The Storageprotector.com Malware

eaml
eaml
in Malware talk

It seems this storageprotector.com malware has been spreading for a month and there is not a cure yet. Still looking for instructions all over the world. Just wondering if I can reinstall the OS to get rid of it to avoid the pain.


Symptoms:


Many different fake system warnings, the one on the startup is this:


Important : Potential errors found in the system.


During a scan of files at system startup, potential errors in the system registry were found.


p-07-0100 irql: 1f SYSVER 0xff0024


NT_Kernel error 1256


KMODE_EXCEPTION_NOT_HANDLED


Icons on Desktop - If i delete them, they come back moments after.


Icon1 : "Windows Update" with target location of -> "http://storageprotector.com"


Icon2 : "Help and Support Center" with target of -> "http://storageprotector.com"


over 5000 files have spread in Drive C.... " .tmp " " .sqm " files extensions

Comments

  • farbar
    farbar ✭
    ... Just wondering if I can reinstall the OS to get rid of it to avoid the pain.


    I think theoretically you can if you have one partition or if you have more partitions but the other partitions are not infected or all the partitions are infected but you reformat all partitions.


    But the question remains as how you got infected at the first place? Let say you have a vulnerability in your system (OS or software) and you reinstall all your software prior to the infection. You are not infected any more but may get infected again as soon as you get to the environment where the malware is active and haunting.


    But coming to the first part of your statement:


    It seems this storageprotector.com malware has been spreading for a month and there is not a cure yet. Still looking for instructions all over the world.


    I may be wrong but I think in many cases there is still a cure. In many cases there are tools one can use if a malware get passed your AV line of defense. I don't see this one as an exception and it can be defeated but sometimes you may have to improvise.

  • Niels
    Niels ✭
    edited January 2008

    Dear eaml,


    Installing an operating system is a little bit too drastic. I recommend that you please do this:


    Download rogueremover you can download it here (you have to press on 1 of the download links. Install it start rogueremover press on check for updates, press again on check for updates. If there are updates available you will be informed about it confirm it and press on download. Press on close when there aren't any updates anymore. Now press on scan and let it remove everything.


    After that download and install superantispyware. Confirm the message for searching for updates. You will now see that Superantispyware screen is minimized left click on it and follow the steps.Change your default home page to the page that it was originally. Press on finish. Now you are in the main screen of superantispyware press on scan your computer,perform complete scan and press next.


    Make also a log with hijack this. You can download hijack this here. Double click on the HijackThis shortcut choose do a system scan and save a logfile. Wait till it finishes. Add the scan report at your next post or copy the content of the scan into your next post.


    Best regards


    Niels

  • eaml
    eaml

    I used lots of methods including vundofix and combofix. Now there seems no symptoms. However, the computer acts weird sometimes. I think this is still something wrong with it. here is a hijackthis log. Would you please take a look?


    C:\WINDOWS\system32\csrss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Rising\Rav\CCenter.exe


    C:\Program Files\Windows Defender\MsMpEng.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\PROGRAM FILES\RISING\RAV\Ravmond.exe


    c:\program files\rising\rfw\rfwsrv.exe


    c:\program files\rising\rfw\rfwstub.exe


    C:\PROGRAM FILES\RISING\RAV\RavStub.exe


    C:\WINDOWS\Explorer.EXE


    c:\program files\rising\rfw\rfwproxy.exe


    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\System32\alg.exe


    C:\Program Files\Windows Defender\MSASCui.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\Super Rabbit\MagicSet\srgui.exe


    C:\Program Files\Super Rabbit\MagicSet\SRCK.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\Program Files\Windows Live\installer\WLSetupSvc.exe


    C:\Program Files\Google\Google Talk\googletalk.exe


    C:\Program Files\Windows Live\Messenger\msnmsgr.exe


    C:\Program Files\Windows Live\Messenger\usnsvc.exe


    C:\Program Files\foobar2000\foobar2000.exe


    C:\Program Files\rising\Rav\RavMon.exe


    C:\Program Files\Mozilla Firefox\firefox.exe


    C:\Program Files\DAEMON Tools\daemon.exe


    C:\WINDOWS\System32\wbem\wmiprvse.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll


    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll


    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll


    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll


    O3 - Toolbar: 9Flasher - {F6D2088C-01E2-444A-8BB9-66AC73FD4775} - (no file)


    O4 - HKLM\..\Run: [iMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [iMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload


    O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup


    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background


    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart


    O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html


    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html


    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html


    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html


    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html


    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html


    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html


    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html


    O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm


    O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm


    O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


    O9 - Extra button: D??￠?ì?÷ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL


    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe


    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O15 - ESC Trusted Zone: http://*.update.microsoft.com


    O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://qp1.jur.lu.se/qp2.cab


    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://eaml.spaces.live.com//PhotoUpload/MsnPUpld.cab


    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1168097530871


    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://eaml.spaces.live.com/PhotoUpload/MsnPUpld.cab


    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab


    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL


    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe


    O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe


    O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe


    O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe


    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  • Niels
    Niels ✭

    Dear eaml,


    I can't find anything suspecious in your log. Can you please say what do you mean with strange? You could try this check your hard disc for errors to do that click on my computer now right-click on the hard disc or partition that you wanted to be scanned click on properties,click on the tools tab,check everything in the error checking section,press on yes. Reboot your pc now and let chdsk run. After you have done that right click on my computer,click once on a hard disc or partition,right click on it choose properties,click on the tools tab and defragment now button. Go to start,run,type msonfig at the run dialog box press enter click on startup tab and enter everything what you find under item for startup on this website if you see an N or X uncheck the radio box. Type now regedit at the run dialog box press enter. Now expand hkey_local_machine registry key and the following folders and subfolders: software,microsoft,windows,currentversion,run. Take a look at the right side enter the names also on the website. But now you have to delete it left click on it and press on the delete button of your keyboard.


    Best regards


    Niels

  • badbeat
    badbeat
    edited January 2008

    Niels,


    I have been having same problem on family member's PC as original poster...


    I had them run spysweeper, then vundofix...


    then based on this thread, I had them run Rogue Remover and didnt find anything, then ran Superantispyware and found like 150 trojans and 400 or so adware. They removed then rebooted and it still keeps finding like 15-20 things that it doesnt seem to remove.


    Here is now the current HJT log, thanks for any assistance:


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 3:12:19 PM, on 1/21/2008


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16574)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\runservice.exe


    C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS


    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe


    C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Viewpoint\Common\ViewpointService.exe


    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


    C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe


    C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI .exe


    C:\WINDOWS\system32\wscntfy.exe


    C:\WINDOWS\system32\rundll32.exe


    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Sds.exe


    C:\Program Files\Webroot\Spy Sweeper\SSU.EXE


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


    F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhfg.exe


    O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll


    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll


    O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm


    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html


    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm


    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll


    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll


    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe


    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com


    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204


    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1135982608687


    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirel...loadControl.cab


    O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab


    O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB


    O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj...ploadClient.cab


    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab


    O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv1.view22.com/view22/app/view22rte.cab


    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab


    O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab


    O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://secure.moffitt.org/dana-cached/setu...perSetupSP1.cab


    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe


    O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows


    O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS


    O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe


    O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe


    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


    --


    End of file - 6508 bytes

  • badbeat
    badbeat

    created own topic

  • eaml
    eaml
    Dear eaml,


    Can you please say what do you mean with strange? Best regards


    Niels


    For example, when I double click on C:, it doesn't open, instead a new search window pop out, and the icon of C: is a red x. When I tried to attach a file which I put on desktop, system reminded me that desktop is not found. My anti-virus software won't initiate automatically at the startup.

  • tekkie
    tekkie

    as of today, on a winXp sp2 box infected with storageprotector.com malware...


    norton av called it Trojan.Metajuan, but could not remove it, even in safemode.


    not sure if the trojan brought storageprotector or vice-versa....whatever


    i had these un-deletable files (!killbox could not de-reg or kill them, even on reboot)


    c:\windows\system32\ddcyavm.dll


    c:\windows\system32\ssttq.dll


    c:\windows\system32\xqulmsvj.dll


    and had dozens of places in the registry reference those dlls - they'd keep coming back


    and the bogus startup error warnings "Important - Potential errors found in the system..."


    and thousands of tmp files [posFF30.tmp...] (keylogger output?)


    and systray warnings about kernel panics and somesuch [*** STOP**...]


    and the bogus "Windows Update" and "Help and Support Center" official-iconized shorts to storageprotector.com


    only one thing removed it: superantispyware. be sure to get the latest defs.


    http://downloads2.superantispyware.com/dow...AntiSpyware.exe

All Time Leaders

Categories

Defenders of the month