Spyware.Banker Detected in MBAM Scan

**SevenYears** · #81 23rd Apr 2009, 17:20

Ran the sfc /scannow and had my xp CD in but still got a few prompts to put in a different CD. Tried DDS afterward and nothing changed.

**evilfantasy** · #82 24th Apr 2009, 13:26

Try a Repair Install. http://www.michaelstevenstech.com/XPrepairinstall.htm

**SevenYears** · #83 24th Apr 2009, 18:59

I was reading through some of the warnings on the previous step you listed there and it seems really sketchy. I'm not sure I will be able to back everything up. (Or maybe there is something I am missing in the instructions?) I did read somewhere that the C:\i386 folder has all the files that the sfc scannow tries to replace. So my questions is what if I were to just take all the files from the i386 folder that I have found on the XP CD and simply copy them into my C Drive?

**evilfantasy** · #84 24th Apr 2009, 19:10

Quote:

So my questions is what if I were to just take all the files from the i386 folder that I have found on the XP CD and simply copy them into my C Drive?

That's pretty much what a repair install is going to do. It's kind of like a fresh only install without loosing anything that is already there like your settings and software. And is safer and much easier than trying to find the file(s) you need to replace.

**SevenYears** · #85 24th Apr 2009, 19:41

After I changed the boot sequence in the BIOS to the CD, I saw the screen showing the proper steps but before I could get to the next step in the repair install, I got the blue screen of death. I am not using an XP CD that came with this computer as it never came with one. I think Dell may have just included the Service Pack files in the i386 folder?

**SevenYears** · #86 28th Apr 2009, 17:34

Would running a scan using Gmer's rootkit detection work?

http://gmer.net/index.php

**evilfantasy** · #87 28th Apr 2009, 17:44

Sorry I didn't reply to the last post. Sort of forgot...

Try this.

Download F-Secure Easy Clean to your desktop.

Turn off your antivirus before starting Easyclean

* Double click EasyClean and follow the instructions.
* Please note that it will probably take longer than the "couple of minutes" mentioned on screen could be wrong depending on if an infection is found. As long as the animation is running EasyClean is working.

More information on this tool can be found at the EasyClean FAQ

Post back with the result of this scan. Don't forget to turn your antivirus back on when EasyClean is complete.

**SevenYears** · #88 28th Apr 2009, 18:20

Came back clean.

**evilfantasy** · #89 28th Apr 2009, 18:30

I'm pretty sure we got the malware that time unless this is a Virut infection. Try running Dr Web CureIt again.

Or this.

Avira AntiVir Rescue System

* Download the Avira AntiVir Rescue System
* Place a blank CD in your burner and double-click on the downloaded file.
* The program will automatically burn the CD for you.
* Place the burned CD into the affected computer and start the computer with the CD in the CD tray.
* On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
* Click on the Configuration button.

- Select Scan all files
- Select Try to repair infected files and Rename files, if they cannot be removed
- Select Scan for dialers
- Select Scan for joke programs (Jokes)
- Select Scan for games
- Select Scan for spyware (SPR)

* Click on Virus scanner
* Click on Start scanner at the bottom of the screen

Currently the program does not support saving a log. Please write down the list of items for Records, Suspect files, and Warnings then post them back here.