Text 9303, 64 rader
Skriven 2005-07-11 14:18:22 av Charles Scaglione (1:123/789.0)
   Kommentar till text 9286 av August Abolins (1:229/2000)
Ärende: spamblockerutility mess..
=================================
On Mon, 11 Jul 2005 01:42:46 -0400, August Abolins -> All wrote:

Hi August:

 AA> A friend of mine managed to be a victim of SpamBlockerUtility.  I
 AA> removed as much of this nuisance as I could.

 AA> Ran HijackThis and noticed "spamblockerutility" references, and
 AA> something called "firewall_anti".  Checking on the web, both seem to be
 AA> Hotbar related.  I allowed HJT to remove them.  I also deleted the files
 AA> with those names manually.

 AA> I rebooted the system.  But the firewall_anti still seemed to be messing
 AA> around.  One thing I noticed, before I started into any of this, was
 AA> that the basic XP firewall was disabled!  Even after enabling it, at
 AA> next reboot, it would be unchecked!

 AA> The existing installation of AVG reported that some subcomponent of
 AA> files were corrupt and could not proceed with an Update.  But I could
 AA> run the scan.  It reported 5 problems: Boot sector change, and changes
 AA> to kernel32.dll, user32.dll, shell32.dll and ntosknl.exe.

 AA> The SpyBot installation would not even run.  I rebooted to SafeMode,
 AA> installed SpyBot 1.4, tried to run it but it refused.  Booting normally,
 AA> SpyBot ran ok, but detected nothing.

 AA> Reinstalled a fresh copy of AVG, and it detected 3 things - but "healed"
 AA> 2 of them.  I wanted to reboot into Safe Mode but the system couldn't -
 AA> it reported that "ntoskrnl.exe is corrupt" and needed to be replaced
 AA> inorder to proceed.  Thankfully, I could still boot into normal mode.

 AA> Something was still messing around with the XP firewall setting; it was
 AA> disabled again!  Ran TrendMicro Housecall.. it detected 3 "Hotbar"
 AA> related things and 17 cookies.  I allowed House Call to remove them all.

 AA> At next boot, the firewall setting was not modified (it was still
 AA> enabled the way I left it before reboot), but something is still trying
 AA> to "dial out" since the internet connection window is popping up.  I had
 AA> previously set that up to NOT auto-connect.

 AA> So.. something is still taking over.    And, obviously the ability to
 AA> boot into SafeMode has been taken away.  :(

 AA> What's the concensus?    The 4 modified .DLL's concern me.  I would
 AA> normally GUESS that those particular files can't be replaced
 AA> individually.

At this point in time (along with the info from your other message) I
would say try to save what data from his system that you are able,
reformat, and reinstall XP.

Reinstall using a slipstream copy of XP to include SP2, afterward,
download and install all updates post SP2. (There are probably 30 or so
updates and patches).

Kind of a drastic recommendation, but it actually may save time over the
long haul.

Regards.

chscag@gmail.com

--- Pan/0.14.2.91 (As She Crawled Across the Table (Debian	GNU/Linux))
 * Origin:  (1:123/789.0)