|
Re: removal of sywebtelecom malware
Right --- I think that I have found the problem by using MSconfig to selectively enable progs. There is an extra that comes with Spybot called Teatimer. With this enabled both spybot and Adaware report:
Comload: Code storage database (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD}
SYSWEB TELECOM: Code storage database (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{EFB22865-F3BC-4309-ADFA-C8E078A7F762}
FunWebProducts: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
With Teatimer disabled these registry values are NOT getting set.
Bearing in mind that the above registry values could be totally harmless it is
strange that Spybot appears to be setting registry values that are reported as malware by adaware & spybot. Is this coincidence, does spybot come with a payload ( worrying as so many people use it ) or has something attached itself to spybot? Maybe the pattern files are common between the two programmes
I shall contact kolla and see what they have to say. In the mean time I have removed spybot from my machine just in case.
Thanks everyone for your comments
|