JS:Banker-IC help

[dallasa]

Here is the log of that scan. And yeah, moving the file to the chest doesn't seem to help much. I ran a full boot-time scan a few days ago, which detected wpad.dat and moved it to the chest, but the warnings continue.

[Mephitidae]

ive found it, complete with url from which its downloaded, in the registry... dunno if deleting those keys would be a good idea or not tho...


---

addendum

well... i finally got rid of it but.... um... id rather tell essexboy how i did it so he could translate my 'slide in sideways' approach to this thing to something everyone could do... so... yeah....  essex... when you get back online drop me an email or pm... (pref email cos i cant send pm over this forum for some reason)

[mchain]

ive found it, complete with url from which its downloaded, in the registry... dunno if deleting those keys would be a good idea or not tho...

Hi Mephitidae,

Perhaps a better idea would be to post the registry lines here so essexboy can have a look for it.  We are all numpties when something new like this comes along... best to wait on these registry references....

...Once you have 20 or more posts here, then you can pm....

[Mephitidae]

well... thats just it... i had a mindset of 'im just going to reinstall anyway so what the heck' when i did what i did so i didnt care if i broke things... fortunately i didnt and fixed it instead... i didnt keep a record of the registry lines... but they may be in the backup data... ...registry tricks arent what solved it tho and thats where the slide in sideways part comes in...

[DavidR]

Having gone this far it would best followed through, that way it would have helped you, but importantly give essexboy information to help others in this position.

I think he feels like I do a reformat and reinstall (nuclear option) is one of last resort.

[Mephitidae]

false alarm.... didnt get rid of it.... only blocked it for a single reboot and then it came back.... even tho there is nothing in the registry that references the url its downloaded from....

-- edit

i cant change the homepage IE is set to either... so something is most likely hidden in gpedit.msc .... yay...

--edit again

something is rewriting it ... its being stored in HKU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections among other places...  ... mentions a malformed url http://wpad/wpad.dat ...

[Bluemeanie]

This may or may not be related, but I remembered reading something earlier where they talked about Wpad.
http://www.wilderssecurity.com/showthread.php?t=327034

[essexboy]

I believe that I have found the common denominator now... Took some reading but fingers crossed

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

  :OTL
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = net.ms
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[Mephitidae]

that caused a hard freeze when it wanted to reboot but i reset the machine and it continued...

heres the log file....


oddest part about this log is that opera java and flash were uninstalled quite some time ago..

--edit

didnt clean the virus out either... it still re-downloaded

[essexboy]

Have the alerts ceased ?   Also could you run a quick scan so that I can check the TCPIP

[essexboy]

OK just seen that could you run this MSFixit prior to the OTL scan please http://support.microsoft.com/kb/299357

[Mephitidae]

heres the resetlog.txt from the KB article.... the OTL quick scan is taking quite a while... will post that when its done...

[essexboy]

The fixit replaced some bad values... This has shown that I need to learn more about networking

[Mephitidae]

OTL quickscan is stuck.... its used about 600+mb of ram which on my system (256mb) goes into the page file.... its just sitting there thrashing the hdd while doing nothing...

suggestions?

[essexboy]

Aye stop it reboot the system and just run a quick scan