spambot117 variant and searchprotocolhost.exe

Discussion in 'Malware Help (A Specialist Will Reply)' started by jdrupp2000, Dec 6, 2008.

  1. jdrupp2000

    jdrupp2000 Private E-2

    A few months ago my Comodo BOClean popped up a message saying that trojan spambot117 variant had been prevented from running, but that the file was still present in searchprotocolhost.exe and asked if I would like to remove it. I said yes, and thought the problem had been taken care of. Unfortunately, the message continues to pop up every once in a while - maybe 2-4 times/week. It seems to happen more often after I have restarted my computer, but that doesn't always produce the message, and the message will sometimes appear a 2nd time without a restart in between. I will attach the 4 requested logs in this post and the next.

    Is this something I need to worry about? Is there any way to permanently remove it?

    Thanks so much in advance.
     

    Attached Files:

    jdrupp2000, Dec 6, 2008
    #1
  2. jdrupp2000

    jdrupp2000 Private E-2

    And the final log...
     

    Attached Files:

    jdrupp2000, Dec 6, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing any malware...please give me the exact message that you get.
     
    TimW, Dec 7, 2008
    #3
  4. jdrupp2000

    jdrupp2000 Private E-2

    First, thanks for looking.

    Next time I get the message I will post the entire thing, but it may take a few days before it comes up again. (Though I have restarted the computer recently so it's more likely to show up.)
     
    jdrupp2000, Dec 7, 2008
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not a problem....I'll be here. :(
     
    TimW, Dec 8, 2008
    #5
  6. jdrupp2000

    jdrupp2000 Private E-2

    It's been a couple weeks now and I'm still going without the error message. Thanks for looking through my logs.
     
    jdrupp2000, Dec 21, 2008
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know......if you havent already:

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Dec 21, 2008
    #7
  8. jdrupp2000

    jdrupp2000 Private E-2

    Many thanks!
     
    jdrupp2000, Dec 22, 2008
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are quite welcome....safe surfing. :)
     
    TimW, Dec 23, 2008
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds