Re: MSN Virus

Dave

I have Ad-Aware SE and Spybot, I also have AVG, Ewido anti-spyware, and
A-squared startcenter. I have dial-up, and it loses connection regularly,
making it almost impossible to download files above 10 MB. For Multi-AV.exe,
I don't have any translation software on my computer, so I am limited to
understanding the website. What does Multi-AV do exactly? Does it provide me
with downloadable scans from various security sites? Also, I'm only a kid and
I'm not really understanding your explanations on how to get the Multi-AV
going. By execute do you mean click on and run the program? I have other
things to do and I'm not spending a whole lot of time on the computer, my
sisters are getting mad that I'm downloading stuff though, because it keeps
them off the computer, too. I'm sorry if I don't respond quickly on here or
if I forget some stuff, but I'm learning and this is summer vacation. Digging
through various forums and computer programs can get tedious and I tend to
wander.

AVG got a large update recently and I downloaded it. AVG found
C:\WINDOWS\system32\rnsmfiv\lsass.exe and deleted it itself. AVG called it
Trojan horse PSW.Generic4.QCX. I do not know whether the lsass.exe had a
lowercase "L" or uppercase "i" but this seemed to fix the problem.

My Zone Alarm firewall was running again, and I could open MSConfig (which I
couldn't before). Now my Windows Defender has again found
SettingsModifier:Win32/PossibleHostsFileHijack, and upon starting my computer
I get an error message saying windows cannot find
C:\WINDOWS\system32\rnsmfiv\lsass.exe and I should try searching for the file
in Search. Then a desktop error message appears saying that
C:\WINDOWS\system32\rnsmfiv\lsass.exe could not be found, and if the file is
not there, then it should be deleted from the registry (which I already did).
Each message repeats itself once.

I think that I have crippled the virus/trojan, but remnants of it still
remain on my system (or something like that).

In MSConfig under Startup there are three (L)or(i)sass.exe startup items.
One has no command and it's location says Startup.

The other two are under the Command of C:\WINDOWS\system32\rnsmfiv\lsass.exe
(which I deleted, so could that be why I get the error messages?). And are
located under HKCU\SOFTWARE\Microsoft\Windows
NT\Currentversion\Windows:(Run), and HKCU\SOFTWARE\Microsoft\Windows
NT\Currentversion\Windows:(load). I have Windows XP so why does the location
have Windows NT in it? Do I dare remove these from the startup?

I am still in the process of downloading updates for various programs and I
haven't gotten to scanning yet. I'll be doing all this today and will reply
back again later.

Thank you,
Matt
--
Fire lead the cavemen to technology, but the fire had the potential to
endanger the cavemen. Technology will lead us to knowledge, but technology
also has the potential to endager us.


"David H. Lipman" wrote:

From: "lil_guy009" <lilguy009@xxxxxxxxxxxxxxxxxxxxxxxxx>

| My computer has been infected by a virus spreading around by MSN
| chatting. My Windows Defender calls it
| 'SettingsModifier:Win32/PossibleHostsFileHijack'. This has shut down my Zone
| Alarm firewall, which I reinstalled to no effect. I've tried getting into
| MSConfig, but that opens up for about half a second and then the virus closes
| the window. I'm betting that I have more programs that are shut down, but I
| haven't begun a thorough observation, yet.
|
| Does anyone know more about this
| SettingsModifier:Win32/PossibleHostsFileHijack virus that spreads by MSN?
|
| Does anyone know how to remove it? Windows Defender detects it at startup
| and says it successfully cleans/deletes/quarantines it, but it's always
| coming back.


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE 2007
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.


For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.pctipp.ch/downloads/dl/35905.asp

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm




.

Relevant Pages

  • Re: Startup Programs
    ... > these pograms to load at Startup. ... What to Know Before You Download and Install Windows XP Service Pack 2 ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: opening attachments causes windows mail to shut down and resta
    ... You might need a system restore to the point prior to when AVG started going bad on you. ... It has only been happening for the past 4 days, when I try to download ... maybe something to do with windows defender ...
    (microsoft.public.windows.vista.mail)
  • Re: D3/NT can no longer shell out to OS
    ... DON'T have some form of AV, download something like AVG and scan the ... Might also want to do a d3vme /debug, ... a reboot of windows can often work wonders (solved ...
    (comp.databases.pick)
  • RE: No XP CD!!
    ... > windows xp startup CD which we don't have for the desktop. ... > can use setup floppy disks. ... Save the download to your hard disk and then send it to the floppy,it ...
    (microsoft.public.windowsxp.help_and_support)
  • SP3
    ... Today I received a MS Download for SP3. ... desktop will not start up Windows at all. ... After reboot it asks how to startup ...
    (microsoft.public.dotnet.general)