PDA

View Full Version : I've tried everything to clear MicroBillSys infection



Hermie
2007-08-17, 21:21
I still have MicroBillSys even after running SpyBot which found and removed 8 infections. I have followed other threads on the forum and run Brute Force Remover also to no effect. (Thanks Shaba for your earlier input on this)
It is activating every time we start Windows Messenger Live. I can stop it by Uninstalling Messenger, but if I download MSN again from Microsoft and re-install, it's back. I have stopped the pop-up by adding a General Firewall Rule in Norton Antivirus, so I would not be aware of the trojan if I didn't occasionally access Norton Reports & Statistics/View Activity Log/Activities, which reports the following:
An instance of c:\Program Files\MSN Messenger\MsnMsgr.Exe is preparing to access the internet, followed by:
Rule "Firewall Rule MBS" blocked communication. (My added rule)
(Occasionally, it's \\MSN Messenger\livecall.exe that starts the sequence)
Can anyone advise whether it's safe to leave things like this or will MicroBillSys start to cause havoc the longer it's left? Any ideas where it's hiding and how to clear it?
Or, as it isn't active with MSN uninstalled, is there any way of installing a clean version of MSN?
I have spent days on this and it's driving me mad, so all suggestions will be gratefully received.

md usa spybot fan
2007-08-17, 22:06
Rather than try to follow solutions to problems posted in the Malware Removal (http://forums.spybot.info/forumdisplay.php?f=22) forum that appear to be similar to yours, I suggest that you consider posting your own thread in that forum and have someone take a look at your system.

Help in the Malware Removal (http://forums.spybot.info/forumdisplay.php?f=22) forum is usually based on the specific content of the logs posted and therefore does not necessarily reflect the exact solution on other systems.

If you decide to have an experienced malware removal specialist assist you with your particular problem, please follow the procedure in this link to run scans and produce a HijackThis log: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) ( http://forums.spybot.info/showthread.php?t=288).
After you have completed the required scans and produced the requested logs, start your own thread in the Malware Removal (http://forums.spybot.info/forumdisplay.php?f=22) forum, making sure to post the logs produced from the above instructions.

Hermie
2007-08-17, 23:05
:oops: Thanks for getting me back on the right track. As a new user I was stumbling about in the dark a bit and hadn't appreciated exactly how the forum worked or that there was more than one forum for different subjects.
I'll follow your suggestions - I guess I'll need to re-install MSN before I do the scan and report?

Hermie
2007-08-18, 18:22
Please close this thread - I will upload new thread in Malware forum as requested