cgrant26 Posted February 10, 2011 ID:387077 Share Posted February 10, 2011 I'm running Windows XP64Program self-installs from browsing infected website.While running it disables the task manager and sets lan to connect through a proxy instead of "automatically detect settings".It starts an "antivirus scan" with several pop-ups asking you to activate your anti-virus protection. Scan window and popups are persistant and overlay everything else on the desktop.I was able to kill it by opening a command prompt and running "taskslist" and then "killtask /PID XXXX /f"Only one process I was able to identify as being abnormal was mswqwbssika.exeFull Malwarebytes scan (updated first) did not detect any malicious items. Link to post Share on other sites More sharing options...
cgrant26 Posted February 10, 2011 Author ID:387080 Share Posted February 10, 2011 I zipped the bad file to be able to upload it.It's location was C:\Documents and Settings\Administrator\Local Settings\Temp\kuaunvifhmswqwbssika.zip Link to post Share on other sites More sharing options...
Maniac Posted February 10, 2011 ID:387122 Share Posted February 10, 2011 Hello cgrant26! Welcome to Malwarebytes' Anti-Malware Forums!My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following: The process of cleaning your system may take some time, so please be patient.Follow my instructions step by step if there is a problem somewhere, stop and tell me.Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.Instructions that I give are for your system only!If you don't know or can't understand something please ask. Do not install or uninstall any software or hardware, while work on.Keep me informed about any changes.You're right, MBAM did not detect it with the latest updates, so please send it for analyse.Upload your archive here:http://forums.malwarebytes.org/index.php?showforum=51But first read the rules:http://forums.malwarebytes.org/index.php?showtopic=31067Let me know when you're ready! Link to post Share on other sites More sharing options...
LDTate Posted February 21, 2011 ID:391569 Share Posted February 21, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts