Opachki.ru

[jimbeam]

Hello,

I get the following message when checking for problems:

Error during check!
Opachki.ru [1 - $8733DD3A] (TRegExpr(comp): Unmatched [] (pos 17))

Six of these messages are coming up. Different to previous posts on this topic, it doesn't say anything about administrator rights being the cause of the problem.

I'm using Spybot v.1.6.2.46 with windows XP 2002.

Any ideas? Thank you in advance.

[spybotsandra]

Hello,

Please wait for the next detection update coming on 2009/10/28 - this should fix it.

Best regards
Sandra
Team Spybot

[jimbeam]

thanks!

[petula]

Hello,

I get the following message when checking for problems:

Error during check!
Opachki.ru [1 - $8733DD3A] (TRegExpr(comp): Unmatched [] (pos 17))

Six of these messages are coming up. Different to previous posts on this topic, it doesn't say anything about administrator rights being the cause of the problem.

I'm using Spybot v.1.6.2.46 with windows XP 2002.

Any ideas? Thank you in advance.

I am getting the same sort of set of errors with the first numbers starting at 4 and ending in 24 and I am updated to the latest version as of today (10th December 2009). Do I have a Trojan?

[spybotsandra]

Hello,

And you really have Spybot version 1.6.2 and not an old one like 1.6.0?


Best regards
Sandra
Team Spybot

[NoNaMeStoleMyName]

Is there any known source for this one? (opachki.ru)

[tashi]

Hello,

Is there any known source for this one? (opachki.ru)

Not sure what you mean by 'source'.
http://isc.sans.org/diary.html?storyid=7519

Cheers.

[NoNaMeStoleMyName]

Thanks for link...
Worries me, it's the only malware that ever got threw to my personal computer.
In years... Trying to find out where it came from? How did I catch this?
And... Is my computer REALLY cleaned up from it?

[tashi]

Hello NoNaMeStoleMyName,

In years... Trying to find out where it came from? How did I catch this?
And... Is my computer REALLY cleaned up from it?

From that link,

This prevents the system from booting in Safe Mode – the attackers did this to make it more difficult to remove the trojan.

I don't know why they do this, it could be that they are hijacking ZEUS or simply competing for same machines or using same attack vectors as the ZEUS crew.

Can you boot in safe mode and/or is your browser being hijacked? If you were infected by Opachki.ru it is possible Zeus/Zbot was there first. As there are many Zeus variants the detection rate by security programs, anti-virus etc, has been spotty.

From the blog of Gary Warner, director of research in computer forensics at the University of Alabama, Birmingham.
http://garwarner.blogspot.com/search/label/zbot
http://garwarner.blogspot.com/2009/0...continues.html

If your computer shows signs of infection or you need reassurance you can follow the instructions in this link to produce a HJT log: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Then start your own thread in the Malware Removal Forum

A volunteer analyst would advise you as soon as available, bear in mind the forum is busy plus it's the weekend and holiday season.

Best regards,

[petula]

Hello,

And you really have Spybot version 1.6.2 and not an old one like 1.6.0?


Best regards
Sandra
Team Spybot

for replying.
I am not very used to this sort of thing - first of all this is a forum right? I am confused by your message stating not to use personal messages?
Also, it seems I have 1.6.0.30....
So I presume I am supposed to uninstall this and install the new one?
again.