Arrgghh - Facebook virus!!!! Help needed...

Bluebird_2

Got it too. Cheers for resolution. Working purrrfectly now.


Malwarebytes' Anti-Malware 1.28
Database version: 1234
Windows 6.0.6001 Service Pack 1
06/10/2008 17:41:32
mbam-log-2008-10-06 (17-41-32).txt
Scan type: Quick Scan
Objects scanned: 45139
Time elapsed: 5 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\System32\119987\119987.dll (Trojan.BHO) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\TypeLib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\!!2231839a-f38e-4066-bf3c-959006189942} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\!!2231839a-f38e-4066-bf3c-959006189942} (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\System32\119987\119987.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\fmark2.dat (Malware.Trace) -> Quarantined and deleted successfully.

chriswl

OK, I got caught out by this as well, I think it was a message sent by a firend about 'the funniest you tube film ever' or something, it added an application to my facebook profile as well.
The good news it that the malware program works, I can now follow links properly.

Thanks to the person who suggested it.

renegade

Thanks Browntoa, I downloaded this and it found 163 - yes163 infections.
They were Adware.Starware.
How can I prevent this happening again?
I have just sat for 1 hr downloading and installing AVG free edition then it failed! I am at my wits end, I have tried avast but had problems with completeing that also. Is there something wrong with my PC or is it me?
My Firewall is Comodo and its excellent although time consuming when you are downloading/installing stuff as it pops up at every move the installer needs access to, its so long winded especially when at the end it hasnt worked!
Thanks in advance.

Browntoa

Check the Windows Installer service is running- Start/Run/type:services.msc

Try downloading the latest Windows Installer

then try avast again

to stop these type of infections avoid opening attachments to emails, only download software from proper known loacations, never click on a link that offers to check your system for free. Also keep your antivirus up to date and scan with it on a regular basis

aliEnRIK

renegade wrote: »

Thanks Browntoa, I downloaded this and it found 163 - yes163 infections.
They were Adware.Starware.
How can I prevent this happening again?
I have just sat for 1 hr downloading and installing AVG free edition then it failed! I am at my wits end, I have tried avast but had problems with completeing that also. Is there something wrong with my PC or is it me?
My Firewall is Comodo and its excellent although time consuming when you are downloading/installing stuff as it pops up at every move the installer needs access to, its so long winded especially when at the end it hasnt worked!
Thanks in advance.

when installing, switch comodo to INSTALLATION MODE and select INSTALLER OR UPDATER as the defense policy
If the installation still fails then switch defense OFF until its completed, then back into SAFE DEFENSE mode

for updating just select INSTALLER OR UPDATER (and REMEMBER THIS ANSWER)

Browntoa

http://support.microsoft.com/kb/310791

Using Group Policy

1.Click Start, and then click Run.
2.Type gpedit.msc, and then click OK.

Expand the following items:

Software Restriction Policies

then make sure it says unrestricted

CLLC

Should you remove malwarebytes after you have done the scan or can you keep it on there?

Browntoa

you can keep it , just run "adhoc" like you would Spybot or Ad-Aware

CLLC

Thank you , but what is adhoc?

Browntoa

sorry ...as needed , once in a while

I run it once a month or if I feel I may have mistakenly clicked on something