Smidfraud Check

Good! You got it then. It does look clear :)

Find this folder and delete it:
C:\!Submit

That's the backup Killbox makes after deleting a file. Since I'm sure you got the right one, no need to keep a backup of the infected file (though rendered harmless in that !Submit folder)

You can also delete the Killbox tool and any other tools we used (like the SmitfraudFix folder, for example)

Now that your PC is clean, make sure all programs are running properly and then you'll need to reset your restore point in Windows XP.......why?

One of the best features of Windows ME or XP is the System Restore option, however if a malware infects a computer with this operating system it can be backed up in the System Restore folder. Therefore, clearing the restore points is necessary after malware removal.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore.
Go to Start > Run, click on *My Computer*.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
Go to Start > Run, click on *My Computer*.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

How to Turn On and Turn Off System Restore in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310405

Next, I highly recommend you get some extra protection to prevent future infections. Here are some things you can do and some free programs to help :).
http://www.dslreports.com/faq/13620

I'm happy to see you have SP2 installed. That will address numerous security issues in your Operating System and IE
Make sure that you keep your Operating System and IE updated with the latest Critical Security Updates from Microsoft...they usually come out once a month, on the 2nd Tuesday of each month. This is the first step in malware prevention, as many nasties now take advantage of new exploits and if not patched, you are vulnerable!
Windows Update
http://update.microsoft.com/microsoftupdate/

And see this link for instructions on how to configure the enhanced security features in SP2:
http://www.microsoft.com/technet/security/smallbusiness/prodtech/windowsxp/iesecxp.mspx

I also highly recommend to get the free tool, Microsoft Baseline Security Analyzer (MBSA) from Microsoft to analyze your PC security for prevention purposes.

MBSA Version 2.0 will scan for common system misconfigurations on Windows 2000, Windows XP, and Windows Server 2003 systems. This program will identify the system security weaknesses in your browser and operating system and provides easy instructions to correct them. This includes any missing critical Windows security updates, system vulnerabilities and your IE Browser security settings. Get the download here:
Microsoft Baseline Security Analyzer
http://www.microsoft.com/technet/security/tools/mbsahome.mspx
Choose MBSAsetup-EN.msi = (English Version) or the language appropriate for you.
 
problem

Hi Calamity, Very sorry to trouble you again but something is still haywire. All aspects of my Norton Security program are disabled and I can't turn them on. When I click on "accounts" it indicates that I am not logged on but there is nothing I can do because the the login window is inactive. All attempts to make adjustments result in the message that I do not have enough priority to make changes. Couldn't even remove the program to install a new version with updated virus protection (the old protection expires next week). Before all of this happened My internet secuity was set to log me in as an administrator. Any thoughts? Unfortunately, I had already reset my system restore points when I discovered that I still had this problem

Except for minor problems with my e-mail everything else seems to be working fine

As for the service.exe file everything jibes. The program that Killbox removed was the service one that I had found earlier.

When this is over I will owe you a steak dinner. If you are ever in Tallahassee call me to collect.
 
When you "click on accounts" ...where? In Norton?

I'm not familiar with Norton Internet Security. Sounds like it's been disabled or tampered with.
 
info

It is the "accts" in Internet Security that's giving me problems. I'm quite sure that I am registered as an administrator in Windows (eg. I was able to turn the system restore option on and off)

I suspect that when the malware was active it disabled the internet security program. I'm hoping to find a way to undo the damage without reinstalling Windows but have tried everything I can think of so far.

I don't think this is your problem. If you get any ideas, I would love to have them but don't fret about it. I think I will contact Symantech

Thanks again for all your help!!!!!!!
 
Ok, I think contacting Symantec is the best option.

I agree that if you can reset the system restore you ARE signed on as Admin in Windows, so it is a problem with Norton. And yes, malware can often target Antivirus programs, so that may well be what has happened. Symantec may be able to help :)

Good luck! :bigthumb:

I'll go ahead and retire this thread to the Archives. If you should need it reopened for any reason, feel free to PM me or one of the Forum Leaders :)
 
You must log in or register to reply here.
Back
Top