Antivirus Xp 2008, Antivirus Xp 2009

BuffaloHELP

Aug 31 2008, 07:16 AM

I've been meaning to write this post for days but the days just got away from me.

Recently I've subjected my personal laptop for this malware which was downloaded to my clients email. The email client was Google Apps (Gmail) and the sender was from a known contact. However the beginning, the issue is that this Trojan was downloaded even through FireFox 2.0.0.16 and passed Google Apps filter. I was also told that some websites contain scripts to disable firewall and download malware without the computer user's knowledge.

The final product is called Antivirus XP 2008 and here are the symptoms: 1) you will immediately notice that your firewall is disabled 2) background has changed 3) cannot change your background 4) cannot change your screensaver 5) cannot launch Control Panel to do anything 6) cannot launch normal programs 7) cannot launch CMD or any command programs 8) cannot launch regedit 9) cannot clean spyware(s) that keeps on spawning 10) your typical antivirus does not show any alert.

The names of malware are different but they all reside under

C:\Windows\system32\lph*********.exe
C:\Windows\system32\*ph****.BMP
C:\Windows\system32\ntos.exe
C:\Windows\system32\wsnpoem\*
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll

It is still unclear to me if two applications are working together (wsnpoem, ntos and lph********.exe a.k.a. a.exe). But the solution I found was able to clear my laptop from the hijacked stage.

Trojan types reported

lph**********.exe | Trojan horse SHeur.CDRG
ntos.exe | Trojan horse PSW.Generic6.YTJ

Download SDFix.exe (also attached at the bottom of this post).

How to use SDFix

Download SDFix and extract. I recommend that you unzip and unpack (self extracting EXE file--this board will not let just EXE file to be posted) on your desktop. You will be running this fix under the SAFE mode. So it's better to have it where it can be located quick and fast.

Restart your machine and enter SAFE mode. To enter SAFE mode, simply hold down F8 during the restart. You will hear continuous beeping sound but I suggest you hold it until you see the Windows start up option screen. Select SAFE MODE.

Once you start in SAFE mode, go to the SDFix folder and double click to run RunThis.bat. A command prompt will open and will take about 10 minutes to do its own thing. Once the registry is clear from the Trojan it will ask you to restart the machine. Follow the on-screen instruction. Once restarted SDFix will run once again. This will take another 10~20 minutes. A message will appear at the end of the clean up showing Report.txt as a log. No need to save since it saves and displays at the same time.

You should be clear from this Trojan. Enable your firewall, run your usual spyware remover and virus remover.

Key registries affected by Antivirus XP 2008

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\
parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\
parameters\firewallpolicy\domainprofile\authorizedapplications\list]

SDFix file
[attachment=1281:SDFix.zip]

UPDATE
============================================================================
Direct download for latest patch from original source
http://downloads.andymanchesta.com/Removal...DFix_ReadMe.htm

Antivirus Xp 2008, Antivirus Xp 2009 - Recent Trojan Threat - find symptoms and fix

Antivirus Xp 2008, Antivirus Xp 2009 - Recent Trojan Threat - find symptoms and fix

Latest Entries