Open add/remove programs and remove anything that says Gator or Gain IF listed
C:\DOCUMENTS AND SETTINGS\ALL USERS\MENU AVVIO\PROGRAMMI\
GAIN Publishing <--delete that folder
C:\WINNT\system32\
svkp.sys <--delete that file..
As you picked up another Rbot infection..I need to look deeper in the system. BTW Zonealarm 5 is fine.
Download
WinPFInd http://www.bleepingcomputer.com/file...r/WinPFind.zip and extract it to your C:\ folder. This will create a folder called
WinPFind in the C:\ folder.
Download
Track qoo http://www.geekstogo.com/downloads/Trackqoo.zip
Save it somewhere you will remember like the Desktop. Unzip the Track qoo.vbs inside to your desktop.
DO NOT run it yet!
Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.!
Inside
C:\WinPFind is a file called
WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the
Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.! Once the Scan is Complete it will make a txt file (log) of what was found.
1. Go to the
WinPFind folder
2. Locate
WinPFind.txt
3. Please post those results in your next post!
REBOOT to normal mode.
Double Click on
"Track qoo.vbs"
Note - If you Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless!
Wait a few seconds and a notepad page will pop up, Copy & Paste those results and place them in the next post along with the results of
WinPFind!
So I need the following tool logs..
WinPFind.txt log
Track qoo.vbs log