When the window first opened I got "C:\Documents and Settings\calsof>" and had to type after that. Do I have to change the directory first? Could it be that I have to type "cd c:\" and press enter before I continue?
Aurora, nail.exe, betterinternet trojan [RESOLVED]
Started by
calsof
, Jun 09 2005 11:05 PM
#46
Posted 15 June 2005 - 08:22 PM
When the window first opened I got "C:\Documents and Settings\calsof>" and had to type after that. Do I have to change the directory first? Could it be that I have to type "cd c:\" and press enter before I continue?
#47
Posted 15 June 2005 - 08:25 PM
Because we are giving the entire path, it should work anyways!!
Let me check and revert
Let me check and revert
#48
Posted 15 June 2005 - 08:29 PM
Hi Calsof,
I have a strong feeling that you are clean but lets flush the system restore points again.
A. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
B. Restart your computer
C. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
Can you check if you can see the cas folder in C:\Program files??
I have a strong feeling that you are clean but lets flush the system restore points again.
A. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
B. Restart your computer
C. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
Can you check if you can see the cas folder in C:\Program files??
#49
Posted 15 June 2005 - 08:47 PM
The cas file is gone.
There's a CasStub file
Also, a search of "cas" gives me the following entries:
Cas Recycle Bin
Cas.zip C:\Documents and Settings\calsof\Recent
casclient.zip C:\Documents and Settings\calsof\Recent
cas1fix.exe C:\Documents and Settings\calsof\Local Settings\Temp
cas1fix.exe C:\Documents and Settings\calsof\Local Settings\Temp
Cas.zip My Computer
casclient.zip My Computer
Cas.zip C:\Program Files
CasStup C:\Program Files
gcASCleaner.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasDtServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasInstallHelper.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASNotice.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASPrivacy.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASSoapLib.dll C:\ProgramFiles\Microsoft AntiSpyware
gcasSwUpdater.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASThreatAudit.dll C:\ProgramFiles\Microsoft AntiSpyware
Cas C:\Program Files\Cas.zip
casclient.exe Cas/Client
casclient.zip Cas/Client
casmf.dll Cas/Client
Just to name a few.
Thanks again.
There's a CasStub file
Also, a search of "cas" gives me the following entries:
Cas Recycle Bin
Cas.zip C:\Documents and Settings\calsof\Recent
casclient.zip C:\Documents and Settings\calsof\Recent
cas1fix.exe C:\Documents and Settings\calsof\Local Settings\Temp
cas1fix.exe C:\Documents and Settings\calsof\Local Settings\Temp
Cas.zip My Computer
casclient.zip My Computer
Cas.zip C:\Program Files
CasStup C:\Program Files
gcASCleaner.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasDtServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasInstallHelper.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASNotice.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASPrivacy.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASSoapLib.dll C:\ProgramFiles\Microsoft AntiSpyware
gcasSwUpdater.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASThreatAudit.dll C:\ProgramFiles\Microsoft AntiSpyware
Cas C:\Program Files\Cas.zip
casclient.exe Cas/Client
casclient.zip Cas/Client
casmf.dll Cas/Client
Just to name a few.
Thanks again.
#50
Posted 15 June 2005 - 08:49 PM
The cas file or folder is gone?
#51
Posted 15 June 2005 - 08:52 PM
Hello again Atribune
The cas folder in C:\Program files is gone. But there are other instances of Cas folders and files. I just don't know if it is normal for them to still be there. I just named a few.
I appreciate both your efforts. Thanks again.
The cas folder in C:\Program files is gone. But there are other instances of Cas folders and files. I just don't know if it is normal for them to still be there. I just named a few.
I appreciate both your efforts. Thanks again.
#52
Posted 15 June 2005 - 08:54 PM
These ones are fine they are microsoft antispyware
gcASCleaner.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasDtServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasInstallHelper.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASNotice.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASPrivacy.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASSoapLib.dll C:\ProgramFiles\Microsoft AntiSpyware
gcasSwUpdater.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASThreatAudit.dll C:\ProgramFiles\Microsoft AntiSpyware
The others should be removed.
gcASCleaner.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasDtServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasInstallHelper.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASNotice.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASPrivacy.exe C:\ProgramFiles\Microsoft AntiSpyware
gcasServ.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASSoapLib.dll C:\ProgramFiles\Microsoft AntiSpyware
gcasSwUpdater.exe C:\ProgramFiles\Microsoft AntiSpyware
gcASThreatAudit.dll C:\ProgramFiles\Microsoft AntiSpyware
The others should be removed.
#53
Posted 15 June 2005 - 08:56 PM
Should I delete them manually in Normal Mode?
#54
Posted 15 June 2005 - 08:58 PM
yes please try that first if it doesnt work ill make a file to do it
#55
Posted 15 June 2005 - 09:14 PM
Ok, here goes:
I flushed the recycle bin and got rid of everything including:
Cas Recycle Bin
I looked for C:\Documents and Settings\calsof\Recent but couldn't find it to delete Cas.zip or casclient.zip. I went to Search and deleted them from there.
I went to C:\Documents and Settings\calsof\Local Settings\Temp and deleted one instance of cas1fix.exe. I went to Search and deleted another instance of it from there.
I could not find Cas.zip or casclient.zip in My Computer. I went to Search and deleted them from there.
I found and deleted Cas.zip and CasStub in C:\Program Files
I couldn't find Cas/Client, or any of the files casclient.exe, casclient.zip, Cas/Client and casmf.dll.
I did find a file called casstub.exe in C:\Program Files\CasStub but did not delete it yet.
Please tell me what else to do.
Thanks again.
I flushed the recycle bin and got rid of everything including:
Cas Recycle Bin
I looked for C:\Documents and Settings\calsof\Recent but couldn't find it to delete Cas.zip or casclient.zip. I went to Search and deleted them from there.
I went to C:\Documents and Settings\calsof\Local Settings\Temp and deleted one instance of cas1fix.exe. I went to Search and deleted another instance of it from there.
I could not find Cas.zip or casclient.zip in My Computer. I went to Search and deleted them from there.
I found and deleted Cas.zip and CasStub in C:\Program Files
I couldn't find Cas/Client, or any of the files casclient.exe, casclient.zip, Cas/Client and casmf.dll.
I did find a file called casstub.exe in C:\Program Files\CasStub but did not delete it yet.
Please tell me what else to do.
Thanks again.
#56
Posted 15 June 2005 - 09:15 PM
Oh, yes. And there is a cas_pb.exe in data.
#57
Posted 15 June 2005 - 09:20 PM
email me the casstub folder and cas_pb.exe please.
#58
Posted 20 June 2005 - 11:15 PM
I'm so sorry for the delay.
I've sent another file to Atribune, and feedback to both Atribune and Tampabelle.
Thanks again.
calsof.
I've sent another file to Atribune, and feedback to both Atribune and Tampabelle.
Thanks again.
calsof.
#59
Posted 21 June 2005 - 07:45 PM
Hello again Tampabelle and Attribune,
Just updating here as well as the personal message sent.
The file was called cas_pb.exe in data and I traced it to c:\Documents and Setings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Fizzlebar.zip\data\cas_pb.exe
Now I wonder where it came from, but I definitely did not zip it myself and I don't have a password for it.
I just bought the full version of McAfee Internet Security Suite (the cd version) and I am thinking of getting rid of Norton Virus Protection offline and installing McAfee. Is this a wise thing to do now, or should I leave it until after I have been cleaned up?
Thanks again to both of you.
Regards,
calsof.
Just updating here as well as the personal message sent.
The file was called cas_pb.exe in data and I traced it to c:\Documents and Setings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Fizzlebar.zip\data\cas_pb.exe
Now I wonder where it came from, but I definitely did not zip it myself and I don't have a password for it.
I just bought the full version of McAfee Internet Security Suite (the cd version) and I am thinking of getting rid of Norton Virus Protection offline and installing McAfee. Is this a wise thing to do now, or should I leave it until after I have been cleaned up?
Thanks again to both of you.
Regards,
calsof.
#60
Posted 21 June 2005 - 07:48 PM
Just correcting the path. It was:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Fizzlebar.zip\data\cas_pb.exe
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Fizzlebar.zip\data\cas_pb.exe
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users