2006-04-30
2006-04-29
SpyFalcon.com == MALWARE / SPYWARE / ADWARE
I simply booted from an alternate (clean) partition and cleanned all the infected partitions's:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run:
I still have to find out what the heck put it in that PC, but the user couldn't provide me with enough clues to help me, so... let's wait and see.
Interesting links:
- %CACHE%\CONTENT.IE5\* (all users)
- %TEMP%\* (all users)
- %WINDIR%\TEMP\*
- %WINDIR%\SYSTEM32\hp*.tmp
- %WINDIR%\SYSTEM32\ATMCLK.EXE
- %WINDIR%\SYSTEM32\DCOMCFG.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run:
- "kernel32.dll"="C:\\WINDOWS\\System32\\atmclk.exe"
- "dcomcfg.exe"="dcomcfg.exe"
I still have to find out what the heck put it in that PC, but the user couldn't provide me with enough clues to help me, so... let's wait and see.
Interesting links:
2006-04-28
2006-04-26
2006-04-25
2006-04-24
2006-04-23
2006-04-21
Subscribe to:
Posts (Atom)