Results 1 to 2 of 2

Thread: Cannot remove Win32.tiny.abk

  1. #1
    Junior Member
    Join Date
    Jan 2008

    Default Cannot remove Win32.tiny.abk

    Spybot identifies Win32.tiny.abk on my system but cannot remove it.

    I am running Spybot S & D update 1/31/08. Windows XP SP2, all updates.
    I have tried with earlier versions and I have tried in safe mode.The files which are identified are removed by S&D, but then return after a restart, and ONLY after I enable my network connection.

    The files identified by the latest version are

    Previous versions of S&D (1.4) also identified the following:
    but these files are no longer identified by S & D as part of the Win32.tiny.abk threat, even though they appear with the other tmp files on a restart.

    I was originally infected by clicking on a link sent to me in a 'spoofed' instant message in Pidgin from one of my contacts. S&D picked up on and fixed that problem. Also, I found and deleted the following files:
    C:\Program Files\Helper\superfindout.dll

    One other thing I have noticed is that there is constant activity on my network connection; sending & receiving, approx 5kb/s.

    I received a warning from my ISP for 'unwanted activity', so I tried the 'netstat'
    command in DOS, and it spit out a list of hundreds of connections/sites in different HTTP states.

    No other anti-virus can find anything, except for AVG which tells me that shell32.dll has been changed.

    Please help! Thanks for any suggestions.

  2. #2
    Junior Member
    Join Date
    Jan 2008

    Default More info

    Using 'netstat -bv' as well as the Spybot Process List, I have found that the process generating the network connections is services.exe.

    Also, the remote port of every connection is 25, which is the common port for sending mail to a SMTP server, so I guess my system is sending hundreds of spam emails.

    The netstat -bv results look like this;
    Proto----Local Address-------Foreign Address---------State
    -- unknown component(s) --

    I have found that I cannot disable these modules using Spybot.

    There are more than 40 'Loaded modules' within services.exe according to the Spybot Process List, but I don't know how to identify the troublemaker (if different that above). I looked at each file in explorer, and the only thing I know to do is to check the timestamps - and they all look old (2006/mid 2007).

    When I start 'randomly' killing modules to identify the problematic one, I eventually get the System shut down notice, and my system becomes unusable.

    Any help would be greatly appreciated.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts