Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: E-Christmas Card Virus (through MSN)  (Read 7081 times)

0 Members and 1 Guest are viewing this topic.

ollylock

  • Guest
E-Christmas Card Virus (through MSN)
« on: December 17, 2006, 04:25:39 PM »
Hello,

I'm new here, however have browsed the site every so often when I have had problems.

Today, I was on Windows MSN Messenger when I got a messege with a link to an 'e-christmas card'; I stupidly followed the link. It then downloaded onto my desktop and opened up an error file. It looked like an MS Dos, black window, with an 'error' in the top line. I closed it and dragged everything into the trash can.

Then, MSN started opening every conversation window and automatically sending the same messege I got: "check :-) www.e-christmas card" (I can't remember the exact URL). After it sent the URL, it automatically closed the window, but it persistently continued to send these messeges. I signed out of MSN and haven't been back in yet.

However, when I am in windows normally, the framework of a new window pops up and then suddenly closes, happening every couple of minutes or so. Undoubtedly a consequence of the virus contracted through MSN.

Every so often, the black, MS Dos - like, window pops up, saying 'install' and 'error'. This is an unsual virus that I haven't seen before. The only virus and trojans I've got are ones that install spyware on my computer.

I've taken the following action, with no result:

1. Turned Off System Restore
2. Restarted in Safe Mode
3. Run the following programmes:
     - CCleaner
     - Windows Defender
     - Lavasoft Ad-Aware
     - AVG
     - A-Squared
     - Spybot
     - Ewido
4. There were the odd viruses found, which I subsequently deleted.
5. Restarted in Normal Mode
6. Turned on System Restore

--> The problem persists.

Also, I now have AVG and A-Squared continually pooping up with the same messege asking me to 'allow'/'disallow'/'quarrantine'/'delete' various programmes and files. Though I give commands, they continue to pop up with the same questions with the same problems.

Would it help if I post up a file of my HijackThis?

I really hope you can help me with this frustrating problem.

Much appreciated,

Oliver Lock

street1 (RIP)

  • R.I.P.


  • Egghead

  • I Triple Dog Dare You!!! LOL
  • Thanked: 14
    • Obituary
  • Experience: Beginner
  • OS: Windows XP
Re: E-Christmas Card Virus (through MSN)
« Reply #1 on: December 17, 2006, 04:50:08 PM »
The below removal tool program is supposed to work.

I- worm Zafi.b removal tool.


http://www.softpedia.com/progDownload/IWormZafib-removal-tool-Download-16574.html

Choose Softpedia Secure Download(RO).

Unzip it and run KLWK.COM.

« Last Edit: December 17, 2006, 04:56:35 PM by street1 »
Sorry,The USA has ruined the language The United Kingdom loaned us. We do our best not to type gibberish. I Hope you can forgive us.

dl65

  • R.I.P.


  • Prodigy

    Thanked: 18
    Re: E-Christmas Card Virus (through MSN)
    « Reply #2 on: December 17, 2006, 04:50:31 PM »
     ollylock......  Is it anything like described in the link below ?
    http://news.com.com/Christmas+card+virus+ataks/2100-7349_3-5493768.html

    I see you already have turned off system restore....... leave it off for the time being .
    Yes , do post a hijackthis log ....it may give us more of a clue .......
    I'm just doing some reading ....... I saw something a few days ago about that worm.......

    dl65  ::)
    « Last Edit: December 17, 2006, 05:01:56 PM by dl65 »
    If you don't know the answer, it isn't a dumb question.

    ollylock

    • Guest
    Re: E-Christmas Card Virus (through MSN)
    « Reply #3 on: December 17, 2006, 05:12:55 PM »
    Update:

    1. The framework of the windows are popping up more frequently now. When I am in various windows explorer windows, such as 'local disk', when the framework thing pops up, it exits all the windows as well (bar firefox etc)

    2. The A-squared and AVG pop-ups are asking me about programmes such as:
    C:\WINDOWS//System32/svchosts.exe
    C:\awqalwt.exe

    Dear street1[/], thank you for the programme; I downloaded it and ran it but unfortunately it told me there were no harmful programmes to remove.

    Dear dl65, having read the article, a few things I recognise: it posed as a Christmas card / greeting; it did spread to all the addresses in my address book and proceeded to send the link - I'm aware of it in MSN; I don't know if it has done it through my email, though - I hope not! As I received a link through MSN, I did not see a subject such as "Merry X-Mas" as the article suggests.

    My HijackThis Log File:

    Logfile of HijackThis v1.99.1
    Scan saved at 00:11:32, on 18/12/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\system32\msasvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\VM_STI.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Softwin\BitDefender8\bdmcon.exe
    C:\Program Files\Softwin\BitDefender8\bdnagent.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\a-squared\a2guard.exe
    C:\Program Files\MSN Messenger\msrr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Palm\Hotsync.exe
    C:\Documents and Settings\Oliver Lock\tel.exe
    C:\Program Files\Common Files\{701B57B5-0BB0-1033-0223-04120503002c}\Update.exe
    C:\WINDOWS\system32\tel.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\Documents and Settings\Oliver Lock\Desktop\HijackThis.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/en-gb/srchasst/srchasst.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
    F2 - REG:system.ini: Shell=
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp (file missing)

    ollylock

    • Guest
    Re: E-Christmas Card Virus (through MSN)
    « Reply #4 on: December 17, 2006, 05:13:41 PM »
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{301B5~1\Bar888.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{301B5~1\Bar888.dll
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
    O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
    O4 - HKLM\..\Run: [{701B57B5-0BB0-1033-0223-04120503002c}] "C:\Program Files\Common Files\{701B57B5-0BB0-1033-0223-04120503002c}\Update.exe" mc-110-12-0001411
    O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
    O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu]  /L:ENG
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PAHomeRouter] C:\Program Files\ProgrammerAce\PA Home Router\PAHomeRouter.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
    O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

    ollylock

    • Guest
    Re: E-Christmas Card Virus (through MSN)
    « Reply #5 on: December 17, 2006, 05:14:08 PM »
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001411 (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    ollylock

    • Guest
    Re: E-Christmas Card Virus (through MSN)
    « Reply #6 on: December 17, 2006, 05:20:20 PM »
    Dear dl65, I have posted three consecutive posts with my log file. The first one containing my replies to you and street1.

    My last reply of my log file should have read:

    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    dl65

    • R.I.P.


    • Prodigy

      Thanked: 18
      Re: E-Christmas Card Virus (through MSN)
      « Reply #7 on: December 17, 2006, 05:26:11 PM »
      ollylock.....

      This entry is looking bad in the running applications.
      C:\WINDOWS\system32\msasvc.exe

      These files should be removed using Hijackthis....

      O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp (file missing)

      O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)

      O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{301B5~1\Bar888.dll        [highlight]This one looks dodgey ...but if you know it to be ok ....just leave[/highlight]

      O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe  

      O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001411 (file missing)

      thats what I'm seeing .......

      dl65  ::)

      If you don't know the answer, it isn't a dumb question.

      ollylock

      • Guest
      Re: E-Christmas Card Virus (through MSN)
      « Reply #8 on: December 17, 2006, 05:30:27 PM »
      Dear dl65, I greatly appreciate your help.

      One question though, how do I remove that 'running application':

      C:\WINDOWS\system32\msasvc.exe

      I will remove the HijackThis ones now.

      Thank you.

      dl65

      • R.I.P.


      • Prodigy

        Thanked: 18
        Re: E-Christmas Card Virus (through MSN)
        « Reply #9 on: December 17, 2006, 05:42:08 PM »
         ollylock ..... That entry looks like the result of a trojan ......
        So do this ...... click.....  my computer ..... then  C drive ..... scroll down to the windows folder ( make sure you have show hidden files and folders being displayed ) ...... open windows folder and scroll down to System 32 folder ....... open it and then look for  [highlight]msasvc.exe [/highlight] when you find it .... delete it ....... nothing else. then go back out .


        dl65  ::)
        « Last Edit: December 17, 2006, 05:43:34 PM by dl65 »
        If you don't know the answer, it isn't a dumb question.

        dl65

        • R.I.P.


        • Prodigy

          Thanked: 18
          Re: E-Christmas Card Virus (through MSN)
          « Reply #10 on: December 17, 2006, 05:55:06 PM »
          ollylock.....  I just noticed that you have both Norton AV as well as AVG free running ...... thats not a good idea as more often than not they do not interact well with other .  Get rid of the worm first and then you can decide which one you wish to use .

          dl65  ::)
          If you don't know the answer, it isn't a dumb question.

          ollylock

          • Guest
          Re: E-Christmas Card Virus (through MSN)
          « Reply #11 on: December 17, 2006, 06:16:05 PM »
          OK, thank you.

          I've deleted all the files that you have told me to, but I'm still having the problems. I've been told to download SmitfraudFix. I'll try that and then post back here, unless you have further advice?

          dl65

          • R.I.P.


          • Prodigy

            Thanked: 18
            Re: E-Christmas Card Virus (through MSN)
            « Reply #12 on: December 17, 2006, 06:52:25 PM »
            ollylock....  Ok ...... give that app a try.
            BTW , when was the last time you emptied out the temp files / history /cookies ?
            If you have ccleaner it will do that for you quickly ...

            dl65  ::)
            If you don't know the answer, it isn't a dumb question.

            ollylock

            • Guest
            Re: E-Christmas Card Virus (through MSN)
            « Reply #13 on: December 17, 2006, 07:02:39 PM »
            I'm continually deleting all my internet temp files etc using CCleaner. I've done it about 5 times this evening alone, but it's usually a few times a week.

            I'm stumped.

            I've used that application and nothing has been resolved at all...

            What else do you suggest?

            dl65

            • R.I.P.


            • Prodigy

              Thanked: 18
              Re: E-Christmas Card Virus (through MSN)
              « Reply #14 on: December 17, 2006, 07:06:29 PM »
               ollylock..... I'm just going back over the previous posts to see if something has been over looked .  How about a new hijackthis log file .

              dl65  ::)
              If you don't know the answer, it isn't a dumb question.