spybot can't remove win32.tiny.abk...

[schitzn]

As a Microsoft MVP in Consumer Security, Im wondering why you endorse a security product that fails miserably when benchmarked.

Sunbelt's firewall is a poor performer in terms of preventing firewall breaches.

Please reference as example
http://www.matousec.com/projects/win...ts-results.php

Zone Alarm Free Edition is even worse than Sunbelt.

Obviously some protection is better than none, but when there are better solutions that are 100% free, why should these two weaker options be endorsed?

[tashi]

Hi there,

As a Microsoft MVP in Consumer Security, Im wondering why you endorse a security product that fails miserably when benchmarked.

The article in question is not mine. I have received permission from the author to update and make adjustments, which I will do after further research.

Thank you for bringing the study to my attention.

Cheers.

[schitzn]

I've ran into another machine with this variant of win32.tiny.abk .

Unfortunately, there does not appear to be any entry in Autoruns and Hijackthis.

Spybot picks up two temporary files under windows\temp\, but does not seem to pick up all traces as it keeps coming back after a re-run.

[schitzn]

I found a solution. Im posting for anyone else unable to find a fix for this.

Boot to the recovery console via your Windows CD and delete all files in the Windows temporary folder. To do so under the recovery console, you need to use the del command and specify the folder %windows%\temp

This tip should not be removed because my instructions are purely safe because its temporary folder anyway.

I wish Spybot would automatically remove this. It appears to me that spybot deletes the file sucessfully, and assumes its gone, however it must still be in memory and writes it back before you shutdown/restart.

[MarcLodge]

Dropped into Recovery console, deleted every file and then the c:\windows\temp directory. Shut down and booted into safe mode and ran spybot - hurray, damned thing had gone. Started normally and ran spybot, and it (along with the temp files) had returned.

[md usa spybot fan]

MarcLodge:

You have a thread in the Malware Removal forum:

• Tiny.W32.abk - S&D detects but is unable to remove
  http://forums.spybot.info/showthread.php?t=25173

tashi edited the first post in that thread with these comments:

Reason: Mod: Merged two posts, added link

The link that was added:

• NOTE:We do NOT ask Users to run fixes before helpers have analyzed HJT/KAV scans

[MarcLodge]

md usa spybot fan,

your point is?

The link that tashi provided does not solve my problem, all it does is chastise me for not reading every sticky and getting the postings of hjt, kas and combo wrong.

Your post does not solve my problem. All it does is, again, remind me that I got it wrong.

I have a virus on a computer that seems to be unsolvable other than to reformat the hard drive.

I would love for someone here to actually try to help me rather than tell me that I didn't post things in the right order. Or, are you saying that because I did, you are unwilling to help???

[schitzn]

Dropped into Recovery console, deleted every file and then the c:\windows\temp directory. Shut down and booted into safe mode and ran spybot - hurray, damned thing had gone. Started normally and ran spybot, and it (along with the temp files) had returned.

Spybot reported two .tmp files in the %win%\temp folder on my machine as win32.tiny.abk.

Are you getting the same file locations on your spybot report?

If not, perhaps make note of the files reported, and manually delete offline (ie. Windows Recovery CD).

[tashi]

The machine MarcLodge posted about was infected, topic in malware removal and looking better now.

http://forums.spybot.info/showthread.php?t=25173&page=2