Solved backdoor win32 cycbot.b

[FCUSA]

Hi Jacee -

Thank you so much for stopping by during your vacation - I did not expect, but most grateful!

I will work on all this (and hopefully will go smoother since I have done it before).

Although I have not done very much with the computer, I have been on it (limited). Quite frankly, I didn't notice anything really unusual and will work with it a bit more and post anything I see about how it is acting. Loosing my wireless Internet Connection (as posted previously), I did not think much about that as I have actually, mysteriously lost the IP address onece before (according to ATT) and Lorien reviewed the snap shots during this last episode. (apparently I need to do some work on my connection settings.)

Anyway, thank you so much for your attention in this - I really appreciate your quick response and analysis.

Sally

PS Should I run Mbam prior to updating Secunia's PSI?

 

[Lorien]

Network Sharing is off because she is concerned about infecting her new computer over the network. I think as as result (though it could be and probably involves other things - she's getting a 169.168.x.x IP which means she isn't getting a valid IP from a DHCP server - either on her computer or the router), she is unable to use this computer wirelessly (I don't think it's an ATT issue at this point as she can connect by cable and the new computer can connect wirelessly). She has also lost a number of data files (including her Outlook BCM) and doesn't know if it's safe to try to recover them and then use them (or transfer them) or any data on this machine. The same applies to the data on her external backup which I think was disconnected before backing up while the problem existed - but was connected when the problem started (though I don't believe it was being used and I don't think any backup occurred since the problem started). There may be other things, but those are what I have on my list to address when given approval it is safe to do so and/or to work on them.

 

[niemiro]

Hi Jacee -

Thank you so much for stopping by during your vacation - I did not expect, but most grateful!

I will work on all this (and hopefully will go smoother since I have done it before).

Although I have not done very much with the computer, I have been on it (limited). Quite frankly, I didn't notice anything really unusual and will work with it a bit more and post anything I see about how it is acting. Loosing my wireless Internet Connection (as posted previously), I did not think much about that as I have actually, mysteriously lost the IP address onece before (according to ATT) and Lorien reviewed the snap shots during this last episode. (apparently I need to do some work on my connection settings.)

Anyway, thank you so much for your attention in this - I really appreciate your quick response and analysis.

Sally

PS Should I run Mbam prior to updating Secunia's PSI?

Run MBAM first. Don't worry about Secunia until MBAM is done, would be my advice

 

[FCUSA]

Thanks for stepping in, Lorien

Just for clarification - I don't know if there is any current problem with BCM as I have not brought up many programs or files that I might typically use - I simply didn't know if it was wise to or not (fear of spreading the virus with more keystrokes/acitivity). Although I did have a problem with BCM back in September, it has been back up & running without issue. I am happy to pull up some of these files/programs and explore that.

RE: The backup drive, yes we were able to pull the plug on all that prior to a scheduled backup and yes, indeed it was pluged in at the time of infection.

 

[FCUSA]

Thanks for reply, Richard!

 

[FCUSA]

Quick question

I have updated Mbam and noticed that the items from the first scans are still in the quarantine (5 items) - should I be concerned about remove them?

 

[FCUSA]

OK - here it is!

And I am hoping I have something to be excited about!!

I will do some work on the computer and report back with anything that does not seem right.

I DO HAVE ONE QUESTION:

In Jacee's instruction wtih MBam (post #140) -the 3rd lines says: "Be Sure that everything is checked, and click Remove Selected" Is that in a different version or have I just not found it? I only have the Quarantined Tab and it does not have any place for checks, just delete all or restore all (there are 5 items from the first scan).

Will post back with computer performance.

Thanks everyone,
Sally

 

[Jacee]

You can delete all. Have you changed all your passwords, using a different computer?

 

[FCUSA]

Hi -

Was not expecting to see you again today - thanks for stopping in again.

Yes, I did with the new computer.

I have not worked on the Vista yet to see if I notice anything unusual. Do the reports look good? Or can you say yet?

Thank you so much,

Sally

EDIT: Well, I am just doing a little browsing, checked BCM (contacts look good at this point). I've changed around through the Users and they all seem to be loading fine (if not better). No trouble with searching, Google etc.

I will work on connections and such over the next couple days, but appreciated what Lorien was able to share. I will connect with him on that just so I understand it better.

I did just want to give you a little more info about the Vista before you signed off and hope to get a 'thumbs up' when you have completed your analysis.

Words cannot express how grateful I am that you were able to check in on my problem while on vacation and during the holiday.

In the event we do not speak before, have a wonderful vacation and very best wishes for the New Year!

Sally

 

[FCUSA]

Hello All!

I have reviewed the install information for Secunia PSI.

I am doing it from Admin and computer said it was an unidentified author and asked for approval - I gave it.

The download went very quick and when I went to open the program I received the attached error.

What should my next step be?

 

[derekimo]

Hello All!

I have reviewed the install information for Secunia PSI.

I am doing it from Admin and computer said it was an unidentified author and asked for approval - I gave it.

The download went very quick and when I went to open the program I received the attached error.

What should my next step be?

Uninstall it from programs and features and try saving it to your desktop before you install again.

 

[FCUSA]

Hello - thanks for such a quick response.

It is actually on the Desktop (as I was uncertain where to install it); it has the admin shield (I am not sure it is installed yet? - I think I have only downloaded the file but I don't think it has installed yet.

 

[derekimo]

Hello, and you're welcome,

I would try to download a fresh installer after removing that one, also here is some info on that error How to Fix a NSIS Error | eHow.com and how to fix it.

Is it listed in programs and features? if it is uninstall from there as well.

 

[FCUSA]

Thank you -

I will review the link info you provided for solution - I was at the Secunia looking for install errors!

I do not see the program in 'Programs & Features'

 

[derekimo]

Thank you -

I will review the link info you provided for solution - I was at the Secunia looking for install errors!

I do not see the program in 'Programs & Features'

You're welcome,

Sounds like it was never installed so it is either a corrupt download or that link will help you with that error.

Let us know how it goes.

 

[FCUSA]

Well -

I have removed it from the desktop and we are rebooting. I will run Anti Virus (I guess now I am concerned it could be a symptom of my Virus attack). PSI offered two additional options in download:

1 - using an ftp location
2 - downloading an older version

Assuming, the Virus Scan is clear I guess will just try to reinstall the same way as the first to see if it (error) persists.

Some of the Fixes called for turning Firewalls off - something tells me that is not a good idea?

will keep you posted.

OK -

I have run MBam - all clear.
I tried downloading the newest version installer - could not launch - same error
I tried downloading the older version installer - same problem.

When the installer is downloading - it seems to happen too quickly. The status bar barely starts and the window closes. I have checked Programs & Features - it is not there.

OK!

Resolved the issue by downloading via the FTP link. Launching.

Thank you,

 

[derekimo]

OK!

Resolved the issue by downloading via the FTP link. Launching.

Thank you,

You're welcome. Although you may have solved that on your own. :D

Nice work.

 

[FCUSA]

OK -

This may have been a first! Baby steps!

Thanks for being there for the big moment. BTW the scan/updates ran great and all is good.

Have a great day.

 

[derekimo]

OK -

This may have been a first! Baby steps!

Thanks for being there for the big moment. BTW the scan/updates ran great and all is good.

Have a great day.

Excellent! There's always someone here to help out.

That's great news, you have a great day too!

 

[Jacee]

OK -

This may have been a first! Baby steps!

Thanks for being there for the big moment. BTW the scan/updates ran great and all is good.

Have a great day.

Good! Now create a fresh/clean restore point Create a System Restore Point in Vista [How To] | Windows Vista Customization | Windows Tools, Help & Guides