[jettybest]

Hi Sam, Thank you very much for your help. I have 2 questions at the moment:

A, When I use Killbox and paste the exact file location:
C:\WINDOWS\MCROSO~1\scrss.exe, still can find the file and if I terminate the process, the computer will blue screen again. So, I can not understand why scrss.exe will appear both system32 and C:\WINDOWS\MCROSO~1\, also, I mentioned that I tried to terminate with ".....on reboot options", it popup "PendingFileRenameOperations Registry Data has been Removed by external Process!", could please explain what is this means?

B, Just this after noon, I was viewing BBC, MS Antispy ware popup a message said that my defalt search will chage to "#!$#%@^(full of code)", I blocked it. following is the log from MS Antispy:
Internet Explorer URLs alert

Occurred on: 2006-2-25 at 16:57:25

The user Administrator, has decided to block the Internet Explorer Search Page URL change from its original URL of http://www.msn.com/access/allinone.asp to

About Internet Explorer URLs:



Till now, there are not any other popups from system.

Thank you again for your kind help!

[Advertisements]

A, When I use Killbox and paste the exact file location:
C:\WINDOWS\MCROSO~1\scrss.exe, still can find the file and if I terminate the process, the computer will blue screen again. So, I can not understand why scrss.exe will appear both system32 and C:\WINDOWS\MCROSO~1\, also, I mentioned that I tried to terminate with ".....on reboot options", it popup "PendingFileRenameOperations Registry Data has been Removed by external Process!", could please explain what is this means?

Killbox will get the PendingFileRenameOperations error when a malware file deletes the PendingFileRenameOperations registry value.

Can you clarify something for me? Do you have 2 instances of scrss.exe that show up in your task manager?
Can you locate this directory?

C:\WINDOWS\MCROSO~1\

[Buckeye_Sam]

A, When I use Killbox and paste the exact file location:
C:\WINDOWS\MCROSO~1\scrss.exe, still can find the file and if I terminate the process, the computer will blue screen again. So, I can not understand why scrss.exe will appear both system32 and C:\WINDOWS\MCROSO~1\, also, I mentioned that I tried to terminate with ".....on reboot options", it popup "PendingFileRenameOperations Registry Data has been Removed by external Process!", could please explain what is this means?

Killbox will get the PendingFileRenameOperations error when a malware file deletes the PendingFileRenameOperations registry value.

Can you clarify something for me? Do you have 2 instances of scrss.exe that show up in your task manager?
Can you locate this directory?

C:\WINDOWS\MCROSO~1\

[jettybest]

Sorry, Sam.

Just go back to the safe mode, use Killbox, can not find scrss.exe in the directory C:\WINDOWS\MCROSO~1\.

However, I search "scrss.exe" in C:\, but the search result is 0....confuse again. if search result is 0, where scrss.exe comes from??


By the way, when I check my system32 folder, I found another find named "sd14.bat" which I never saw before. I use notepad open it. in side as follows:

:R
del C:\WINDOWS\TEMP\ddl3B.tmp.exe
if exist C:\WINDOWS\TEMP\ddl3B.tmp.exe goto R
del sd14.bat

is this the normal file?

Thank you again Sam!

[Buckeye_Sam]

Please make sure that you can View Hidden Files

• Click Start -> My Computer
• Select Tools -> Folder options
• Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
• Also make sure that 'Display the contents of system folders' is checked.
• Make sure "Hide extensions for known file types" is unchecked
• Make sure "Hide protected operating system files (recommended)" is unchecked
• For more info on how to show hidden files click here.

Now look in this folder and tell me what's there.

C:\WINDOWS\MCROSO~1

Also tell me the complete(untruncated) name of that folder.



There's nothing to indicate that batch file is malicious.

[jettybest]

Have checked.

C:\WINDOWS\MCROSO~1 folder has gone. There are only one empty folder C:\WINDOWS\MICROSOFT\MICROSOFT, there are nothing in this folder.

But, I search the whole computer, I search result for SCRSS.EXE is still 0.........

Anyway, my computer looks fine.
Thank you, Sam, I really learn a lot from this and I spent nearly whole week to fight with this bug!

I will help others if I could within this forum......

[Buckeye_Sam]

I'm glad I could help.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

[jettybest]

I have checked above list, honestly, before I got infect with outinfo, I installed half of them and keep them uptodate. Also, my system is WIN2K3, I did not set restore point. I really comfused how my machine got affected.

Anyway, I will install more application and do be carefully in the future.......

Thanks Sam! You are a star!

[Buckeye_Sam]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.