Tech Support Forum - View Single Post

AbstractEpiphany · 04-21-2006, 11:24 PM

Hello again Sonya!

Please re-enable system restore until the disinfection of your system is finished. This way, you do have a backup if you find reason to use it, just in case--we'll clear the system restore points once your system is clean, to give you a fresh restore point and to purge the infected restore points.

Also, I noticed you've run a system scan with Bitdefender's online scan. However, although that was a nice idea, it would be appreciated if you would follow the malware removal process precisely as outlined in the fix provided, and resist running any extra scans until your system is clean, please--as they may make the removing the existing malware more difficult, especially if I don't know what the scan found or modified, or how you dealt with the results, if any.

Did you by any chance happen to save the results from Bitdefender's scan, if there were any? If so, can you please post them here?

Turn on System Restore
Turn on System Restore by clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

Restart to Safe Mode
Restart your computer, and repeatedly tap the F8 key (or the appropriate key for your system) until the menu appears. Select Safe Mode from that menu.

Uninstall Programs
Click Start -> Control Panel -> Add/Remove Programs and uninstall the following programs (if they exist):

FunWebProducts
Need2Find
MyWay
MyWebSearch

Do not reboot if prompted by any of the uninstallers.

Delete Files
Delete the following files indicated in RED and folders indicated in BLUE if they still exist.

C:\WINDOWS\smdat32a.sys
C:\PROGRAM FILES\FunWebProducts\
C:\PROGRAM FILES\MyWay\
C:\PROGRAM FILES\MyWebSearch\
C:\PROGRAM FILES\Need2Find\

Let me know if you can't find or delete any of them.

Also, empty this folder:
D:\WINDOWS\Cookies\
by deleting all of the files it contains.

Restart to Normal Mode
Restart your system normally.

Scan with Kapersky
Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner.

Answer Yes when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button and configure to:
- Scan using the following Anti-Virus Database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Logfiles Required
The Kapersky log

And please advise as to how your system is running.

04-21-2006, 11:24 PM	#6 (permalink)
AbstractEpiphany Registered User Join Date: Jan 2006 Location: Canada Posts: 250 OS: Windows 98SE/XP Home, Mac OS X	Hello again Sonya! Please re-enable system restore until the disinfection of your system is finished. This way, you do have a backup if you find reason to use it, just in case--we'll clear the system restore points once your system is clean, to give you a fresh restore point and to purge the infected restore points. Also, I noticed you've run a system scan with Bitdefender's online scan. However, although that was a nice idea, it would be appreciated if you would follow the malware removal process precisely as outlined in the fix provided, and resist running any extra scans until your system is clean, please--as they may make the removing the existing malware more difficult, especially if I don't know what the scan found or modified, or how you dealt with the results, if any. Did you by any chance happen to save the results from Bitdefender's scan, if there were any? If so, can you please post them here? Turn on System Restore Turn on System Restore by clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK. Restart to Safe Mode Restart your computer, and repeatedly tap the F8 key (or the appropriate key for your system) until the menu appears. Select Safe Mode from that menu. Uninstall Programs Click Start -> Control Panel -> Add/Remove Programs and uninstall the following programs (if they exist): FunWebProducts Need2Find MyWay MyWebSearch Do not reboot if prompted by any of the uninstallers. Delete Files Delete the following files indicated in RED and folders indicated in BLUE if they still exist. C:\WINDOWS\smdat32a.sys C:\PROGRAM FILES\FunWebProducts\ C:\PROGRAM FILES\MyWay\ C:\PROGRAM FILES\MyWebSearch\ C:\PROGRAM FILES\Need2Find\ Let me know if you can't find or delete any of them. Also, empty this folder: D:\WINDOWS\Cookies\ by deleting all of the files it contains. Restart to Normal Mode Restart your system normally. Scan with Kapersky Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner. Answer Yes when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button and configure to: Scan using the following Anti-Virus Database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Logfiles Required The Kapersky log And please advise as to how your system is running.