Printable View
and now I can't change it back... I've run the proper anti-spyware software after being infected with spyware. Everything seems to be back to normal except that my desktop reads : SPYWARE INFECTION on a blue desktop. I've gone into properties and tried changing my desktop but it's locked so that I can't changed my desktop... any idea? :confused:
Does it look like the photo I uploaded? If so, you have one of the new Win XP exploits. Most if not all antivirus makers should have definitions for it by now but if you already have the exploit, I'm not sure if you can get updated?
Here is more info http://www.f-secure.com/weblog/
If you can't update your antivirus, try downloading Dr Web CureIT and running it. After you start it, go into the Options and turn off the heuristics detection. Then let it scan all of your PC.
http://download.drweb.com/drweb+cureit/
Thats exactly what it looks like, I've downloaded and am running a scan on (C:) w/ Dr. Web [with heuristic detection off] It looks like it will take a while so I will get back to you. Thanks again :]
okay i ran the scan and it found a few objects and deleted them, but my desktop remains locked as the blue screen you showed me, is there something im missing? :confused:
Craze221: This is not looking good. I have looked at tons of places of how to get rid of the .wmf exploit and cannot find any. I posted the question over at dslreports (at the .wmf exploit thread) and they say there is no recovery. One has to wipe the drive and start fresh. http://www.dslreports.com/forum/rema...9~start=80#end
I will keep looking but so far, this thing looks as bad as anything EVER! :(
Thanks a lot for looking into it, I've been reading and if I'm not mistaken this thing is new and there is no cure *yet* so do you think instead of wiping my drive I should just wait and see if something is figured out in terms of riding my computer of this exploit? Or should I just get this clearing process over and done with? =\
Sorry I couldn't get back sooner... :)
If you can wait, I would. I do feel that that I would disconnect it from the web. Especially if you use your PC for any personal stuff (banking, PDA syncing and so forth.) That will keep you from potentially losing anything or letting the exploit download any further junk.
I read in one thread that you could try a doing a restore from before you were infected. And then search for any files created after that restore and delete them. I have very mixed feelings about this and I don't know if that is a good idea. If the exploit installs rootkits (as some have said) then a restore may not help at all (rootkits become part of Windows processes themselves and can be very difficult to find and correct.)
Somewhat related...IMO, Dr Web CureIT is a very good product and it is updated quite often. By any chance, did you write down what malware it found?
No, I thought about doing that but I absent mindedly closed the program after it was done scanning and deleting them, and there's no sort of archive to see what I deleted :( I think im going to stick with this and not try to rollback my computer seeing as how you don't really seem to know yourself what would happen. My computer should be safe, and ill be checking that blog you linked earlier to see if they figure anything out. Thanks for all your help today! :D Just hope they nail this! :rolleyes:
Oh well... Another good thing about CureIT is that when you're finished, it cleans up after itself very well. Something unusual for a lot of software!
The dslreports thread link I posted above would be worth following too...
I hope they find a cleanup for this too. The alternative stinks! :mad:
quoted for truth :mad: I'll follow that other thread too, ty againQuote:
Originally Posted by HAN
I hope I am not too late...
Han, why do you think this is the WMF exploit?
What he has is Spysheriff spyware which locks the desktop and places some annoying files in the c:\windows\system32. Paytime.exe is one of the files. I recently fixed a computer with the same spyware. There were rootkits on the computer as well, which I am not sure whether they came from Spysheriff or not. They could have come from something else. In any case, Spysheriff can be beaten. What you need to do is unlock the desktop with a registry key, use HijackThis to get rid of some bad entries, and a rootkit removal program (such as Blacklight. I will post a link with the registry fix and other useful things to get rid of SpySheriff.
http://www.bleepingcomputer.com/foru...xe-t22402.html
I know the background picture is different, but we are talking about the same malware.
usil: Truthfully, I can't say that it is positively the WMF exploit. But I felt (and still feel) that the signs sure point to it. It apparently happened (more or less) in the right time frame. Plus, Craze221 had the exact screen that the blog at Sunbelt (maker of CouterSpy) listed as one of the first known versions of the issue. By all accounts I have read, both at that time through today, the general concensus is that there is no way to clean up the mess that is left behind. Several folks looking at the WMF issues have said they would never trust the PC again without starting over.
That said, I'm very open (and I would imagine Craze221 is too) to other ideas. To me, if a PC can be cleaned up, that is much more preferable to a complete reinstall. In my case, reinstalling everything would take a couple days or more...
Thanks for the link Usil my laptop got infected yesterday and despite following the removal instructions at Norton which removed the problem [I assume] the desktop background persisted so I`ll have a gander later and try the fix.
Well, that changes things a bit. Cause I don't believe you downloaded Spysheriff. You didn't, right 10?
Han, I tried to look for the connection between the locked desktop and the WMF but didn't find one. Can you send the link to the article you read?
OK, this clears things up for me. Turns out we are both correct Han.
That explains why I've seen different "anti-spyware" malware programs connected with that desktop background, and why 10 could have gotten it simply by surfing certain websites. I read somewhere that a certain legitimate bank website was hit with the same problem. So the banks customers got the exploit simply by going to the site.Quote:
According to F-Secure, Trojan downloaders are taking advantage of the vulnerability to install Trojan-Downloader.Win32.Agent.abs, Trojan-Dropper.Win32.Small.zp, Trojan.Win32.Small.ga and Trojan.Win32.Small.ev. F-Secure also reports that some of the Trojans install hoax anti-malware programs such as Avgold.
I found the connection between the WMF and the locked desktop. I previously thought that the rogue anti-spyware programs brought the exploit with it, but I misunderstood. What really happens is that the exploit has always been there and the WMF exploit allows for the rogue anti-spyware programs to be installed on your system without asking you. They then have you enter your credit card details in order to get rid of the locked desktop. They've really gone too far this time! :mad:
I ended up with spysherrif on there somehow but how it got there is a bit of a mystery. :confused:Quote:
Cause I don't believe you downloaded Spysheriff. You didn't, right 10?
Well thats what I explained in my previous post. The exploit allows these rogue anti-spyware programs to install themselves on your computer just like that! Without asking your permission, without anything popping up. Scary, eh?
Well that seems to have removed the thing all together.Thanks for the assist https://discussions.virtualdr.com/im.../2006/05/2.gif
usil: Here is the link where I found the screen info. The photo is under Tuesday December 27th and the header is "New exploit blows by fully patched Windows XP systems".
http://sunbeltblog.blogspot.com/2005...g_archive.html
Han, I've been doing so much research on this thing that I came up with that already. But thanks anyway :)
10, what do you mean it got rid of it? What did you do, and what now works?
Well I aready went to Norton and went through the solution offered there for the problem but still had the screen and spy sherriff.So on closely following the instructions from the link you provided Ewido found and removed 1000 issues insafe mode rebooted deleted a few folders from the Documents and Settings accounts along with uninstalling spysherrif and all seems to be well.This said I only did it very last night so we shall see.
Ewido is a very good product.
Did you install the hotfix/patch against the vulnerability?
Did`nt see a link for it or is it a windows update?
No, its not microsoft related. It is an unofficial patch which all the main security sites suggest installing. It will plug the hole. MS hasn't come out with an update yet, they should release one sometime next week. The unofficial patch can be downloaded here.
On this page, there are more download links of the same patch, and towards the bottom, there is a vulnerability checker. Use it before and after patching your computer to make sure that have fixed the vulnerability.
Microsoft's WMF patch is available early ... get it now.
Microsoft Security Bulletin MS06-001
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919)
Published: January 5, 2006
http://www.microsoft.com/technet/sec.../ms06-001.mspx
Note: If you have Automatic Updates enabled, it will install automatically:
http://h1.ripway.com/SpywareDr/Virtu...s/kb912919.gif
Yes! Good thing I bookmarked this. I had been following F-secure and it didn't look like it was helping me to much so I checked back at this and low and behold! The fix! :D The Bleeping Computer link did the trick, although none of the scans found any malware(I think because I deleted SpySheriff a while back?) My desktop was unlocked therefore I believe it to be fixed. Thanks everyone for the help! :D
Craze221, don't forget to follow the link above in SpywareDrs post to download and install Microsofts patch. Otherwise, you can get it again.
Better yet, go to http://windowsupdate.microsoft.com and click the Express button. Not only will you get the 'WMF' update released back on the 5th, you'll also get at least two new ones released yesterday, the 10th. (If you're running Office 2003, you'll get one more update for Outlook).
Here's a list of the four that I've received (via Automatic Updates) since the 5th. (Running Windows XP Pro and Office Pro 2003):Windows XP - KB890830 - Wednesday, January 11, 2006Since you're (hopefully) already on Windows Update, recommend flipping Automatic Updates On. To do so, in the News box over on the bottom right, click anywhere within the words:
http://support.microsoft.com/?id=890830
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
Office 2003 - KB892843 - Wednesday, January 11, 2006
http://support.microsoft.com/?id=892843
Description of the security update for Outlook 2003: January 10, 2006
Windows XP - KB908519 - Wednesday, January 11, 2006
http://support.microsoft.com/?id=908519
MS06-002: Vulnerability in embedded Web fonts could allow remote code execution
Windows XP - KB912919 - Thursday, January 05, 2006
http://support.microsoft.com/?id=912919
MS06-001: Vulnerability in graphics rendering engine could allow remote code execution(It's painless and only takes a couple of minutes). Once you're returned to the Windows Update site, you'll no longer see the words quoted above in the News box on the right.Quote:
Upgrade to Microsoft Update. Automatically receive updates for Windows, Office and more
If you have any questions about Automatic Updates, click the FAQ link on the left.Microsoft Update > FAQ (Frequently Asked Questions)
http://update.microsoft.com/microsof...out.aspx?ln=en
This page contains a good explanation of Microsoft's Automatic Updates, the Microsoft Update Web Site (Express and Custom), Windows Server Update Services, High priority Updates (Critical Updates, Security Patches, Update Rollups and Service Packs), Optional Updates (Software, Hardware and Beta software), a chart showing the supported versions and languages (including expiration dates), Troubleshooting, Networking and Advanced Information as well as an abundance of links sprinkled throughout for even more related information.
This problem may be related to certain things posted on this thread. My Windows XP kept crashing, giving me a variety of reasons, and things to check. I finally got into the BIOS settings, and disabled caching and shadowing and maybe one other thing, I can't remember what it was, and then I restarted my computer, and voila! my computer has not crashed since. I have since run my anti-virus software and it did detect a bug: AdAware. So I deleted it, and everything has been fine since. :)