Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Another nasty Skybot infection


  • This topic is locked This topic is locked
3 replies to this topic

#1 MusicNeuroGuy

MusicNeuroGuy

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:18 PM

Posted 30 June 2009 - 03:11 AM

Hi folks, new user (of the site) here. I've been trying for four days to get rid of a Skybot infection that appears to be doing three things (that I can tell) - firstly, it redirects most search engine results (thank goodness for NoScript); it interferes with normal shutdown about 75% of the time, and it is now displaying file name suffixes. I've run several anti-everything programs (AVG, Spybot S&D, SuperAS Free, to name a few, in combination with ATF), and the daggone thing keeps reinstalling - even when entering/using safe mode. Since you all are log people, here's my HJT and MbAM. My computer won't let me copy them into the window, so I'm giving them as attachments.

Attached Files



BC AdBot (Login to Remove)

 


#2 MusicNeuroGuy

MusicNeuroGuy
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:18 PM

Posted 30 June 2009 - 11:08 AM

Update, it's multiplying/having more effects. It's taken over my desktop image and I now have one of those little red 'X" shields in the lower right hand corner (the ones designed to look like the Windows security error shield) that keeps saying 'click here to prevent infection from spyware'.

Hello MusicNeuroGuy,

We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the HJT Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.

Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible.

Thank you for understanding.

Regards,

The weatherman
(Moderator)

Edited by The weatherman, 30 June 2009 - 06:09 PM.


#3 MusicNeuroGuy

MusicNeuroGuy
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:18 PM

Posted 30 June 2009 - 07:16 PM

Well, after reading a few other skynet challenges, I ran ComboFix, and that actually took care of it. So, no problem now - huzzah!

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:05:18 PM

Posted 01 July 2009 - 06:47 PM

Please note that even though symptoms are gone does not mean the infection is gone.

Also, ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert." It is NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Running ComboFix by yourself is like performing open heart surgery on yourself--the scalpel and other surgical tools that is ComboFix is meant to be wielded by a highly trained surgeon only in emergencies or dire circumstances. When the surgeon is thru s/he leaves the room. So combofix should be removed from a system once it has accomplished its job, unlike an AV that is there to protect you from future infections.

. . . CF does make some alterations to your system if you run it. Even if you had no malware removed and run the uninstall command, some things may be different now on your system. I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection--but if you aren't infected you might need those restore points.

Read and abide by the disclaimer people. It's there for a reason. Stick to running and protecting yourself with a good AV and firewall and an anti-malware scanner or two. If you feel you need a second opinion, try running online scans. If you feel you might need surgery, come here to BC and ask for help--that is what we're here for.


From: http://www.bleepingcomputer.com/forums/ind...t&p=1159014

If you should experience issues with your computer, please start a new topic.

This topic is now closed.

Orange Blossom :thumbup2:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users