[bcab] Re: malware I can't find

Graham,

Wow that's alot of stuff going on there.

The very first thing to do is get yourself a demo copy of NOD32,
Go into the indepth scanning settings and check the boxes for it to scan everything. 

That's the first thing you need to do, let us know how you get on.
IMHO, if NOD32 can't find and remove everything it's probably going to be a re-format of the system. 

I'd also recommend installing Look And Stop, as a software firewall.

Dj paddy

Ôà
----- Original Message ----- From: "Graham Page" <gpage@xxxxxxxxxxxxxx> 
To: <bcab@xxxxxxxxxxxxx>
Sent: Thursday, May 24, 2007 4:23 PM
Subject: [bcab] malware I can't find


Hi all.
In the last couple of days, I think I have had someone try and succeed in getting through my firewall. I found this out because I got a message that appeared from the Microsoft firewall which is all I was using at the time. It said it had blocked something called File Transfer Program and asked to keep blocking or unblock. I accidentally pressed enter on unblock and that is where my problems began.
My PC shut down automatically and then restarted. Everything appeared to be fine until an mp3 file started playing on the PC automatically. I therefore asumed someone had gained remote access to my PC, having got through the router on my firewall.
I was also working on a new laptop at the time and put the Sygate firewall on this. I got a dialog there saying a module called I believe Windows Services was wanting to contact a server called garbage.scrappy.cc 

The Garbage and cc bits are certainly correct.  I did not let this through.

I tried to do a system restore and got the message:

C:\WINDOWS\system32\Restore\rstrui.exe
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access 
the item.
OK
also after doing a windows update I get a message telling me the update is complete and asking me to restart and when I do I do a windows update again and the update that I installed is listed as downloaded but not installed. 

I have tried installing the sygate firewall but this does not work either.

I have tried logging on as user admin and this does nnot work either.
Running Adaware tells me there is no spyware apart from a few tracking cookies and I have corrected these errors.
Anyone any ideas what I can do? it seems as though I have been denied permision to certain key parts of the system but I am not sure how to get them back.
Since this all happened I have changed the password on my account and router. 

Regards

Graham

Graham Page
Home Phone: 0207 265 9493
Mobile: 07753 607980
Fax:  0870 706 2773
Email: gpage@xxxxxxxxxxxxxx
MSN: gabriel_mcbird@xxxxxxxxxxx
Skype: gabriel_mcbird

***  BCAB List administration ***

If you wish to unsubscribe, set vacation,, request a digest or carry out 
routine maintenance on your subscription to the list then go to:
http://www.bcab.org.uk/mailing-list.html

Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word faqin 
the subject line. You'll receive an email with advice on managing your 
subscription to the list.

If you wish to discuss the administration of the list then contact:
bcab-moderators@xxxxxxxxxxxxx

Other related posts: