Zlop.CL
in [Windows Viruses]
|
Prev: locate.exe
Next: Ccollgatee Virus
From: David H. Lipman on 16 Dec 2005 22:04 From: "David" <art(a)davidartgallery.co.uk> | Hi | My sons PC | When I boot it up a small window pops up on the right side of the taskbar | with " Download a spyware " | I do a scan with Lavasoft Adware 6 and Quarantined 9 items. In the middle of | the scanning a window pops up with "Virus Alert and says 'ZLOP.CL in System | 32' | I then do a scan with Grisoft AVG Free Edition and send the virus to the | Vault. | This obviously does not get rid of the virus because when I enter an URL in | the address bar of the IE .For example if I type in www.google.co.uk it | quickly turns into www.dns404.net and the little window pops up again in the | right hand side of the taskbar with "Download a spy ware" If I click on this | then different spyware programme try's to upload. | What is the remedy please. | Ta | Thanx to information posted by Retro... Updated removal information. ----- Two part reply.. Perform Part 1 and then perform Part 2 . Use the alternate if the first two parts are ineffective... Note: Alternate only for Win2K, WinXP and Win2003 Server Part 1 ----------- Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe http://noahdfear.geekstogo.com/click%20counter/click.php?id=1 http://www.bleepingcomputer.com/forums/topic36868.html Part 2 ----------- Download SmitFraud.exe from the URL -- http://www.ik-cs.com/programs/virtools/SmitFraud.exe Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee } Choose; Unzip Choose; Close NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your FireWall to enable WGET.EXE to download the needed McAfee related files. Execute; c:\mcafee\clean.bat { or Double-click on 'Clean Link' in c:\mcafee } A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer). It is suggested that you move the report out of c:\mcafee before performing another scan. Alternate: Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool. http://secured2k.home.comcast.net/tools/AntiPuper.exe http://forums.mcafeehelp.com/viewtopic.php?t=65072 * * * Please report back your results * * * -- Dave http://www.claymania.com/removal-trojan-adware.html http://www.ik-cs.com/got-a-virus.htm
From: David H. Lipman on 16 Dec 2005 22:05 From: "Retro" <retrouk@[NOSPAM]gmail.com> | http://www.f-secure.com/weblog/archives/archive-122005.html#00000739 | Thank you Retro !!! -- Dave http://www.claymania.com/removal-trojan-adware.html http://www.ik-cs.com/got-a-virus.htm
From: Leythos on 16 Dec 2005 22:35 If you have SpyAxe, PSGuard, Smitfraud, Sinnaka Advertisments or detections for Puper or Alemod that can not seem to be removed automatically, please try this automated removal tool. AntiPuper v1.0 by secured2k http://secured2k.home.comcast.net/tools/AntiPuper.exe What does this tool do? This tool will attempt to delete several known trojan files. These files are modified by the malware authors and encrypted to avoid detection. Fortunately, many of these tend to use the exact same file names. If the files are in use, locked, protected, ect, this program will schedule Windows to remove the files upon restarting. This program will also remove some common security policies that are changed by viruses and worms. Policies that lock out your desktop changes, windows update, Windows Firewall, Explorer Run policies, Registry editing, and more are all reset. Finally, if you have an infected Alemod WININET.DLL file, this program will try to copy a clean version from your Windows File Protection folder and replace the bad copy on restart. If a backup copy can not be found, the tool will quickly look for McAfee AntiVirus files and attempt to clean a copy of the file to replace the bad one on reboot. If all of this fails, you will need to manually replace/clean your WININET.DLL file. "David" <art(a)davidartgallery.co.uk> wrote in message news:%23HYgQliAGHA.436(a)TK2MSFTNGP10.phx.gbl... > Hi > My sons PC > When I boot it up a small window pops up on the right side of the taskbar > with " Download a spyware " > I do a scan with Lavasoft Adware 6 and Quarantined 9 items. In the middle > of > the scanning a window pops up with "Virus Alert and says 'ZLOP.CL in > System > 32' > I then do a scan with Grisoft AVG Free Edition and send the virus to the > Vault. > This obviously does not get rid of the virus because when I enter an URL > in > the address bar of the IE .For example if I type in www.google.co.uk it > quickly turns into www.dns404.net and the little window pops up again in > the > right hand side of the taskbar with "Download a spy ware" If I click on > this > then different spyware programme try's to upload. > What is the remedy please. > Ta > >
From: Ian Kenefick on 17 Dec 2005 06:28
On Sat, 17 Dec 2005 02:43:41 -0000, "Retro" <retrouk@[NOSPAM]gmail.com> wrote: >http://www.f-secure.com/weblog/archives/archive-122005.html#00000739 I think naming conventions will prevent you cross referencing these and find that the file detected as Zlob.CLby FSAV will be the same detection as ZLOB.CL with grisoft. In this situation use the kaspersky engine from Multi AV (See D Lipman post) as the detection was added to the AVP engine of F-Secure. -- Ian Kenefick E-Mail: ian(a)ik-cs.com Our site: http://www.ik-cs.com My weblog: http://www.ik-cs.com/blogger |