PWS-Pinch Password Stealer ? help

[Guest]

my microsoft anti spyware found PWS-Pinch Password Stealer and
Trojan.Downloader.Small.popcorn64 Trojan Downloader on my pc , yet nothing
else (norton 2005 , ad aware , spy bot ) has found it.I tryed to delete the
files with microsoft anti spyware but thay come back on system restart and
the windows files thay are conected to are invisiable
(c:\windows\system32\hlmicro.exe and c:\windows\system32\bndmod.exe) . Any
help please e-mail (e-mail address removed)

 

[Bill Sanderson]

This looks important to follow up on to me.

Please update both Microsoft Antispyware (new defs came out late yesterday)
and your antivirus app. Then restart Windows in safe mode.

Do full, deep scans with Microsoft Antispyware until a scan comes through
clean--and do similar scans with your antivirus as well.

Let's see whether safe mode is enough to make sure that the files aren't in
use, and enable Microsoft Antispyware to do a better job of cleaning.

If this does not do the job, I'd recommend downloading a trial of the Ewido
suite, and doing a scan and removal with that tool.

 

[Guest]

thanks for the tips bill , ewido works good . it found lots of things the
others could not but i have one problem id hope you could help me with . im
getting this with 6 things left after the scan (even under safe mod with
admin rights)TrojanDownloader.Agent.uj : Error during cleaning hope u can
help i dont want to format

 

[Guest]

I don't know for sure what your situation is--I've not got a lot of
experience reading Ewido output.

This thread:

http://www.castlecops.com/postp638581.html

shows your error, but doesn't comment on it.

This is what I'd recommend. Go to a forum--either at Castlecops (above url)
or at

http://aumha.org/a/quickfix.htm

register, and go through their self-help cleaning routines. Then download
HijackThis, and post your log in one of their forums. That should get you
help for exactly what you've got left, if anything. Formatting shouldn't be
needed, I think--but read up on the capabilities of what you've removed, and
think about what might have been compromised...