Slight spy ware problem. v.v

)85( · 04-15-2008, 09:38 PM

My comp has been under alot of virus attacks lately. it's finally got through or unless i visited alot of spyware infested sites. <.<

first symtom new spy ware blockers

To view links or images in this forum your post count must be 20 or greater. You currently have 0 posts.

2. i can't access the task manager.

To view links or images in this forum your post count must be 20 or greater. You currently have 0 posts.

Bugs bunny-What i'm trying to say is.....WE NEED YOUR HELP!!!

I've tried "the spyware killer" a CD that i got to remove spy ware and i've tried it three times. didn't work.

)85( · 04-16-2008, 04:33 PM

think i found my problem.

Quote:

F-Secure Malware Information Pages: Trojan-Spy:W32/Small.BSL

[Summary] | [Detailed Description]

Name : Trojan-Spy:W32/Small.BSL
Alias: Trojan-Spy.Win32.Small.bsl
Type: Trojan-Spy
Category: Malware
Platform: W32
Radar

Summary
Trojan-Spy applications are usually standalone programs that allow malicious individuals to monitor activity on infected computers.

Trojan-Spy:Win32.Small.BSL installs a component designed to steal installed certificates.
Back to the Top

Detailed Description
Creates the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{BD942DA7-96C8-4342-84C6-E2BCFE69FE11}\InprocServer32
(Default) = "C:\WINDOWS\system32\acrobat.dll"
ThreadingModel = "Apartment"
(Using the name, Adobe Acrobat ActiveX Control)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion
\Explorer\Browser Helper Objects\{BD942DA7-96C8-4342-84C6-E2BCFE69FE11}
NoExplorer = 0x00000001 (1)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
Adobe Acrobat ActiveX Control = "Rundll32 acrobat.dll,AInit"

It attempts to create the following registry entry:

HKEY_LOCAL_MACHINE\Software\Acrobat\
"1" = "124.217.251.118"
"2" = 0x00000050 (80)
"3" = /NNN/parse.php

It then drops a file into the following folder:

%windir%\system32\

The dropped file is called acrobat.dll and is 51712 bytes in size.

The malware sets acrobat.dll with a hidden file attribute and changes its date properties to the current system time.

Small.BSL then displays the following fake/decoy dialog message:

When the dialog box is closed the malware will search for and terminate all running Internet Explorer processes. After this, it will launch Internet Explorer as a hidden process which has the malicious component attached.

This malicious component acts like a Browser Helper Object (BHO).

After the user has started Internet Explorer the malware will attempt to communicate with a server located at the following URL:

To view links or images in this forum your post count must be 20 or greater. You currently have 0 posts.
.[REMOVED]/NNN/parse.php

The BHO has the following functionality:

Steals installed certificates
Deletes user cookie files
Updates itself
Deletes files from C:\Documents and Settings
\%username%\Application Data\Macromedia\Flash Player\
Updates registry information

deleted it from the add/remove program. sll have a problem though.

Jayman · 04-16-2008, 04:57 PM

You should stop looking at porn sites.

)85( · 04-16-2008, 05:06 PM

i wasn't looking at one the time.....
i havn't downloaded anything the sites asked me to. <.<

in my defence, Jayman is the hacker who knows my passwords. <.<
To view links or images in this forum your post count must be 20 or greater. You currently have 0 posts.

)85( · 04-21-2008, 08:19 PM

so it was a virus. i'm with out photoshop and everything that was on the computer. had to erase everything and start from square one. this is how bad it got. there's not even a sound device for the speakers anymore. v.v

To view links or images in this forum your post count must be 20 or greater. You currently have 0 posts.

sorry for the bluryness. i couldn't keep my hands steady for a good picture.

James Deuce · 04-21-2008, 11:13 PM

Ask Felix imo...or SS.

Slight spy ware problem. v.v

This is a discussion on Slight spy ware problem. v.v within the Video Games & Electronics forums, part of the Non Wrestling Forums category; My comp has been under alot of virus attacks lately. it's finally got through or unless i visited alot of ...