detected Zolob, removed, and still there

[Guest]

I just upgraded to Beta 2 and ran a scan. It only found something called
Zolob and said it was a severe alert level. I selected remove, and it seemed
to do its thing and removed it. Whenever I restart my computer, Defender
comes back up saying Zolob is on my system and needs to be removed. This has
happened everytime I restart the machine. I now have a history log of having
removed Zolob 3 times in 2 days but it apperantly is still on my system.

The software has all the latest definitions and software updates as well.

 

[Guest]

Hi Joe,

Could you paste the system event log entry of what's still being detected
here?

I also recommend trying a safety.live.com scan, since this guys a trojan.

Thanks for trying Windows Defender,
Joe

 

[plun]

Hi Joe

Zolob is the carrier trojan for Spywarestrike, Spyaxe, Spyfalcon
and so on.

Maybe Safety Live is enough but I belive just must go deeper beacuse
of a smitfraud infestion.

This procedure shows how to get rid of this:
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview

Details within step 3 with a Smitrem.exe removal.

regards
plun

 

[Guest]

1st, thanks for all your suggestions. I atempted the removal procedure
recommended by plun without success. once in safe mode i didn't find any
referrence to SpyFalcon in the add/remove programs. I went ahead and ran the
SmitRem and Ewido. The only things that Ewido found and removed were several
thousand tracking cookies in the norton protected recycle bin.

Restarting the system after attempting to clean insafe mode, WD popped up
again saying I still have Zolob.

Here's the summary from WD about Zolob:

Category:
Trojan Downloader

Description:
This program has potentially unwanted behavior.

Advice:
Remove this software immediately.

Resources:
regkey:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{e0103cd4-d1ce-411a-b75b-4fec072867f4}

bho:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{e0103cd4-d1ce-411a-b75b-4fec072867f4}

Summary:
Internet Explorer Add-ons change occurred.

This agent monitors additions to IE, such as new toolbars, browser helper
objects, and ActiveX controls. These add-ons can automatically run when IE is
started.

Checkpoint:
Browser Helper Objects

Finally, another thing I noticed before attempting to remove this thing in
safe mode was that all my bookmarks in Firefox have disappeared. Even after
running the removal tools, they are still gone.

Please, and suggestions?

Thanks
Joe

 

[Mike Treit [Msft]]

Please try running a "quick scan" from:

http://safety.live.com/site/en-US/s...=safety&goback=/site/en-US/center/howsafe.htm


And let me know if that fixes the problem.

Thanks

-Mike