[bcab] Re: malware I can't find

thanks DJ.

I have also tried Super Antispyware and the AVG rootkit detector.  I 
suspeect in fact that it just be registry changes we are talking about here.

Regards


Graham
----- Original Message ----- 
From: "Dj Paddy" <mygroups@xxxxxxxxxxxxx>
To: <bcab@xxxxxxxxxxxxx>
Sent: Friday, May 25, 2007 10:39 AM
Subject: [bcab] Re: malware I can't find


graham,

Open NOD32's control panel.

Go to NOD32 in the list, and ctrl tab.

Tab to the indepth analysis button and hit return.

You'll probably want to stop the scan and go to the setup tab and tick, all
the boxes there for items to scan.

Dj Paddy
Ôà
----- Original Message ----- 
From: "Graham Page" <gpage@xxxxxxxxxxxxxx>
To: <bcab@xxxxxxxxxxxxx>
Sent: Friday, May 25, 2007 9:08 AM
Subject: [bcab] Re: malware I can't find


> no, just the normal scan from within nod. how do you specify a fuller
> scan?
>
> Regards
>
> graham
> ----- Original Message ----- 
> From: "Dj Paddy" <mygroups@xxxxxxxxxxxxx>
> To: <bcab@xxxxxxxxxxxxx>
> Sent: Thursday, May 24, 2007 6:41 PM
> Subject: [bcab] Re: malware I can't find
>
>
> Hi did you run the thorough scan, not just the normal scan?
>
> Dj Paddy
> Ôà
> ----- Original Message ----- 
> From: "Graham Page" <gpage@xxxxxxxxxxxxxx>
> To: <bcab@xxxxxxxxxxxxx>
> Sent: Thursday, May 24, 2007 6:25 PM
> Subject: [bcab] Re: malware I can't find
>
>
>> first, I have nod 32 on here and             have already done a scan.
>> Nod32 updates itself fine.
>>
>> No problems were found.
>>
>> Cheers
>>
>> Graham
>> ----- Original Message ----- 
>> From: "Dj Paddy" <mygroups@xxxxxxxxxxxxx>
>> To: <bcab@xxxxxxxxxxxxx>
>> Sent: Thursday, May 24, 2007 4:50 PM
>> Subject: [bcab] Re: malware I can't find
>>
>>
>> Graham,
>>
>> Wow that's alot of stuff going on there.
>>
>> The very first thing to do is get yourself a demo copy of NOD32,
>>
>> Go into the indepth scanning settings and check the boxes for it to scan
>> everything.
>>
>> That's the first thing you need to do, let us know how you get on.
>>
>> IMHO, if NOD32 can't find and remove everything it's probably going to be
>> a
>> re-format of the system.
>>
>> I'd also recommend installing Look And Stop, as a software firewall.
>>
>> Dj paddy
>>
>> Ôà
>> ----- Original Message ----- 
>> From: "Graham Page" <gpage@xxxxxxxxxxxxxx>
>> To: <bcab@xxxxxxxxxxxxx>
>> Sent: Thursday, May 24, 2007 4:23 PM
>> Subject: [bcab] malware I can't find
>>
>>
>> Hi all.
>>
>> In the last couple of days, I think I have had someone try and succeed in
>> getting through my firewall.  I found this out because I got a message
>> that
>> appeared from the Microsoft firewall which is all I was using at the
>> time.
>> It said it had blocked something called File Transfer Program and asked
>> to
>> keep blocking or unblock.  I accidentally pressed enter on unblock and
>> that
>> is where my problems began.
>>
>> My PC shut down automatically and then restarted.  Everything appeared to
>> be
>> fine until an mp3 file started playing on the PC automatically.  I
>> therefore
>> asumed someone had gained remote access to my PC, having got through the
>> router on my firewall.
>>
>> I was also working on a new laptop at the time and put the Sygate
>> firewall
>> on this.  I got a dialog there saying a module called I believe Windows
>> Services was wanting to contact a server called garbage.scrappy.cc
>>
>> The Garbage and cc bits are certainly correct.  I did not let this
>> through.
>>
>> I tried to do a system restore and got the message:
>>
>> C:\WINDOWS\system32\Restore\rstrui.exe
>> Windows cannot access the specified device, path, or file.  You may not
>> have
>> the appropriate permissions to access
>> the item.
>> OK
>>
>> also after doing a windows update I get a message telling me the update
>> is
>> complete and asking me to restart and when I do I do a windows update
>> again
>> and the update that I installed is listed as downloaded but not
>> installed.
>>
>> I have tried installing the sygate firewall but this does not work
>> either.
>>
>> I have tried logging on as user admin and this does nnot work either.
>>
>> Running Adaware tells me there is no spyware apart from a few tracking
>> cookies and I have corrected these errors.
>>
>> Anyone any ideas what I can do?  it seems as though I have been denied
>> permision to certain key parts of the system but I am not sure how to get
>> them back.
>>
>> Since this all happened I have changed the password on my account and
>> router.
>>
>> Regards
>>
>> Graham
>>
>> Graham Page
>> Home Phone: 0207 265 9493
>> Mobile: 07753 607980
>> Fax:  0870 706 2773
>> Email: gpage@xxxxxxxxxxxxxx
>> MSN: gabriel_mcbird@xxxxxxxxxxx
>> Skype: gabriel_mcbird
>>
>> ***  BCAB List administration ***
>>
>> If you wish to unsubscribe, set vacation,, request a digest or carry out
>> routine maintenance on your subscription to the list then go to:
>> http://www.bcab.org.uk/mailing-list.html
>>
>> Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word
>> faqin the subject line. You'll receive an email with advice on managing
>> your
>> subscription to the list.
>>
>> If you wish to discuss the administration of the list then contact:
>> bcab-moderators@xxxxxxxxxxxxx
>>
>>
>> __________ NOD32 2290 (20070524) Information __________
>>
>> This message was checked by NOD32 antivirus system.
>> http://www.eset.com
>>
>>
>> ***  BCAB List administration ***
>>
>> If you wish to unsubscribe, set vacation,, request a digest or carry out
>> routine maintenance on your subscription to the list then go to:
>> http://www.bcab.org.uk/mailing-list.html
>>
>> Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word
>> faqin the subject line. You'll receive an email with advice on managing
>> your subscription to the list.
>>
>> If you wish to discuss the administration of the list then contact:
>> bcab-moderators@xxxxxxxxxxxxx
>>
>
> ***  BCAB List administration ***
>
> If you wish to unsubscribe, set vacation,, request a digest or carry out
> routine maintenance on your subscription to the list then go to:
> http://www.bcab.org.uk/mailing-list.html
>
> Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word
> faqin the subject line. You'll receive an email with advice on managing
> your
> subscription to the list.
>
> If you wish to discuss the administration of the list then contact:
> bcab-moderators@xxxxxxxxxxxxx
>
>
> __________ NOD32 2290 (20070524) Information __________
>
> This message was checked by NOD32 antivirus system.
> http://www.eset.com
>
>
> ***  BCAB List administration ***
>
> If you wish to unsubscribe, set vacation,, request a digest or carry out
> routine maintenance on your subscription to the list then go to:
> http://www.bcab.org.uk/mailing-list.html
>
> Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word
> faqin the subject line. You'll receive an email with advice on managing
> your subscription to the list.
>
> If you wish to discuss the administration of the list then contact:
> bcab-moderators@xxxxxxxxxxxxx
>

***  BCAB List administration ***

If you wish to unsubscribe, set vacation,, request a digest or carry out 
routine maintenance on your subscription to the list then go to:
http://www.bcab.org.uk/mailing-list.html

Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word 
faqin the subject line. You'll receive an email with advice on managing your 
subscription to the list.

If you wish to discuss the administration of the list then contact:
bcab-moderators@xxxxxxxxxxxxx


__________ NOD32 2292 (20070525) Information __________

This message was checked by NOD32 antivirus system.
http://www.eset.com


***  BCAB List administration ***

If you wish to unsubscribe, set vacation,, request a digest or carry out 
routine maintenance on your subscription to the list then go to:
http://www.bcab.org.uk/mailing-list.html

Alternatively, send an email to bcab-request@xxxxxxxxxxxxx with the word faqin 
the subject line. You'll receive an email with advice on managing your 
subscription to the list.
 
If you wish to discuss the administration of the list then contact:
bcab-moderators@xxxxxxxxxxxxx

Other related posts: