Downloader.VB.EC

• Previous message: Stan: "Re: XXXserver"
• In reply to: Kevin: "Downloader.VB.EC"
• Messages sorted by: [ date ] [ thread ]

Date: Mon, 12 Apr 2004 10:32:57 -0700

Here is a post that probably will help. I have edited out
some rambling and obsceneties:

"I had to remove them myself. I found the following
files, which were not
detected by the most recent updates for Spybot S&D, and
were also not
immunized against by the most recent updates for
SpywareBlaster.

pup.exe
over.exe
7vgav.exe
indstrf.exe

All of them list in the properties as being registered to
Tmax corp,
which is an ad-firm in England. [...]

Here's what I had to do. I found pup.exe and over.exe in
my program
files. I deleted them. I found 7vgav.exe and indstrf.exe
in my
c:\windows\system32 folder. I deleted them as well. NOTE:
In order to
delete those two files, you have to do ctrl/alt/del and
go to the
processes tab. You will see both processes running,
7vgave.exe and
indstrf.exe, so right-click on them and click "end
process." If you
don't do that, you'll get an error about them being in
use when you try
to delete them. After ending the process, you can delete
them no
problem.

I also went into my registry to the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run

The registry keys located there show you what programs
are being run
when you boot your system. You will see keys for both
7vgav and
indstrf, so right-click them and delete them.

After that, I rebooted my pc and rechecked everything.
Nothing had come
back, so I think I got it all. My browser isn't giving me
pop-up ads
anymore either. I searched the registry for both pup.exe
and over.exe
but didn't find any of them. I think I'm clean now.

[...]"

If that does not solve your problem, feel free to repost.

Sincerely,
Benjamin Johnstone-Anderson
Microsoft "MVP" - Windows Security
Remove "SPAM" from email address to reply!
Security Manifest: www.msmvps.com/trafton/

>-----Original Message-----
>Even though I have AVG running and a firewall I have
>managed to contract the Trojan horse: Downloader.VB.EC
>Can anyone help me get rid of it. It is residing in
>C:windows.pup.exe it gets detected then removed but
>pops back up as soon as I try to use windows media
>player. I have also tried A2 (squared) but alas to no
>avail.
>
>Regards
>
>K
>.
>

• Previous message: Stan: "Re: XXXserver"
• In reply to: Kevin: "Downloader.VB.EC"
• Messages sorted by: [ date ] [ thread ]