Results 1 to 10 of 34

Thread: Help with some spyware

Hybrid View

  1. #1
    Join Date
    Apr 2007
    Posts
    27
    Ok I've done that, but I still get the error when my computer starts up.

  2. #2
    Join Date
    Aug 2006
    Location
    The Middle
    Age
    80
    Posts
    4,079
    I am as dumb as a box of rocks! I never had you run HJT again and do the fixes there
    Run HJT again and place checkmarks next to the following entries if they still exist;
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\fiobxsax.dll",setvm
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O15 - Trusted Zone: http://www.ti.com (Did you add this yourself? If NOT then place a checkmark next to this one too. If you DID add it then leave it.)
    O16 - DPF: {20050325-D35A-4233-926E-2E801AE25949} (NMJPStarter15 Class) - http://www.netmarble.jp/_common/cab/NMStarterJP5.cab

    Once you have placed the checkmarks then click the FIX button.
    Exit HJT.
    Reboot and run one more HJT scan.
    If you still get the error then you may have to go into the Registry manually and remove it.

  3. #3
    Join Date
    Apr 2007
    Posts
    27
    Okay that error is gone, thanks for the help. But I think I might have another problem.. there is a hidden folder in my C: drive called Uploads and its directly in it C:\Uploads. Inside of it are 15,000 zip folders all named after popular programs/games and other stuff..and they are all just 1 KB. Is this something to just delete or is there something else I need to do?

  4. #4
    Join Date
    Aug 2006
    Location
    The Middle
    Age
    80
    Posts
    4,079
    Ok, this appears to be a worm.
    WORM_VB.AQ
    This worm also drops the nonmalicious file BSZIP.DLL. It uses the said file to drop its compressed copy, A.ZIP, using ZIP compression.
    This worm creates UPLOADS folder in the root directory, which is usually C:/. It then drops several .ZIP copies of itself using file names of known applications in the created folder.
    Go here Trend Micro HouseCall

    Do their online scan and see if it will fix.

  5. #5
    Join Date
    Apr 2007
    Posts
    27
    Sorry for not posting a reply. I haven't been able to get to the computer at all this week. It seems my brother has downloaded some "game" or something... and unleashed a bunch more spyware on my computer. I tried using Trend Micro HouseCall but it froze during the cleaning process, and then caused internet explorer to crash. Should I try it again? And should I start the whole cleaning process over again now?

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •