Ghost IE Windows

[drfsupercenter]

Erm... but then wouldn't McAfee find it? When I downloaded this one ZIP file it came up with a warning so I deleted it. No problem there.

I will try those once I am done recording something off the radio - they are doing a "celebrity playlist" that could be worth something someday

[Cambion7]

I'd also go to SysInternal's web and pick up a copy of ProcessExplorer and see if you can spot some funky named processes running... in particular pay attention to the WinLogon process since many nasties use this to load themselves.

Oh, while we're on the subject a real bad nasty called rootkit.hearse has been released. It was discovered on the 20th of this month.

Regards,
Cam

[drfsupercenter]

This problem has been happening for over a month now... I just never got around to asking about it.

[Chewy]

have you run a full system scan after updating McAfee from safe mode?

[drfsupercenter]

No, I ran a full scan after updating in normal mode.

[Chewy]

newest trojan I ran into automatically made like 30 copies of itself and named
them after popular programs and created a share folder on my C drive.
They were all about 200KB

it was from limewire and norton's passed it as ok,
trojanhunter killed it with a little help

I knew it was fishy but I was fixing to reload that computer anyway, yes drf, chewy intentionally installs
trojans as educational exercises, gotta keep on my toes

anyways, I verifyed what I thought, limewire has become a very dangerous place

dead giveaway is an hourglass after you execute and the program doesn't work

run trojanhunter

[drfsupercenter]

Hmmm... I don't see a share folder. I downlad all my files to my F://Downloaded Files folder, because should I get a virus, I just unplug the drive and all my programs are on drive C.

[Chewy]

did you run trojan hunter? that's how I found the new share folder

[uufta]

Better listen to the Wookie DRF,
or we will all go back to analyzing the reasons for Chewy's baldness and your homework.

[drfsupercenter]

I just got back from a boy scout meeting, I will install trojanhunter now.

[uufta]

Good Idea

[drfsupercenter]

Registry scan
No suspicious entries found
Inifile scan
No suspicious entries found
Port scan
No suspicious open ports found
Memory scan
No trojans found in memory
File scan
No trojan files found

Now what?

[Chewy]

hijackthis

http://www.spywareinfo.com/~merijn/downloads.html

http://www.hijackthis.de/index.php

[uufta]

Try SpyBot S&D just for kicks, cant hurt

http://www.majorgeeks.com/SpyBot-Search_&_Destroy_d2471.html

We posted in stereo Chewy, think he can hear us?

[drfsupercenter]

Attached is the HJT log.

http://www.hijackthis.de/logfiles/d5ee1de98d15098d6aad2288d8da9e8a.html

That's the analysis. Everything looks good. (Wal-Mart Music Downloads I need, HiDownload I installed... what else is there)