Slight spy ware problem. v.v

)85( · 04-15-2008, 08:38 PM

My comp has been under alot of virus attacks lately. it's finally got through or unless i visited alot of spyware infested sites. <.<

first symtom new spy ware blockers

2. i can't access the task manager.

Bugs bunny-What i'm trying to say is.....WE NEED YOUR HELP!!!

I've tried "the spyware killer" a CD that i got to remove spy ware and i've tried it three times. didn't work.

)85( · 04-16-2008, 03:33 PM

think i found my problem.

Quote:

F-Secure Malware Information Pages: Trojan-Spy:W32/Small.BSL

[Summary] | [Detailed Description]

Name : Trojan-Spy:W32/Small.BSL
Alias: Trojan-Spy.Win32.Small.bsl
Type: Trojan-Spy
Category: Malware
Platform: W32
Radar

Summary
Trojan-Spy applications are usually standalone programs that allow malicious individuals to monitor activity on infected computers.

Trojan-Spy:Win32.Small.BSL installs a component designed to steal installed certificates.
Back to the Top

Detailed Description
Creates the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{BD942DA7-96C8-4342-84C6-E2BCFE69FE11}\InprocServer32
(Default) = "C:\WINDOWS\system32\acrobat.dll"
ThreadingModel = "Apartment"
(Using the name, Adobe Acrobat ActiveX Control)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion
\Explorer\Browser Helper Objects\{BD942DA7-96C8-4342-84C6-E2BCFE69FE11}
NoExplorer = 0x00000001 (1)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
Adobe Acrobat ActiveX Control = "Rundll32 acrobat.dll,AInit"

It attempts to create the following registry entry:

HKEY_LOCAL_MACHINE\Software\Acrobat\
"1" = "124.217.251.118"
"2" = 0x00000050 (80)
"3" = /NNN/parse.php

It then drops a file into the following folder:

%windir%\system32\

The dropped file is called acrobat.dll and is 51712 bytes in size.

The malware sets acrobat.dll with a hidden file attribute and changes its date properties to the current system time.

Small.BSL then displays the following fake/decoy dialog message:

When the dialog box is closed the malware will search for and terminate all running Internet Explorer processes. After this, it will launch Internet Explorer as a hidden process which has the malicious component attached.

This malicious component acts like a Browser Helper Object (BHO).

After the user has started Internet Explorer the malware will attempt to communicate with a server located at the following URL:

http://124.217.[REMOVED]/NNN/parse.php

The BHO has the following functionality:

Steals installed certificates
Deletes user cookie files
Updates itself
Deletes files from C:\Documents and Settings
\%username%\Application Data\Macromedia\Flash Player\
Updates registry information

deleted it from the add/remove program. sll have a problem though.

Jayman · 04-16-2008, 03:57 PM

You should stop looking at porn sites.

)85( · 04-16-2008, 04:06 PM

i wasn't looking at one the time.....
i havn't downloaded anything the sites asked me to. <.<

in my defence, Jayman is the hacker who knows my passwords. <.<

)85( · 04-21-2008, 07:19 PM

so it was a virus. i'm with out photoshop and everything that was on the computer. had to erase everything and start from square one. this is how bad it got. there's not even a sound device for the speakers anymore. v.v

sorry for the bluryness. i couldn't keep my hands steady for a good picture.

James Deuce · 04-21-2008, 10:13 PM

Ask Felix imo...or SS.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Wii Ware	The Half Boy	Video Games & Electronics	5	12-19-2007 05:32 PM
Slight Overreaction In Courtroom	Necro	Real Media	1	02-19-2007 03:18 AM
Eva Mendes <slight nudity>	Blitzkrieg	Celebrity Photos / Pics	2	09-29-2006 09:42 AM
Koko B. Ware Interview: Talks about upcoming Dream	The ROC	Wrestling News & Rumors	0	09-19-2006 03:14 AM
Koko B Ware returns to AWA	AWASupreme	WWE Discussion	4	11-15-2004 01:25 PM

Slight spy ware problem. v.v

Whether your system is PC, PS3, Wii, or X-Box 360 we have your online discussion here. Also discuss today's latest gizmos and gadgets like cell phones, mp3 players, and more.