www.antiviruspro.com Is This A Trojan?

[Damian]

What's in a Name? wrote:
> After much thought,Little Clevis came up with this jewel:
>
>>
>> "Dustbin" <Bughumper@gemail.come> wrote in message
>> news:462f7d8d$0$16343$88260bb3@free.teranews.com.. .
>>> www.antiviruspro.com-Spyware? wrote:
>>>> This pops up all the time. Where is it located so I can remove
>>>> it? It has jammed up programs, browser etc and ruins a computer.
>>>> I have zone alarm, avast, pest patrol and other high quality
>>>> detection programs but am not able to remove this.
>>>>
>>>> Sometimes I get drive scrubber pop up.
>>>
>>> Install SP2, install a Firewall, block port 135, do one or all.
>>
>> WOW that was helpful Dustman. Guess you can't read either.
>>>
>
> he should change his name to dusted.........
>
> "and he knows toasted!"

Dustbin is on the right track, it's an old XP problem.

[Dustin Cook]

"Damian" <nospam@rabid-dog.net> wrote in news:462fe8fe$0$97227$892e7fe2
@authen.yellow.readfreenews.net:

> What's in a Name? wrote:
>> After much thought,Little Clevis came up with this jewel:
>>
>>>
>>> "Dustbin" <Bughumper@gemail.come> wrote in message
>>> news:462f7d8d$0$16343$88260bb3@free.teranews.com.. .
>>>> www.antiviruspro.com-Spyware? wrote:
>>>>> This pops up all the time. Where is it located so I can remove
>>>>> it? It has jammed up programs, browser etc and ruins a computer.
>>>>> I have zone alarm, avast, pest patrol and other high quality
>>>>> detection programs but am not able to remove this.
>>>>>
>>>>> Sometimes I get drive scrubber pop up.
>>>>
>>>> Install SP2, install a Firewall, block port 135, do one or all.
>>>
>>> WOW that was helpful Dustman. Guess you can't read either.
>>>>
>>
>> he should change his name to dusted.........
>>
>> "and he knows toasted!"
>
> Dustbin is on the right track, it's an old XP problem.

Well, actually, if it was a messenger message, sure.. But, it's likely a
desktop hijack; And his advice is too late for that. ;p Sp2 might even
fail to install depending on what he has exactly, worse, it could fail
partially into the install, leaving a potentially dead in the water
system. *hahahah*. You and your trolling friend have lots to learn
hahaha

He should scan his box in safe mode with reputable products, including
BugHunter. In fact, it's quiet possible BugHunter alone can fix the
issue; but I still recommend you use multiple scanners just to be safer.

Some suggestions in random order:

SuperAntiSpyware
BugHunter
Adaware
SpyBot Search and Destroy


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[David H. Lipman]

From: "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com>


|
| Well, actually, if it was a messenger message, sure.. But, it's likely a
| desktop hijack; And his advice is too late for that. ;p Sp2 might even
| fail to install depending on what he has exactly, worse, it could fail
| partially into the install, leaving a potentially dead in the water
| system. *hahahah*. You and your trolling friend have lots to learn
| hahaha
|
| He should scan his box in safe mode with reputable products, including
| BugHunter. In fact, it's quiet possible BugHunter alone can fix the
| issue; but I still recommend you use multiple scanners just to be safer.
|
| Some suggestions in random order:
|
| SuperAntiSpyware
| BugHunter
| Adaware
| SpyBot Search and Destroy
|

Correct. It is a Vundo Trojan/Virtumonde Adware infection causing the Pop-Ups.
That's why David Rankin's advice was apropos.

BugHunter may not be useful as the Trojan uses a combination of a Browser Helper Object and
Winlogon Notify construct. I'm not sure if BugHunter can handle this type of malware.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Dustin Cook]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:guxZh.4335$st3.1754@trnddc06:

> From: "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com>
>
>
>|
>| Well, actually, if it was a messenger message, sure.. But, it's
>| likely a desktop hijack; And his advice is too late for that. ;p Sp2
>| might even fail to install depending on what he has exactly, worse,
>| it could fail partially into the install, leaving a potentially dead
>| in the water system. *hahahah*. You and your trolling friend have
>| lots to learn hahaha
>|
>| He should scan his box in safe mode with reputable products,
>| including BugHunter. In fact, it's quiet possible BugHunter alone can
>| fix the issue; but I still recommend you use multiple scanners just
>| to be safer.
>|
>| Some suggestions in random order:
>|
>| SuperAntiSpyware
>| BugHunter
>| Adaware
>| SpyBot Search and Destroy
>|
>
> Correct. It is a Vundo Trojan/Virtumonde Adware infection causing the
> Pop-Ups. That's why David Rankin's advice was apropos.
>
> BugHunter may not be useful as the Trojan uses a combination of a
> Browser Helper Object and Winlogon Notify construct. I'm not sure if
> BugHunter can handle this type of malware.
>

Morning Dave!

BugHunter can deal with winlogon based malware now, as finally; I can
suspend the services and terminate winlogon. It should have been done
awhile ago, but better now than never.

Vundo seems to be making the rounds alot lately...


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[David H. Lipman]

From: "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com>


| Morning Dave!
|
| BugHunter can deal with winlogon based malware now, as finally; I can
| suspend the services and terminate winlogon. It should have been done
| awhile ago, but better now than never.
|
| Vundo seems to be making the rounds alot lately...
|

Vundo has been making the rounds for 2+ years. It is a prevalent infector and has morphed
at least three times in the last 2 years.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Dustin Cook]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:bANZh.2338$KP1.2193@trnddc02:

> From: "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com>
>
>
>| Morning Dave!
>|
>| BugHunter can deal with winlogon based malware now, as finally; I can
>| suspend the services and terminate winlogon. It should have been done
>| awhile ago, but better now than never.
>|
>| Vundo seems to be making the rounds alot lately...
>|
>
> Vundo has been making the rounds for 2+ years. It is a prevalent
> infector and has morphed at least three times in the last 2 years.

Hmm. I've seen more systems infected lately than usual with it... Atleast
it's not morphed as much so far as zlob... sheesh.




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[David H. Lipman]

From: "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com>


|
| Hmm. I've seen more systems infected lately than usual with it... Atleast
| it's not morphed as much so far as zlob... sheesh.
|

ZLob is even MORE prevalenty and has morphed evn more. It is interesting to note there is
SOME overlap between the ZLob family and the malware offered by Amaena.Com.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm