Thread: Z.lobber/win32
View Single Post
Old 06-19-2008, 07:41 PM   #42 (permalink)
tetonbob
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,551
OS: 2000 Pro; XP Pro; XP Home


Re: Z.lobber/win32

Some of the downloads in your Limewire folder appear to be infected. Best we delete them.

P2P - I see you have P2P software (Limewire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

---------------------------------------------------------------------------------------------

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

Viewpoint Manager<<<this is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Read this article: http://www.clickz.com/news/article.php/3561546

Additional info: http://vil.nai.com/vil/content/v_137262.htm

---------------------------------------------------------------------------------------------

Copy and paste the following into Notepad (don't forget to copy and paste REGEDIT4):

Quote:
REGEDIT4

[-hkey_classes_root\mynewsbarlauncher.ie5barlauncherbho.1]

[-hkey_classes_root\mynewsbarlauncher.ie5barlauncherbho]

[-hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\abi-1]

[-hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer]
Save the file as "delete.reg". Make sure to save it with the quotes. It should look like this:

Close Notepad.

Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

---------------------------------------------------------------------------------------------

Open NOTEPAD.exe and copy/paste the text in the codebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\Documents and Settings\Desiree\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-494e0098-73f465fe.zip"
"C:\Documents and Settings\Erik\My Documents\LimeWire\Saved\i think im ready katy perry.mp3"
"C:\Documents and Settings\Erik\My Documents\LimeWire\Saved\no me without you matt pokora.mp3"
"C:\Documents and Settings\Erik\My Documents\LimeWire\Saved\when i grow up pussycat dolls.mp3"
"C:\Documents and Settings\Erik\Application Data\ptads.bin"
"C:\Documents and Settings\Ethan\Application Data\ptads.bin"
"c:\windows\cfgmgr52.ini"

) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)

for %%g in (

%systemdrive%\Deckard

) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says.

Also tell me how the machine is behaving.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline