[fmolina]

Hi all,

In case it is of any help:

I, as several others this days, found a trojan which:
1. removed my desktop image, replaced by a blue screen telling about spyware, and asking to click for a solution. This new wall paper was contained in a file: c:\windows\default.htm. Deleting the file was useless as every minute or so was replaced.
2. started popping up ballons telling of spyware, internet attacks and the like
3. Opening internet explorer (even when my default is firefox) in a site "livesecuritycenter.com"
4. Popping up big red windows (supposedly from Microsoft) telling that some "inexistent" threat was found
5. Disabling the task manager. Re-enabling from registry was unsucessfull

Full scan by adaware, avast antivirus and norton on line did not help.

I found and downloaded Process Explorer (very good!) in http://download.sysi...essExplorer.zip
It can be opened and showed distinctly, in the process list, the process C:\windows\system32\sbwltbxa.exe
Stopped it, then erased (after full search in c:):
C:\windows\system32\sbwltbxa.exe
C:\windows\prefetch\SBWLTBXA.EXE-2C40CA24.pf

and all references to sbwltbxa.exe in the registry (several, in places such as userinit and helpers), and rebooted. Fixed desktop and enabled task manager in registry. Everything now works OK.

Did this after reading several threads here and founding other people fighting the same thing.

Good site!

Cheers