Friday
2008-11-28, 18:20
The following instructions have been created to help you to get rid of "29a7" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Removal Instructions:
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
A file with an unknown location named "29a-7_full_edition.zip".
A file with an unknown location named "HYBRIS.RAR".
A file with an unknown location named "LPE-DLX.ZIP".
A file with an unknown location named "BG.BMP".
A file with an unknown location named "MUSIC.MP3".
A file with an unknown location named "DELIKON.ZIP".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "EVWHOWTO.ZIP".
A file with an unknown location named "XAUDIO.DLL".
A file with an unknown location named "intro.exe".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "HXDEF100.ZIP".
A file with an unknown location named "HKIT.RAR".
A file with an unknown location named "NAS096B.ZIP".
A file with an unknown location named "DOS.ZIP".
A file with an unknown location named "ZAIKA.ZIP".
A file with an unknown location named "MLDE32.ZIP".
A file with an unknown location named "GODZIILA.ZIP".
A file with an unknown location named "FREEBIRD.ZIP".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "INCONEX.ZIP".
A file with an unknown location named "HEMPHOPE.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "STIGMA.ZIP".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "INJEVIL.ZIP".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "GBG.ZIP".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.023".
A file with an unknown location named "DAMAEXPL.ZIP".
A file with an unknown location named "SEROTONI.ZIP".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "ZERT.ZIP".
A file with an unknown location named "DAMA2.ZIP".
A file with an unknown location named "IRXP.ZIP".
A file with an unknown location named "29A-7.EXE".
A file with an unknown location named "SNAIL.ZIP".
A file with an unknown location named "SECRET.DLL".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "FTRANSF.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "FCI.ZIP".
A file with an unknown location named "29A-7.027".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "29A-7.024".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "TIRTHAS.ZIP".
A file with an unknown location named "MYDOOM.ZIP".
A file with an unknown location named "GEORGINA.ZIP".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "ALICIA.ZIP".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "INVISIBI.ZIP".
A file with an unknown location named "VXSNTP.ZIP".
A file with an unknown location named "HOOKLIBR.RAR".
A file with an unknown location named "29A-7.022".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "CALYPZO.ZIP".
A file with an unknown location named "29A-7.027".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "AMON.ZIP".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "EXPLOIT.ZIP".
A file with an unknown location named "PHIDE.ZIP".
A file with an unknown location named "PIECEBYP.ZIP".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "CPU.ZIP".
A file with an unknown location named "URK0.ZIP".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "OPHANDLE.ZIP".
A file with an unknown location named "7FACES.ZIP".
A file with an unknown location named "ELFVIRUS.ZIP".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "GAYBAR.ZIP".
A file with an unknown location named "29A-7.026".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "LINKER.ZIP".
A file with an unknown location named "LADYMARI.ZIP".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "CODEHOPP.ZIP".
A file with an unknown location named "SDATA.29A".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "BOT.ZIP".
A file with an unknown location named "WRARXPLT.ZIP".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "NT_PASSW.ZIP".
A file with an unknown location named "29A-7.021".
A file with an unknown location named "JUNKMAIL.ZIP".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "29A-7.021".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "READER.INI".
A file with an unknown location named "VPCHAMME.ZIP".
A file with an unknown location named "CROISSNT.ZIP".
A file with an unknown location named "29A-7.028".
A file with an unknown location named "RIVANON.ZIP".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "JUNKHTML.ZIP".
A file with an unknown location named "RSALIB.ZIP".
A file with an unknown location named "FLYINGV.ZIP".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "29A-7.IDX".
A file with an unknown location named "NETVIRUS.ZIP".
A file with an unknown location named "BLOCKEXT.ZIP".
A file with an unknown location named "29A-7.032".
A file with an unknown location named "EFISH-C.ZIP".
A file with an unknown location named "EFISH-B.ZIP".
A file with an unknown location named "29A-7.021".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.025".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.026".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.023".
A file with an unknown location named "29A-7.029".
A file with an unknown location named "29A-7.030".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "CATCHY32.RAR".
A file with an unknown location named "RINS.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.025".
A file with an unknown location named "VIRSTR.ZIP".
A file with an unknown location named "CONSCRPT.ZIP".
A file with an unknown location named "RGBLDE.ZIP".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "CROBFTP.ZIP".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "GILDO.ZIP".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "FLY.ZIP".
A file with an unknown location named "BALROG.ZIP".
A file with an unknown location named "SREDIR.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "29A-7.031".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "PRETEXT.ZIP".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "SIAMEXE.ZIP".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "NTRING0.ZIP".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "4096.ZIP".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "HELKERN.ZIP".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "FILE_ID.DIZ".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "29A-7.022".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "29A-7.024".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.009".
Make sure you set your file manager to display hidden and system files. If 29a7 uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Removal Instructions:
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
A file with an unknown location named "29a-7_full_edition.zip".
A file with an unknown location named "HYBRIS.RAR".
A file with an unknown location named "LPE-DLX.ZIP".
A file with an unknown location named "BG.BMP".
A file with an unknown location named "MUSIC.MP3".
A file with an unknown location named "DELIKON.ZIP".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "EVWHOWTO.ZIP".
A file with an unknown location named "XAUDIO.DLL".
A file with an unknown location named "intro.exe".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "HXDEF100.ZIP".
A file with an unknown location named "HKIT.RAR".
A file with an unknown location named "NAS096B.ZIP".
A file with an unknown location named "DOS.ZIP".
A file with an unknown location named "ZAIKA.ZIP".
A file with an unknown location named "MLDE32.ZIP".
A file with an unknown location named "GODZIILA.ZIP".
A file with an unknown location named "FREEBIRD.ZIP".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "INCONEX.ZIP".
A file with an unknown location named "HEMPHOPE.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "STIGMA.ZIP".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "INJEVIL.ZIP".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "GBG.ZIP".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.023".
A file with an unknown location named "DAMAEXPL.ZIP".
A file with an unknown location named "SEROTONI.ZIP".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "ZERT.ZIP".
A file with an unknown location named "DAMA2.ZIP".
A file with an unknown location named "IRXP.ZIP".
A file with an unknown location named "29A-7.EXE".
A file with an unknown location named "SNAIL.ZIP".
A file with an unknown location named "SECRET.DLL".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "FTRANSF.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "FCI.ZIP".
A file with an unknown location named "29A-7.027".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "29A-7.024".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "TIRTHAS.ZIP".
A file with an unknown location named "MYDOOM.ZIP".
A file with an unknown location named "GEORGINA.ZIP".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "ALICIA.ZIP".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "INVISIBI.ZIP".
A file with an unknown location named "VXSNTP.ZIP".
A file with an unknown location named "HOOKLIBR.RAR".
A file with an unknown location named "29A-7.022".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "CALYPZO.ZIP".
A file with an unknown location named "29A-7.027".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "AMON.ZIP".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "EXPLOIT.ZIP".
A file with an unknown location named "PHIDE.ZIP".
A file with an unknown location named "PIECEBYP.ZIP".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "CPU.ZIP".
A file with an unknown location named "URK0.ZIP".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "OPHANDLE.ZIP".
A file with an unknown location named "7FACES.ZIP".
A file with an unknown location named "ELFVIRUS.ZIP".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "GAYBAR.ZIP".
A file with an unknown location named "29A-7.026".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "LINKER.ZIP".
A file with an unknown location named "LADYMARI.ZIP".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "CODEHOPP.ZIP".
A file with an unknown location named "SDATA.29A".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "BOT.ZIP".
A file with an unknown location named "WRARXPLT.ZIP".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "NT_PASSW.ZIP".
A file with an unknown location named "29A-7.021".
A file with an unknown location named "JUNKMAIL.ZIP".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "29A-7.021".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "READER.INI".
A file with an unknown location named "VPCHAMME.ZIP".
A file with an unknown location named "CROISSNT.ZIP".
A file with an unknown location named "29A-7.028".
A file with an unknown location named "RIVANON.ZIP".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "JUNKHTML.ZIP".
A file with an unknown location named "RSALIB.ZIP".
A file with an unknown location named "FLYINGV.ZIP".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "29A-7.IDX".
A file with an unknown location named "NETVIRUS.ZIP".
A file with an unknown location named "BLOCKEXT.ZIP".
A file with an unknown location named "29A-7.032".
A file with an unknown location named "EFISH-C.ZIP".
A file with an unknown location named "EFISH-B.ZIP".
A file with an unknown location named "29A-7.021".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.025".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.026".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.023".
A file with an unknown location named "29A-7.029".
A file with an unknown location named "29A-7.030".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "CATCHY32.RAR".
A file with an unknown location named "RINS.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.025".
A file with an unknown location named "VIRSTR.ZIP".
A file with an unknown location named "CONSCRPT.ZIP".
A file with an unknown location named "RGBLDE.ZIP".
A file with an unknown location named "29A-7.012".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "CROBFTP.ZIP".
A file with an unknown location named "29A-7.007".
A file with an unknown location named "GILDO.ZIP".
A file with an unknown location named "29A-7.013".
A file with an unknown location named "FLY.ZIP".
A file with an unknown location named "BALROG.ZIP".
A file with an unknown location named "SREDIR.ZIP".
A file with an unknown location named "29A-7.004".
A file with an unknown location named "29A-7.015".
A file with an unknown location named "29A-7.031".
A file with an unknown location named "29A-7.019".
A file with an unknown location named "PRETEXT.ZIP".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "SIAMEXE.ZIP".
A file with an unknown location named "29A-7.009".
A file with an unknown location named "29A-7.017".
A file with an unknown location named "NTRING0.ZIP".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "4096.ZIP".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "29A-7.018".
A file with an unknown location named "HELKERN.ZIP".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "FILE_ID.DIZ".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.016".
A file with an unknown location named "29A-7.003".
A file with an unknown location named "29A-7.022".
A file with an unknown location named "29A-7.010".
A file with an unknown location named "29A-7.001".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "29A-7.024".
A file with an unknown location named "29A-7.002".
A file with an unknown location named "29A-7.020".
A file with an unknown location named "29A-7.005".
A file with an unknown location named "29A-7.006".
A file with an unknown location named "29A-7.011".
A file with an unknown location named "29A-7.014".
A file with an unknown location named "29A-7.008".
A file with an unknown location named "29A-7.009".
Make sure you set your file manager to display hidden and system files. If 29a7 uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.