Popups, Trojan Dropper, Downloader etc.

[rkt428]

http://www.spybot.info/en/home/index.html

Ok I found each and every one of the files above and deleted them.

I also found the c:\windows\system32\kfmfe167.sys file. What do you mean by submit this file here (I can not upload it and I get some jibberish in notepad)? Should I delete this file as well too?

 

[LonnyRJones]

Opps I forgot the url
submit this file here and let me know what was found ?
C:\WINDOWS\system32\kfmfe167.sys
http://www.virustotal.com/flash/index_en.html

 

[rkt428]

Here are my results:

Complete scanning result of "kfmfe167.sys", received in VirusTotal at 08.15.2006, 06:10:11 (CET).

Antivirus Version Update Result
AntiVir 6.35.1.0 08.14.2006 no virus found
Authentium 4.93.8 08.14.2006 no virus found
Avast 4.7.844.0 08.14.2006 no virus found
AVG 386 08.14.2006 no virus found
BitDefender 7.2 08.14.2006 no virus found
CAT-QuickHeal 8.00 08.14.2006 no virus found
ClamAV devel-20060426 08.14.2006 no virus found
DrWeb 4.33 08.14.2006 no virus found
eTrust-InoculateIT 23.72.97 08.15.2006 no virus found
eTrust-Vet 30.3.3019 08.14.2006 no virus found
Ewido 4.0 08.14.2006 no virus found
Fortinet 2.77.0.0 08.15.2006 no virus found
F-Prot 3.16f 08.14.2006 no virus found
F-Prot4 4.2.1.29 08.14.2006 no virus found
Ikarus 0.2.65.0 08.14.2006 no virus found
Kaspersky 4.0.2.24 08.15.2006 no virus found
McAfee 4829 08.14.2006 no virus found
Microsoft 1.1560 08.14.2006 no virus found
NOD32v2 1.1706 08.14.2006 no virus found
Norman 5.90.23 08.14.2006 no virus found
Panda 9.0.0.4 08.14.2006 no virus found
Sophos 4.08.0 08.15.2006 no virus found
Symantec 8.0 08.15.2006 no virus found
TheHacker 5.9.8.192 08.14.2006 no virus found
UNA 1.83 08.14.2006 no virus found
VBA32 3.11.0 08.14.2006 no virus found
VirusBuster 4.3.7:9 08.14.2006 no virus found

Aditional Information
File size: 1064 bytes
MD5: 28eac01ca321c8c946de3e33864fc754
SHA1: 390a53b2154fb43d636670f11e2360056b85ac24

 

[LonnyRJones]

Good . leave it be.

Are there any current problems ?

If not now is the time to go update your windows.

 

[rkt428]

Excellent. So far so good. I have yet to get a popup or adware yet!! I will post again here in a couple of days to let you know if there are any problems, but it looks very promising so far. Thanks so much for your help and time Lonny.

 

[rkt428]

Hi Lonny,

I have been using the computer for a couple of days and it looks like everything is running normal and no popups. Thanks again, I appreciate your assistance buddy.

 

[LonnyRJones]

Hopefully you updated windows, otherwise it will definatly get infected again.

Think Prevention: Put in place a good hosts file
http://www.mvps.org/winhelp2002/hosts.htm
How To Download and Extract the HOSTS file:
http://www.mvps.org/winhelp2002/hosts2.htm
Repeat that proccess about once or twice a month

To help avoid reinfection see "So how did I get infected in the first place?"
http://forums.spybot.info/showthread.php?t=279

 

[rkt428]

Lonny I put in the hosts and will be updating windows shortly. Thanks you have been an immense help.

 

[tashi]

As the problem appears to be resolved this topic has been archived.

If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread; this applies only to the original topic starter. Cheers.