Printable View
Hey all
Anyone seen this virus before? It changes your wallpaper. Anyone know anything about it and how to remove it?
You can rename the zip file to a jpeg or gif to view.
Please dont be scared to open the file, its only a picture.
Any help appreciated.
Thanks.
Kind of a scary name for a thread :)
I tried changing the ext to .jpg and .gif, but could not open the file.
edit: Guess I misunderstood, I had to extract the file from the archive, then change the extension. I have not seen that before, but I would run the usual scans... which you have probably done. Have you had any luck getting rid of this thing?
Greetings Cider,
I have faced these neat liittle spyware viruses before. here is some rationale behond how it works. The virus has changedyour desektop to use a homepage. It can get tought ot delete whereas it will probably duplicate itself when you restart your computer. First I will need some information. Can you download a copy of HiJackThis and run it and copy the log to tihs thread please? From there I can see whats running when your computer turns son as well as how your registry and startup has been changed.
Sorry if my post was abit vague :)
I havent had any luck getting rid if this.
Any ideas ?
What about hijack this...as previously suggested?
MLF
Try a-squared free: (3rd one down on the site)
http://www.emsisoft.com/en/software/download/
It works for me every time...or try the trial version of counterspy if that doesn't work:
http://www.sunbelt-software.com/Home...ce/CounterSpy/
these will hopefully get rid of it :cool:
Yup Ive seen that exact one before :-P Its been awhile but some of those desktop hijacks use active desktop to put a fullsize web page on your screen so even if you change you wall paper it still shows up :-P
So...turning off active desktop would break it?
smitfraud fix by siri!
run it in safemode. Then run the usual suspects (adaware, avg, spyware doctor, spy sweeper, kaspersky, autoruns and hijackthis)
should clean it, but make sure to run a disk cleanup. Should do it.
What you have is a smitfraud variant
Hey dark.
You see I work for Panda so using 3rd party tools is abit of a no no :)
But Ill give it a go ...
I don't even know what to say about your last post Cider :D
What is the procedure? Either reformat or wait for Panda to issue a fix? :P
It seems that maybe Panda has a bit of a pride issue... I mean no offense... They make great utilities... your post just struck me as funny... :)
This is what I usually do when removing similar infections. First turn off system restore. Then go into safe mode and run combofix and smitfraud fix. Usually if there's one there's going to be more so I'd do a full run of AV scans.
"You see I work for Panda so using 3rd party tools is abit of a no no"
Seriously, no single software gets everything. For really bad infections I pull the hard drive and have a scanner machine with several AV programs including NOD32, AVG, Antivir, Blink, and SuperAntispyware. There are many times when several programs pickup things the others don't. I'm not saying you need all this for your problem but if you really want to clean a system you need more than one tool.
Well I can see you situation, but alas its a lot faster and easier to use the smitfraud fix than to do it manually.
In fact I did one of these just today manually, I removed privacy_danger which was dropped by privacy protector and of course the trojans and adware that also crippled that poor laptop.
I booted into a pe environment similar to bartpe and pulled up a file explorer then started looking at all file stamps that were suspiciously new. In the case of this computer march 27, 2008 is when the infections hit. So anything from a few days prior to today pretty much got deleted. There are some exceptions such as the wpa.dbl file which has a timestamp of the current day but is a valid file. Too wrap up, I deleted around 2 or 300 of these trojans, and adware files in this way which takes time and is not recommended for the novice or telling someone to do over the phone if they havent done it before. Always check out the files name and its properties for signatures before deleting.
After the above steps, its time to boot into safe mode and use the av/as software to clean up the rest. Deletion of temp files, and startup entries is best to do in the PE environment but can be done in safe mode.
Thank you for everyones replies.
No offence taken! I know it seems funny, but I post here to see what everyone thinks. I do scale it up to Panda Labs to check it out. Its not that I dont go through Panda, I just want to see what everyone else is doing so I can make some judgement on the matter with the client.Quote:
don't even know what to say about your last post Cider :D
What is the procedure? Either reformat or wait for Panda to issue a fix? :P
It seems that maybe Panda has a bit of a pride issue... I mean no offense... They make great utilities... your post just struck me as funny... :)
You see, Panda will only go PANDA'S way and no other way obviously. So by me posting here I see the general vibe on the particular subject, just not one sided.
And I dont trust google :)
But thats for your replies.
Panda has said that with an updated signature file all the smithfraud variants should be taken care of ...