Help!

[True_Snake]

I have this problem with my computer! And I need your help.

On C: drive I have these hidden files as shown in the attachment.

When I delete them, they come back. They also close any internet explorer pages with words like "V - I -R - U - S" etc.

I even tried S a f e m o d e and they still came back.

I GOOGLED it and I figured that there's a tool by Symantic for it but the link isnt working!

See if it works for you:

http: / /securityresponse.symantec.com/avcenter/venc/data/w32.serflog.a.removal.tool.h t m l

(just remove the spaces at the beginning and end.)

This "problem" also was on my other computer and got into this one through a CD I burned on the other one.

It basically burns "a u to r u n .d l l" (without spaces) on to the CD and transferrs to the other computers.

It also closes C T RL A L T D E L every time I press it!

I hope whoever made this virus burns in hell....

Please help!

Thanks !


True_Snake

 

[snoopi]

Download this stand alone application and God bless you my child.

http://download.nai.com/products/mcafee-avert/stinger.exe

 

[True_Snake]

Download this stand alone application and God bless you my child.

http://download.nai.com/products/mcafee-avert/stinger.exe

I already downloaded that and used it; didn't detect anything for some reason. I'll try it again.

By the way, when I click on this thread, the window closes.

I have to use a THIRD computer now.

Thanks snoopi!

Anyone else??

True_Snake

 

[Mark]

What spyware/virus programs you got True ?

I know most cringe at the thought - But the new Microsoft one is picking up a lot of stuff on mine (But there is a bug or 2 still in it as well) But I'll take their gliches over Viruses any day !

- as well as -

Norton
spybot
etc ...

 

[True_Snake]

Ah! I'm in safe mode now; and can access this thread.

Anyways: All4:

I have on this one:

Norton
Hijack This
And That's about it.

On the other one I have:

Spybot
Lavasoft's Adaware
Spy Sweeper
Norton
Hijack This

I fixed the problem on the other one; but my internet screwed up with it!

HELP!

Can I please get the link for the Microsoft one?

Thanks.

EDIT:

Here's my Hijack this log; it's the same on the other one too!

I delete all those hosts and they come back after restarting!

Logfile of HijackThis v1.99.1
Scan saved at 8:23:52 PM, on 15/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Desktop\stinger.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O1 - Hosts: 64.233.167.104 www.symantec.com
O1 - Hosts: 64.233.167.104 www.sophos.com
O1 - Hosts: 64.233.167.104 www.mcafee.com
O1 - Hosts: 64.233.167.104 www.viruslist.com
O1 - Hosts: 64.233.167.104 www.f-secure.com
O1 - Hosts: 64.233.167.104 www.avp.com
O1 - Hosts: 64.233.167.104 www.kaspersky.com
O1 - Hosts: 64.233.167.104 www.networkassociates.com
O1 - Hosts: 64.233.167.104 www.ca.com
O1 - Hosts: 64.233.167.104 www.my-etrust.com
O1 - Hosts: 64.233.167.104 www.nai.com
O1 - Hosts: 64.233.167.104 www.trendmicro.com
O1 - Hosts: 64.233.167.104 www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.mcafee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.mcafee.com
O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.mcafee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
O4 - HKLM\..\Run: [serpe] C:\WINDOWS\system32\serbw.exe
O4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\system32\serbw.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

NEED HELP!

Thanks.

True_Snake

 

[Mark]

I think the "Old Lady" installed it (Microsoft) - and She's 800 miles away :blink:

I think it is in Beta test still and More than likely it was part of an Update ~

http://www.microsoft.com/athome/security/downloads/default.mspx

 

[suthra]

I have uploaded that symantec tool in
http://thankyouspammers.com/FixSflog.exe

incase if u need it

s.s

 

[sufi]

How about formatting your hard drive and installing a fresh windows copy

 

[True_Snake]

WOHOOO! It's fixed!

Thanks snoopi, All4, suthra and sufi:tu:!

The Symantic tool fixed it!

Thanks guys!

Just one thing though; these Symantic "Security Alerts keep popping up!

I've attached a screenshot.
I keep pressing "Okay" and even tried un-checking the box, etc. Just pops up every 30 or so seconds.

I opened Norton, and looked around, can't seem to find a way to stop that.

BTW: I have Norton 2004.

Thaks again!

True_Snake

PS: I gave all of you reputation points, but All4, sorry, I need to "spread it around first":D.

 

[redhippo]

glad you found a solution snake...!