someone at work opened a zipped file that was “supposed” to be a photo
and then suddenly we are being driven crazy with what appears to be
mulitiple messages but i’m not sure if we are sending them or they are being sent to us,
avast window opens saying warning suspicious message has been detected,
i click don’t send about 30 times
and then it stops for a couple of hours.
we have avast and a firewall.
i ran trend micro and it found “worm_agent.afbf”
but when i tried to clean it, it said it couldn’t get rid of it.
i ran the avast online virus scan but it didn’t seem to have this one listed.
the scan came up clean.
[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04:04 AM, on 11/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Here is my very own training course for the busy business owner:
Chapter 1
Rule 1
Do not open any attachments received by email unless you are expecting the email. In the event of receiving an email attachment which appears to be from a trusted source, check with the source if the email is unexpected. Do not rely on any AV product to detect all malicious attachments.
With this degree of suspicion required when opening seemingly legitimate email attachments from known sources, take it as read that any email attachment from an unknown source purporting to contain something interesting is almost certainly a Trojan horse, and clicking on it will compromise confidential information and waste valuable time and/or expenses in dealing with compromised security.
As to the log,
Go to Task Manager and kill spwnplizeunb.exe if you can.
Run HijackThis again, close all other windows, put a tick next to these entries and click ‘fix’.
Run HijackThis! again. Click on Config, then Misc Tools, and then press the Delete an NT service… button. Enter ‘ejm5weoawwuc’ (without quotes) and press OK.
thanks for the advice for the business owner,
i am showing this to him…
and telling him how long it took to get rid of this
all so he could see a picture of paris hilton.
(snort)
anyhow.
i also d/l’d the superantispyware after i left the log copy here
and ran that. it found the same “spwnplizeunb.exe”
that you have said.
the superantispyware said that it removed that .exe but
should i still do all that you suggested or will there be an
easier way to check before i do all that?
sorry if these are simple questions, i’m better with computers
than my boss but not as smart with them as my husband so…
i’m middle of the road.
opened task manager,
that spwnplizeunb.exe file was not there.
ran hijack this again and checked log,
the only one that matched with what you said to look for
was O4 - HKLM..\Run: [fadcdhd] C:\WINDOWS\system32\fadcdhd.exe
the other two are no longer there.
does this mean it is gone?
or should i click that one file to fix
and continue with instructions?
;D
