Avast WEBforum

Other => Viruses and worms => Topic started by: Muni70 on December 23, 2008, 12:13:40 PM

Title: www.007guard.com
Post by: Muni70 on December 23, 2008, 12:13:40 PM
Hi! when I run AgentNetstat I see: remote adress hxxp://www.007guard.com conected. I would like to know how can I kill this malware.

I tryed: ccleaner, shutdown system restore, start in safe mode, run malwarebytes, ccleaner again, restart and antivirus online...
But nothing 007guard is still there. ???
I have the free avast home version.
Thank you a lot.
Title: Re: www.007guard.com
Post by: Lisandro on December 23, 2008, 12:20:35 PM
I suggest:

1. Clean your temporary files.
2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! (http://www.freedrweb.com/cureit/) instead.
3. Use SUPERantispyware (http://www.superantispyware.com), MBAM (http://malwarebytes.org/mbam.php) or Spyware Terminator (http://www.spywareterminator.com/) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
4. Test your machine with anti-rootkit applications (http://www.antirootkit.com/software/index.htm). I suggest avast! antirootkit (http://files.avast.com/files/beta/aswar.exe) or Trend Micro RootkitBuster (http://www.trendmicro.com/download/rbuster.asp).
5. Make a HijackThis (http://www.bleepingcomputer.com/files/hijackthis.php) log to post here or this analysis site (http://www.hijackthis.de/#anl). Or even submit the RunScanner (http://www.runscanner.net/) log to to on-line analysis.
6. Disable System Restore and then reenable it again.
7. Immunize your system with SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html).
8. Check if you have insecure applications with Secunia Software Inspector (http://secunia.com/software_inspector/).

Title: Re: www.007guard.com
Post by: FreewheelinFrank on December 23, 2008, 12:54:52 PM
The answer is here:

http://forum.avast.com/index.php?topic=40574.msg340233#msg340233 (http://forum.avast.com/index.php?topic=40574.msg340233#msg340233)
Title: Re: www.007guard.com
Post by: Muni70 on December 23, 2008, 01:56:15 PM
Thanks a lot :)... now say localhost conection established

The answer is here:

http://forum.avast.com/index.php?topic=40574.msg340233#msg340233 (http://forum.avast.com/index.php?topic=40574.msg340233#msg340233)
Title: Re: wXw.007guard.com
Post by: DavidR on December 23, 2008, 03:10:54 PM
Can you please modify your first post and edit the URL so it isn't active to avoid accidental exposure. Change the www for wXw, e.g. wXw.007guard.com