V
vernon
Has anyone encountered and solved this fake spy?
N
nass
vernon said:
Trojan.Fakeavalert
http://www.symantec.com/security_response/writeup.jsp?docid=2007-101013-3606-99&tabid=2
http://www.bleepingcomputer.com/forums/topic120923.html
Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx
Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html
Lots of tools to download and disinfect your machine (offline scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/
After the scan run disk cleanup on your drive.
try to run the Hijackthis and send the log to one of many forums and please
can you send me one at here:
to_you_rossatyahoo.co.uk (replace the at with@ to email me -!= _ ) for more
help, if you wish.
2- Download the Hijackthis and send the report to one of many
forums for analysis and troubleshooting:
http://www.merijn.org/index.php
When all else fails, HijackThis v2.0.2
(http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis) is
the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
Let us know how it is going.
nass
V
vernon
I'll give it a try.
Thanks.
If it doesn't work, it's ALL your fault >
Thanks.
If it doesn't work, it's ALL your fault >
nass said:
S
Sushant
Hi Nass,
gotta help me buddy...I have got infected by this trojan (gomyhit.com). I
have run NAV 2005 and I think it has detected and removed the trojan (I don't
get those annoying pop ups anymore which I used to get previously). Now the
problem is each time upon boot of my PC I get an error message as below:-
"RUNDLL
Error loading C:/Windows/System32/drvlir.dll
The specific module could not be found."
Everything else seems O.K. and I am able to work on my system as before.
Please solve this problem. Any help would be appreciated.
Thanks very much
Sushant
=================================================
gotta help me buddy...I have got infected by this trojan (gomyhit.com). I
have run NAV 2005 and I think it has detected and removed the trojan (I don't
get those annoying pop ups anymore which I used to get previously). Now the
problem is each time upon boot of my PC I get an error message as below:-
"RUNDLL
Error loading C:/Windows/System32/drvlir.dll
The specific module could not be found."
Everything else seems O.K. and I am able to work on my system as before.
Please solve this problem. Any help would be appreciated.
Thanks very much
Sushant
=================================================
nass said:
E
Elmo
Sushant said:
The reference to the file was not removed from the registry.
Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file into the search pane. Click "Find Next", and
when located, delete the reference to the file. Press F3 to continue
the search.
You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.
You could click Start, Run, type MSCONFIG, click OK, click the StartUp
tab, and deselect the item(s). When you restart the computer, you will
be warned that you're running in the Diagnostic mode; click to not alert
you again, and OK out. You won't see the message again. But I think
it's best to just remove the references from the registry.