Bot (who knows it?)

[jeo]

hi boys.
who knows one type of file called bot?
minutes ago avg free did automatic search in the system and nothing wrong was found.
ad-aware se updated don't found anything wrong and using repair and block,just the same,nothing is wrong.
strange that everytime when i start or reboot the system,when in desktop came the dial up waiting for the login and password.
if i use ctrl+alt+del, i see 2 times this file called bot (seems .exe) and i don't kill this files to search where they are.
more strange is that searching in the hds (*bot*.*) i can't find anythin but they are still running.
then with ctrl+alt+del i kill this files and the dial up close.
as i use vcool to control the cpu and motherboard temperatures i saw now that the cpu is now 5 C high and this is not normal because is raining here 2 days and the temper is falling in my city.

what is "bot" my friends,who knows and can help me to remove it please?

thanks.

[anonymez]

i believe its a worm, see here http://www.securitystronghold.com/enc/Microsoft-Synchronization-Manager-bot.exe-problem-solution-3935.php

if that's correct, get a virus scanner, or do an online (free) virus scan at http://www.mcafee.com

[jeo]

you're right anonymez! :)

from Spyware and Adware Encyclopedia(first link):
Name of the thread: Microsoft Synchronization Manager
Command or file name: bot.exe
Hazard index: 5. Dangerous threat! Virus, trojan or spyware. You must get rid of it as soon as possible.
Microsoft Synchronization Manager? what Bill is doing?!?
anonymez,i download the truesword.exe from the link but send me the sword from your signature and i will "kill Bill". :rotfl:

now i'm in mcafee page to remove it.(i will and later i post the result)

too much :thanks2:

[jeo]

anonymez,
see what happens using true sword:
http://img222.imageshack.us/img222/4126/truesword5sf.th.png (http://img222.imageshack.us/my.php?image=truesword5sf.png)
after run 40%,the program stop and close(as a blink)without any advice.

in mcafee i can't find the online (free) virus scan.

running regedit was found:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
ab 000 REG_SZ bot*.*...
ab 001 REG_SZ *bot*.*...

HKEY_USERS\S-1-5-21-861567501-842925246-854245398-500\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
ab 000 REG_SZ bot*.*...
ab 001 REG_SZ *bot*.*...

i'm afraid to remove this keys.should i backup this keys and remove for test?
what do you think?

thanks in advance!

[anonymez]

IMO don't touch the registry unless you know what you're doing. to get to the online virus scan at mcafee, go to the link i provided, click 'home and home office', it will lead you to another page, where it has a little box at the bottom saying 'free tools'. click 'free scan'.

[C.E.O.]

http://housecall.trendmicro.com/

theres another free solution if you cant find it on McAfee.

[H@X]

talking about bots i have 2 of them that show up on my aim buddy list. thats new

[jeo]

anonymez,
mcafee found only one file called "Generic Adware.txt" that was installed from sound blaster original cd that have 2 years old..:angeldevi (how can it be?)..nothing more.

C.E.O.,
trend found 26 spywares(25 cookies) and one file called "ADW_TARGETSAV.A Adware".all was removed.
when trend was running,avgfree found 2 virus,but not had found anything before.(seems crazy? :shocked:

no one can find the "bot" files and as i posted they still in the registry.

bot is one "amazing" file don't? :tissue2:
i will delete this files from the registry after backup it.
if i stay out from the forum for more than one day means that my system crash or :deadhorse ...or...:evilsick:

H@X,
take care of this files.
search in the registry where they are and wait my result after i delete and backup it.

:thanks2: for all

[Chewy]

http://www.trojanhunter.com/

install it, update it, reboot into safe mode run deep scan

might find everything, all the other things you have done are easily
defeated by modern trojans.

[jeo]

anonymez,
thanks for your interest.you help me so much!

C.E.O.
thanks,trend is very cool and solve the problem, now everything is ok.

rbrtpl,
trojan hunter was not needed.
after reboot bot files gone.thanks

in the end..... :thanks2: to you all!
great team!

[Chewy]

rbrtpl,
trojan hunter was not needed.
after reboot bot files gone.thanks



You can't be too sure, I ran three scanners in safe mode, each
found something and wasn't truly disinfected until I repeated with
broadband disconnected.

[jeo]

well,searching with regedit the bot files was not found...it's gone(seems) and the dial up don't appaer when i power on or reboot.

but ok,i will use trojanhunter now following your advice.

thank you.

[jeo]

rbrtpl,
trojan hunter don't found anything wrong.
seems everything ok now.

thank you
:)

[Chewy]

Ur welcome and be careful out there, it's getting more and more dangerous just to surf!

[anonymez]

glad you got rid of it, jeo!

just make sure you have a good firewall installed, you don't surf any suspicious websites, and watch what files you open/install. also have adware, spyware and anti-virus software installed. :)

[Jack Lurker]

I thought I had all my bases covered, Adaware, Spybot, Spyware Doctor, AVG and a couple of online scans on a fairly regular basis and trojan hunter still found three trojans!! Thanks rbrtpl, thats a nice little app.:thanks2:

[Chewy]

ur welcome
There is a grey area between spyware and virus(ii) and trojan hunter seems to cover it best.
The problem is the bad guys are integrating the three areas into their web booby traps.