3 replies to this topic

[c02]

I had been having a number of problems that may or may not be gone. I posted a log on the appropriate thread a couple of days ago but there was no response. In the meantime I was still having ugly issues with my machine. I awoke this morning to a blue-screen but what separated this one from the others....anytime I tried to log back on I blue-screened again, and again, and again.... I restarted under Safe Mode and ran MWTI's eScan and many issues that weren't found before, were now being deleted. Some of those issues are stated my hijack log thread so I won't repeat them here. Then I ran sysinternals rootkit revealer and found a ton of stuff under a file named WS_Files. The directory so happend to be created around the time I became infected (or noticed the problems). Attempting to open the files inside the directory generated an error stating the file could not be found. I copied the file and pasted it onto my desktop. Now, I am able to view the files. Two files in particular lead me to belive this directory was running a lot of the payload for the various problems. One file was named "dns" and another named "index." When opened in wordpad, both files showed a listing for a TON of ad-servers and links. My assumption is this is where the pop-ups were getting their info but I don't want to jump the gun. Does anyone have any experience with this?

[little eagle]

Did you install this C:\Program Files\Messenger Plus! 3\MsgPlus1.exe

Also you have windows XP you can try system restore.

info on webstart
http://pandonia.canb...a/webstart.html

Edited by little eagle, 15 November 2005 - 12:36 PM.

[c02]

Thanks for the reply. Yes, I do have msngr plus on my system and I recently downloaded an upgrade for it. I went the System Restore route to no avail. Not a single restore point I selected worked and I went back about as far as I could. I'm not sure what the deal is there as the only advice the sys. restore gives you is to try a different restore point.

[little eagle]

Let me look at your log. I'll check for it and post there.