Comments on: PC Infected: kbppsysguard.exe

By: MBH

MBH — Wed, 25 Nov 2009 21:18:19 +0000

Kaspersky isn’t free. They offer a trial. A strong free for home-user AV is Avira. Not as good as Kaspersky Internet Security, but good enough.

New generation worms bring in their cousins when they infect a box, so I wouldn’t be surprised if there are others lurking silently.

By: Bloggylife

Bloggylife — Wed, 25 Nov 2009 21:14:14 +0000

MBH, 1st Thanks then about the keylogger, YUP, I knew this was a possibility so I copied pasted letters to form what I needed But do you mean even after I deleted it, there’s a possiblity of residue I missed, I’m running the link you provided. I like AVG, except the shield feature, I’ll give Kaspersky, it’s free right.
don’t tell me I need to change them, I can barely remember the ones I have xo I didn’t log in keys while I was infected, but I had saved passwords for some sites! But I’ve already disconnected myself from the Internet so I hope I covered everything … you think I still need to change my passwords …

3baid, I’m not sure how it all works, but I deleted all related files/registry entries.

By: MBH

MBH — Wed, 25 Nov 2009 20:59:17 +0000

Consider the possibility of it having installed a keylogger and got your passwords. Make sure you change them.

By: 3baid

3baid — Wed, 25 Nov 2009 20:50:54 +0000

The proxy setting probably means that the trojan was running a local service to hijack all your browser activities :/

By: MBH

MBH — Wed, 25 Nov 2009 20:40:01 +0000

Just because you don’t see it, doesn’t mean it ain’t there.
Run this tool (ComboFix): It cleans the computer and fixes whatever the worms broke: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

AVG stinks. After running ComboFix, remove AVG & install Kaspersky.

It always helps to have a 2nd machine with an antivirus. When one gets infected, hook the disk directly to the 2nd machine & scan away.
The only bad thing about this is that running the antivirus from a 2nd disk doesn’t fix the problems caused by worms. It has to be run directly on the infected OS.