I went to the elephant computer site that you gave a link to, and I have
been using S&D for a while. I think that I just realized what david said
about certain things being password protected from an immunization when I ran
smitfraud. I had just run S&D: immunize, after I got infected by spyaxe, in
the hopes it would quarrentine it. You and David have both given me alot of
links/info that I will thouroughly investigate.
I will never understand how a business could hope to get customers by
first infecting them with their own product, as is the case with SpyAxe. If
anything, the last thing I would do is give money to the "business" that
caused the problem in the first place. Thankfully people like you guys in
these forums exist to help laypersons like myself. Thanks for taking the
time to point me in the right direction concerning malware. Well, have a
good new year!

From: "king_bob" <kingbob@discussions.microsoft.com>


Replies are inline...

| Ok, here is the html file you wanted david.
|
| Virus Scan Report File
| Virus Scan Information
| McAfee VirusScan for Win32 v4.40.0
| Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights
| reserved.
| (408) 988-3832 LICENSED COPY - Sep 23 2004
|
| Scan engine v4.4.00 for Win32.
| Virus data file v4663 created Dec 30 2005
| Scanning for 168331 viruses, trojans and variants.
|
| 12/30/2005 22:35:31
|
| Options:
| /ADL /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL
| /PROGRAM /EXCLUDE C:\MCAFEE\EXCLIST.TXT /MIME /HTML
| "C:\MCAFEE\SCANREPORT.HTML"
|
| Scanning C: []
| C:\install.cab\ISEARCH.CAT ... Found potentially unwanted program
| Adware-Isearch.
| Scanning C:\*.*


That's it ? It stopped right there ?

At least I can say delete; C:\install.cab

I would *REALLY* like to see the McAfee Scan go through completion.

I have an updated version of my tool; SmitFraud.exe

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe



|
| Thanks for all the links. After new years I will get a chance to check
| them out and if you want info about what I find out, let me know and I'll
| post back.
| Again, I looked at the sun java thing, IE, Tools, Sun Java Console. It
| says that it is version 1.5. I know you said it should be 5.0, but I don't
| know how to remove it. I went to IE, Tools, Options, Programs, Manage
| Add-ons and found listings for sun java console, JScrispt language, two java
| plug-in 1.50_05's, and a Java plug-in 1.50_03. It gives filenames for each,
| but I am unsure of how to delete them, and which ones to delete in the first
| place.
| Thanks for your responses and happy new year!
|

Sun Java's version numbering system is confusing. It sound like you have a non-vulnerable
version of Sun Java.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm