Guest Vincdc Posted December 31, 2008 Posted December 31, 2008 Hello, My PC recently was infected by something. After I cleaned it using Windows Defender, I started to receive the following warning message: Error Loading C:\WINDOWS\winsp3fc.dll The specified module could not be found. I checked the registry, but could not find anything like this one. Does anyone has any idea on what this winsp3fc.dll is and how to fix it? Thanks in advance and Happy New Year! Vincdc Quote
Guest PA Bear [MS MVP] Posted December 31, 2008 Posted December 31, 2008 You've got MUCH more work to do! 1. See if you can download/run the MSRT manually: http://www.microsoft.com/security/malwareremove/default.mspx 2. Run this online scan (in safe mode w/networking, if need be): http://onecare.live.com/site/en-us/center/howsafe.htm 3. Run additional checks for hijackware, including posting your hijackthis log to an appropriate forum. Checking for/Help with Hijackware http://aumha.org/a/parasite.htm http://aumha.org/a/quickfix.htm http://aumha.net/viewtopic.php?t=5878 http://mvps.org/winhelp2002/unwanted.htm http://inetexplorer.mvps.org/data/prevention.htm http://inetexplorer.mvps.org/tshoot.html http://www.mvps.org/sramesh2k/Malware_Defence.htm http://defendingyourmachine2.blogspot.com/ http://www.elephantboycomputers.com/page2....emoving_Malware When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in conjuction with some other utilities). HijackThis will NOT fix anything on its own, but it will help you to both identify and remove any hijackware/spyware with assistance from an expert. Post your log to http://spywarehammer.com/simplemachinesfor....php?board=10.0, http://forums.spybot.info/forumdisplay.php?f=22, http://aumha.net/viewforum.php?f=30, or another appropriate forum for review by an expert in such matters, not here. If the procedures look too complex - and there is no shame in admitting this isn't your cup of tea - take the machine to a local, reputable and independent (i.e., not BigBoxStoreUSA) computer repair shop. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Vincdc wrote:<span style="color:blue"> > Hello, > My PC recently was infected by something. After I cleaned it using Windows > Defender, I started to receive the following warning message: > Error Loading C:WINDOWSwinsp3fc.dll > The specified module could not be found. > > I checked the registry, but could not find anything like this one. Does > anyone has any idea on what this winsp3fc.dll is and how to fix it? > Thanks in advance and Happy New Year! > > Vincdc </span> Quote
Guest David H. Lipman Posted December 31, 2008 Posted December 31, 2008 From: "Vincdc" <Vincdc@discussions.microsoft.com> | Hello, | My PC recently was infected by something. After I cleaned it using Windows | Defender, I started to receive the following warning message: | Error Loading C:\WINDOWS\winsp3fc.dll | The specified module could not be found. | I checked the registry, but could not find anything like this one. Does | anyone has any idea on what this winsp3fc.dll is and how to fix it? | Thanks in advance and Happy New Year! | Vincdc When you wrote you "checked the registry", does that mean you searched the Registry for any/all occurrences of "winsp3fc.dll" ? Chances are that Windows Defender removed the DLL and the DLL is loaded by RUNDLL32.EXE and Windows Defender failed to remove the line item where RUNDLL32.EXE calls winsp3fc.dll to be loaded and thus generates the error message. Removing the line item that has "RUNDLL32 winsp3fc.dll" will mitigate this error message. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Vincdc Posted January 1, 2009 Posted January 1, 2009 Hello, I tried to use the Autoruns program to find out what the winsp3fc.dll is. The Autoruns found it as "MsUpdateTask" under C:\\Windows\Tasks (I am using XP) with "rundll32 C:\WINDOWS\winsp3fc.dll,fnOpen" (which is missing). Therefore, I disabled the task and the warning message no longer showing up. It seems that winsp3fc.dll is not a malware or virus. Thanks for your help! Vincdc "David H. Lipman" wrote: <span style="color:blue"> > From: "Vincdc" <Vincdc@discussions.microsoft.com> > > | Hello, > | My PC recently was infected by something. After I cleaned it using Windows > | Defender, I started to receive the following warning message: > | Error Loading C:WINDOWSwinsp3fc.dll > | The specified module could not be found. > > | I checked the registry, but could not find anything like this one. Does > | anyone has any idea on what this winsp3fc.dll is and how to fix it? > | Thanks in advance and Happy New Year! > > | Vincdc > > When you wrote you "checked the registry", does that mean you searched the Registry for > any/all occurrences of "winsp3fc.dll" ? > > Chances are that Windows Defender removed the DLL and the DLL is loaded by RUNDLL32.EXE > and Windows Defender failed to remove the line item where RUNDLL32.EXE calls winsp3fc.dll > to be loaded and thus generates the error message. Removing the line item that has > "RUNDLL32 winsp3fc.dll" will mitigate this error message. > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest David H. Lipman Posted January 1, 2009 Posted January 1, 2009 From: "Vincdc" <Vincdc@discussions.microsoft.com> | Hello, | I tried to use the Autoruns program to find out what the winsp3fc.dll is. | The Autoruns found it as "MsUpdateTask" under C:\\Windows\Tasks (I am using | XP) with "rundll32 C:\WINDOWS\winsp3fc.dll,fnOpen" (which is missing). | Therefore, I disabled the task and the warning message no longer showing up. | It seems that winsp3fc.dll is not a malware or virus. | Thanks for your help! Your conclusion that " winsp3fc.dll is not a malware " may be premature. The fact that is was there and executed by RUNDLL32 and is no longer there indicates otherwise. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Malke Posted January 1, 2009 Posted January 1, 2009 Vincdc wrote: <span style="color:blue"> > Hello, > I tried to use the Autoruns program to find out what the winsp3fc.dll is. > The Autoruns found it as "MsUpdateTask" under C:\WindowsTasks (I am > using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is > missing). Therefore, I disabled the task and the warning message no longer > showing up. It seems that winsp3fc.dll is not a malware or virus.</span> Your conclusion is wrong. In all probability your computer is infected, possibly with a Vundo or SDBot trojan. Windows Defender has not removed the entire infection. The "MsUpdateTask" is not part of Windows. At this point you should get guided help at one of the specialty forums listed below. PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. http://aumha.org/downloads/hijackthis.zip http://aumha.net/ - Click on the HijackThis forum. Read the announcement and the stickies first . http://www.atribune.org/forums/index.php?showforum=9 http://aumha.net/viewforum.php?f=30 http://www.bleepingcomputer.com/forums/forum22.html http://www.dslreports.com/forum/cleanup http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html http://www.malwarebytes.org/forums/index.php?showforum=7 http://gladiator-antivirus.com/forum/index.php?showforum=170 http://spywarewarrior.com/viewforum.php?f=5 http://forums.techguy.org/54-security/ http://forums.tomcoyote.org/ http://www.thespykiller.co.uk/index.php?board=3.0 http://forums.subratam.org/index.php?showforum=7 Malke -- MS-MVP Elephant Boy Computers - Don't Panic! FAQ - http://www.elephantboycomputers.com/#FAQ Quote
Guest Vincdc Posted January 2, 2009 Posted January 2, 2009 Hello, Thanks for all your suggestions! I am confused by the scan results from Windows Defender, OneCare and Spybot S&D. Windows Defender did not detect anything on my PC right now; OneCare detected Trojan.Downloader, but could not fix it; Spybot found something else named 22nd Street and fixed it... I do not know which one I should believe. As my computer seems working fine at this moment, I do not know what else I should do. Thanks a lot! Vincdc "Malke" wrote: <span style="color:blue"> > Vincdc wrote: > <span style="color:green"> > > Hello, > > I tried to use the Autoruns program to find out what the winsp3fc.dll is. > > The Autoruns found it as "MsUpdateTask" under C:WindowsTasks (I am > > using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is > > missing). Therefore, I disabled the task and the warning message no longer > > showing up. It seems that winsp3fc.dll is not a malware or virus.</span> > > Your conclusion is wrong. In all probability your computer is infected, > possibly with a Vundo or SDBot trojan. Windows Defender has not removed the > entire infection. The "MsUpdateTask" is not part of Windows. At this point > you should get guided help at one of the specialty forums listed below. > > PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. > > http://aumha.org/downloads/hijackthis.zip > http://aumha.net/ - Click on the HijackThis forum. Read the announcement and > the stickies first . > http://www.atribune.org/forums/index.php?showforum=9 > http://aumha.net/viewforum.php?f=30 > http://www.bleepingcomputer.com/forums/forum22.html > http://www.dslreports.com/forum/cleanup > http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 > http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html > http://www.malwarebytes.org/forums/index.php?showforum=7 > http://gladiator-antivirus.com/forum/index.php?showforum=170 > http://spywarewarrior.com/viewforum.php?f=5 > http://forums.techguy.org/54-security/ > http://forums.tomcoyote.org/ > http://www.thespykiller.co.uk/index.php?board=3.0 > http://forums.subratam.org/index.php?showforum=7 > > Malke > -- > MS-MVP > Elephant Boy Computers - Don't Panic! > FAQ - http://www.elephantboycomputers.com/#FAQ > > </span> Quote
Guest David H. Lipman Posted January 2, 2009 Posted January 2, 2009 From: "Vincdc" <Vincdc@discussions.microsoft.com> | Hello, | Thanks for all your suggestions! | I am confused by the scan results from Windows Defender, OneCare and Spybot | S&D. Windows Defender did not detect anything on my PC right now; OneCare | detected Trojan.Downloader, but could not fix it; Spybot found something else | named 22nd Street and fixed it... I do not know which one I should believe. | As my computer seems working fine at this moment, I do not know what else I | should do. | Thanks a lot! | Vincdc Unfortunately, different scans find and remove different things. That's why you often have to use several products. As for OneCare detecting "Trojan.Downloader" and being unable to remove it, it would help to have complete information on this. This would include what is the fully qualified name and path to the file OneCare declared to be "Trojan.Downloader". -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Shenan Stanley Posted January 2, 2009 Posted January 2, 2009 Vincdc wrote:<span style="color:blue"> > I am confused by the scan results from Windows Defender, OneCare > and Spybot S&D. Windows Defender did not detect anything on my PC > right now; OneCare detected Trojan.Downloader, but could not fix > it; Spybot found something else named 22nd Street and fixed it... I > do not know which one I should believe. As my computer seems > working fine at this moment, I do not know what else I should do.</span> No single antispyware/antiadware/antimalware is 100% effective at this time. I'd personally suggest you uninstall everyone you have installed thus far (and done a full scan with) just to keep things neat. Then download, install, run, update and perform a full scan (individually - not at the same time) with the following two products: SuperAntiSpyware http://www.superantispyware.com/ (Free version) MalwareBytes http://www.malwarebytes.com/ (Free version) After you have ran them and cleaned up anything they find - uninstall them as well. In general - you need to perform some general routine maintenance on your computer (just like a vehicle or anything else you want to keep running.) You can do these things yourself or you can pay someone to do them for you (just like everything else you want to keep runnning.) - Keep backup copies of your installation media and the product keys/serial numbers needed to use them. - Schedule backups of your stuff (your documents, your pictures, your bookmarks/favorites, your email, your contacts, etc.) to external (to the computer - physically) media. - Keep the list of installed applications down to just what you use. - Perform the occassional CHKDSK on your hard disk drives. - Perform the occassional Disk Cleanup on your system. - Perform the occassional Defragmentation on your hard disk drive. - Scan with a decent few antispyware applications on occassion - just to make sure you have not collected any crud. (The two I listed are at the top of my list - although there are others out there.) - Keep Windows patched and updated. - Keep your applications (office products, etc) updated. - Keep your antivirus software updated. Other things you can consider... - Check for hardware driver updates on occassion. This is one of those things where if you aren't having trouble - you probably can leave well enough alone - but there have been hardware driver releases that fixed problems you didn't even know you had - even security issues. - Clean up a little more thoroughly than Disk Cleanup allows for using something like CCleaner. While I cannot say you should use all features of the product - I do utilize them all with no adverse side-effects so far. You really are unlikely to need anything in terms of a firewall more than what is built into Windows - and adding anything just puts another variable in the mix to cause trouble down the line. I am not telling you not to run a third party firewall - by all means - if you desire to or feel you need to - go ahead. I'm just mentioning that most home users do not really benefit from it, IMO. Why add extra overhead and possible sources of trouble if you gain nothing for it otherwise? A good antivirus (while not essential) provides a good cushion for mistakes. The free ones are generally as good as the paid versions. You must make sure they are properly updating and stay functional, however. I would personally recommend against any/all products that do more than one thing in the arena of AntiVirus. Some of them do help somewhat in the antispyware arena - but none can claim complete coverage. I would avoid the 'suites' - the ones that come with a firewall, internet protection, email, etc. All you really need is a basic AntiVirus that checks files as they are accessed and the likes. Basically - nothing complicated - just a little time consuming - although much of it can be easily automated. I personally use JKDefrag to defragment my hard disk drive when the system is idle. My AntiVirus software (in whichever form it takes) automatically updates itself. I have Windows Automatic Updates set to notify me when updates are available so I can install at a time of my choosing (and thus reboot at that time.) I have email reminders/calendar entires that remid me to CHKDSK/Disk Cleanup on occassion (and I usually use CCleaner and AntiSpyware apps about the same time.) Whenever I get new software - I usually make ISO images of the CD/DVD and store it on a network drive (I have a couple - basically just drives that plug directly into my network and allow all computers on my network to access shares I setup. Inexpensive and easy.) I have scheduled tasks that copy my important (to me) directories and such to the same network drive already mentioned. -- Shenan Stanley MS-MVP -- How To Ask Questions The Smart Way http://www.catb.org/~esr/faqs/smart-questions.html Quote
Guest PA Bear [MS MVP] Posted January 2, 2009 Posted January 2, 2009 When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in conjuction with some other utilities). HijackThis will NOT fix anything on its own, but it will help you to both identify and remove any hijackware/spyware with assistance from an expert. Post your log to http://aumha.net/viewforum.php?f=30, http://forums.spybot.info/forumdisplay.php?f=22, http://spywarehammer.com/simplemachinesfor....php?board=10.0, or other appropriate forums for review by an expert in such matters, not here. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Vincdc wrote:<span style="color:blue"> > Hello, > Thanks for all your suggestions! > I am confused by the scan results from Windows Defender, OneCare and > Spybot > S&D. Windows Defender did not detect anything on my PC right now; OneCare > detected Trojan.Downloader, but could not fix it; Spybot found something > else named 22nd Street and fixed it... I do not know which one I should > believe. As my computer seems working fine at this moment, I do not know > what else I should do. > Thanks a lot! > > Vincdc > > "Malke" wrote: ><span style="color:green"> >> Vincdc wrote: >><span style="color:darkred"> >>> Hello, >>> I tried to use the Autoruns program to find out what the winsp3fc.dll >>> is. >>> The Autoruns found it as "MsUpdateTask" under C:WindowsTasks (I am >>> using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is >>> missing). Therefore, I disabled the task and the warning message no >>> longer >>> showing up. It seems that winsp3fc.dll is not a malware or virus.</span> >> >> Your conclusion is wrong. In all probability your computer is infected, >> possibly with a Vundo or SDBot trojan. Windows Defender has not removed >> the >> entire infection. The "MsUpdateTask" is not part of Windows. At this >> point >> you should get guided help at one of the specialty forums listed below. >> >> PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. >> >> http://aumha.org/downloads/hijackthis.zip >> http://aumha.net/ - Click on the HijackThis forum. Read the announcement >> and the stickies first . >> http://www.atribune.org/forums/index.php?showforum=9 >> http://aumha.net/viewforum.php?f=30 >> http://www.bleepingcomputer.com/forums/forum22.html >> http://www.dslreports.com/forum/cleanup >> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 >> http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html >> http://www.malwarebytes.org/forums/index.php?showforum=7 >> http://gladiator-antivirus.com/forum/index.php?showforum=170 >> http://spywarewarrior.com/viewforum.php?f=5 >> http://forums.techguy.org/54-security/ >> http://forums.tomcoyote.org/ >> http://www.thespykiller.co.uk/index.php?board=3.0 >> http://forums.subratam.org/index.php?showforum=7 >> >> Malke >> -- >> MS-MVP >> Elephant Boy Computers - Don't Panic! >> FAQ - http://www.elephantboycomputers.com/#FAQ </span></span> Quote
Guest Vincdc Posted January 2, 2009 Posted January 2, 2009 Hello, Thanks a lot for all of you guys help! I really appreciate. I ran Windows Defender, Spybot S&D, OneCare on demand and my virus check program again. Right now, only the OneCare on demand detected 2 Trojan: Trojan:Win32/Meredrop TrojanDownloader:Win32/Matcash.L All other programs did not detect anything. I also ran the HijackThis 2.0.2 and did not see any suspicious entries. I will run that OneCare on demand again. If the two Trojans still exist, I will post my HijackThis log file to one of the forums. Have a good weekend! Vincdc "PA Bear [MS MVP]" wrote: <span style="color:blue"> > When all else fails, HijackThis v2.0.2 > (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in > conjuction with some other utilities). HijackThis will NOT fix anything on > its own, but it will help you to both identify and remove any > hijackware/spyware with assistance from an expert. Post your log to > http://aumha.net/viewforum.php?f=30, > http://forums.spybot.info/forumdisplay.php?f=22, > http://spywarehammer.com/simplemachinesfor....php?board=10.0, or other > appropriate forums for review by an expert in such matters, not here. > -- > ~Robear Dyer (PA Bear) > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > AumHa VSOP & Admin http://aumha.net > DTS-L http://dts-l.net/ > > Vincdc wrote:<span style="color:green"> > > Hello, > > Thanks for all your suggestions! > > I am confused by the scan results from Windows Defender, OneCare and > > Spybot > > S&D. Windows Defender did not detect anything on my PC right now; OneCare > > detected Trojan.Downloader, but could not fix it; Spybot found something > > else named 22nd Street and fixed it... I do not know which one I should > > believe. As my computer seems working fine at this moment, I do not know > > what else I should do. > > Thanks a lot! > > > > Vincdc > > > > "Malke" wrote: > ><span style="color:darkred"> > >> Vincdc wrote: > >> > >>> Hello, > >>> I tried to use the Autoruns program to find out what the winsp3fc.dll > >>> is. > >>> The Autoruns found it as "MsUpdateTask" under C:WindowsTasks (I am > >>> using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is > >>> missing). Therefore, I disabled the task and the warning message no > >>> longer > >>> showing up. It seems that winsp3fc.dll is not a malware or virus. > >> > >> Your conclusion is wrong. In all probability your computer is infected, > >> possibly with a Vundo or SDBot trojan. Windows Defender has not removed > >> the > >> entire infection. The "MsUpdateTask" is not part of Windows. At this > >> point > >> you should get guided help at one of the specialty forums listed below. > >> > >> PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. > >> > >> http://aumha.org/downloads/hijackthis.zip > >> http://aumha.net/ - Click on the HijackThis forum. Read the announcement > >> and the stickies first . > >> http://www.atribune.org/forums/index.php?showforum=9 > >> http://aumha.net/viewforum.php?f=30 > >> http://www.bleepingcomputer.com/forums/forum22.html > >> http://www.dslreports.com/forum/cleanup > >> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 > >> http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html > >> http://www.malwarebytes.org/forums/index.php?showforum=7 > >> http://gladiator-antivirus.com/forum/index.php?showforum=170 > >> http://spywarewarrior.com/viewforum.php?f=5 > >> http://forums.techguy.org/54-security/ > >> http://forums.tomcoyote.org/ > >> http://www.thespykiller.co.uk/index.php?board=3.0 > >> http://forums.subratam.org/index.php?showforum=7 > >> > >> Malke > >> -- > >> MS-MVP > >> Elephant Boy Computers - Don't Panic! > >> FAQ - http://www.elephantboycomputers.com/#FAQ </span></span> > > </span> Quote
Guest PA Bear [MS MVP] Posted January 3, 2009 Posted January 3, 2009 Post a link to your forum thread (which I'm fairly certain you'll be doing). Vincdc wrote:<span style="color:blue"> > Hello, > Thanks a lot for all of you guys help! I really appreciate. > I ran Windows Defender, Spybot S&D, OneCare on demand and my virus check > program again. Right now, only the OneCare on demand detected 2 Trojan: > Trojan:Win32/Meredrop > TrojanDownloader:Win32/Matcash.L > All other programs did not detect anything. I also ran the HijackThis > 2.0.2 > and did not see any suspicious entries. I will run that OneCare on demand > again. If the two Trojans still exist, I will post my HijackThis log file > to > one of the forums. > Have a good weekend! > > Vincdc > > > "PA Bear [MS MVP]" wrote: ><span style="color:green"> >> When all else fails, HijackThis v2.0.2 >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use >> (in conjuction with some other utilities). HijackThis will NOT fix >> anything on its own, but it will help you to both identify and remove any >> hijackware/spyware with assistance from an expert. Post your log to >> http://aumha.net/viewforum.php?f=30, >> http://forums.spybot.info/forumdisplay.php?f=22, >> http://spywarehammer.com/simplemachinesfor....php?board=10.0, or >> other >> appropriate forums for review by an expert in such matters, not here. >> -- >> ~Robear Dyer (PA Bear) >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >> AumHa VSOP & Admin http://aumha.net >> DTS-L http://dts-l.net/ >> >> Vincdc wrote:<span style="color:darkred"> >>> Hello, >>> Thanks for all your suggestions! >>> I am confused by the scan results from Windows Defender, OneCare and >>> Spybot >>> S&D. Windows Defender did not detect anything on my PC right now; >>> OneCare >>> detected Trojan.Downloader, but could not fix it; Spybot found something >>> else named 22nd Street and fixed it... I do not know which one I should >>> believe. As my computer seems working fine at this moment, I do not know >>> what else I should do. >>> Thanks a lot! >>> >>> Vincdc >>> >>> "Malke" wrote: >>> >>>> Vincdc wrote: >>>> >>>>> Hello, >>>>> I tried to use the Autoruns program to find out what the winsp3fc.dll >>>>> is. >>>>> The Autoruns found it as "MsUpdateTask" under C:WindowsTasks (I am >>>>> using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is >>>>> missing). Therefore, I disabled the task and the warning message no >>>>> longer >>>>> showing up. It seems that winsp3fc.dll is not a malware or virus. >>>> >>>> Your conclusion is wrong. In all probability your computer is infected, >>>> possibly with a Vundo or SDBot trojan. Windows Defender has not removed >>>> the >>>> entire infection. The "MsUpdateTask" is not part of Windows. At this >>>> point >>>> you should get guided help at one of the specialty forums listed below. >>>> >>>> PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. >>>> >>>> http://aumha.org/downloads/hijackthis.zip >>>> http://aumha.net/ - Click on the HijackThis forum. Read the >>>> announcement >>>> and the stickies first . >>>> http://www.atribune.org/forums/index.php?showforum=9 >>>> http://aumha.net/viewforum.php?f=30 >>>> http://www.bleepingcomputer.com/forums/forum22.html >>>> http://www.dslreports.com/forum/cleanup >>>> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 >>>> http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html >>>> http://www.malwarebytes.org/forums/index.php?showforum=7 >>>> http://gladiator-antivirus.com/forum/index.php?showforum=170 >>>> http://spywarewarrior.com/viewforum.php?f=5 >>>> http://forums.techguy.org/54-security/ >>>> http://forums.tomcoyote.org/ >>>> http://www.thespykiller.co.uk/index.php?board=3.0 >>>> http://forums.subratam.org/index.php?showforum=7 >>>> >>>> Malke >>>> -- >>>> MS-MVP >>>> Elephant Boy Computers - Don't Panic! >>>> FAQ - http://www.elephantboycomputers.com/#FAQ </span></span></span> Quote
Guest Vincdc Posted January 4, 2009 Posted January 4, 2009 Hello, I ran the OneCare on demand again. It still detected the 2 same Trojans from my C:\System Volume Information and it could not clean the 2 Trojans. Should I turn off the system restore? Should I still post my HijackThis log on one of the forums? Thanks! Vincdc "PA Bear [MS MVP]" wrote: <span style="color:blue"> > Post a link to your forum thread (which I'm fairly certain you'll be doing). > > Vincdc wrote:<span style="color:green"> > > Hello, > > Thanks a lot for all of you guys help! I really appreciate. > > I ran Windows Defender, Spybot S&D, OneCare on demand and my virus check > > program again. Right now, only the OneCare on demand detected 2 Trojan: > > Trojan:Win32/Meredrop > > TrojanDownloader:Win32/Matcash.L > > All other programs did not detect anything. I also ran the HijackThis > > 2.0.2 > > and did not see any suspicious entries. I will run that OneCare on demand > > again. If the two Trojans still exist, I will post my HijackThis log file > > to > > one of the forums. > > Have a good weekend! > > > > Vincdc > > > > > > "PA Bear [MS MVP]" wrote: > ><span style="color:darkred"> > >> When all else fails, HijackThis v2.0.2 > >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use > >> (in conjuction with some other utilities). HijackThis will NOT fix > >> anything on its own, but it will help you to both identify and remove any > >> hijackware/spyware with assistance from an expert. Post your log to > >> http://aumha.net/viewforum.php?f=30, > >> http://forums.spybot.info/forumdisplay.php?f=22, > >> http://spywarehammer.com/simplemachinesfor....php?board=10.0, or > >> other > >> appropriate forums for review by an expert in such matters, not here. > >> -- > >> ~Robear Dyer (PA Bear) > >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > >> AumHa VSOP & Admin http://aumha.net > >> DTS-L http://dts-l.net/ > >> > >> Vincdc wrote: > >>> Hello, > >>> Thanks for all your suggestions! > >>> I am confused by the scan results from Windows Defender, OneCare and > >>> Spybot > >>> S&D. Windows Defender did not detect anything on my PC right now; > >>> OneCare > >>> detected Trojan.Downloader, but could not fix it; Spybot found something > >>> else named 22nd Street and fixed it... I do not know which one I should > >>> believe. As my computer seems working fine at this moment, I do not know > >>> what else I should do. > >>> Thanks a lot! > >>> > >>> Vincdc > >>> > >>> "Malke" wrote: > >>> > >>>> Vincdc wrote: > >>>> > >>>>> Hello, > >>>>> I tried to use the Autoruns program to find out what the winsp3fc.dll > >>>>> is. > >>>>> The Autoruns found it as "MsUpdateTask" under C:WindowsTasks (I am > >>>>> using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is > >>>>> missing). Therefore, I disabled the task and the warning message no > >>>>> longer > >>>>> showing up. It seems that winsp3fc.dll is not a malware or virus. > >>>> > >>>> Your conclusion is wrong. In all probability your computer is infected, > >>>> possibly with a Vundo or SDBot trojan. Windows Defender has not removed > >>>> the > >>>> entire infection. The "MsUpdateTask" is not part of Windows. At this > >>>> point > >>>> you should get guided help at one of the specialty forums listed below. > >>>> > >>>> PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. > >>>> > >>>> http://aumha.org/downloads/hijackthis.zip > >>>> http://aumha.net/ - Click on the HijackThis forum. Read the > >>>> announcement > >>>> and the stickies first . > >>>> http://www.atribune.org/forums/index.php?showforum=9 > >>>> http://aumha.net/viewforum.php?f=30 > >>>> http://www.bleepingcomputer.com/forums/forum22.html > >>>> http://www.dslreports.com/forum/cleanup > >>>> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 > >>>> http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html > >>>> http://www.malwarebytes.org/forums/index.php?showforum=7 > >>>> http://gladiator-antivirus.com/forum/index.php?showforum=170 > >>>> http://spywarewarrior.com/viewforum.php?f=5 > >>>> http://forums.techguy.org/54-security/ > >>>> http://forums.tomcoyote.org/ > >>>> http://www.thespykiller.co.uk/index.php?board=3.0 > >>>> http://forums.subratam.org/index.php?showforum=7 > >>>> > >>>> Malke > >>>> -- > >>>> MS-MVP > >>>> Elephant Boy Computers - Don't Panic! > >>>> FAQ - http://www.elephantboycomputers.com/#FAQ </span></span> > > </span> Quote
Guest David H. Lipman Posted January 4, 2009 Posted January 4, 2009 From: "Vincdc" <Vincdc@discussions.microsoft.com> | Hello, | I ran the OneCare on demand again. It still detected the 2 same Trojans from | my C:\System Volume Information and it could not clean the 2 Trojans. Should | I turn off the system restore? Should I still post my HijackThis log on one | of the forums? | Thanks! | Vincdc Y E S ! -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest PA Bear [MS MVP] Posted January 5, 2009 Posted January 5, 2009 > ...[OneCare online scan] still detected the 2 same Trojans from<span style="color:blue"> > my C:System Volume Information and it could not clean the 2 Trojans.</span> Don't worry about that (but don't use System Restore either). Yes, post your HJT log in an appropriate forum. Vincdc wrote:<span style="color:blue"> > Hello, > I ran the OneCare on demand again. It still detected the 2 same Trojans > from > my C:System Volume Information and it could not clean the 2 Trojans. > Should > I turn off the system restore? Should I still post my HijackThis log on > one > of the forums? > Thanks! > > "PA Bear [MS MVP]" wrote:<span style="color:green"> >> Post a link to your forum thread (which I'm fairly certain you'll be >> doing). >> >> Vincdc wrote:<span style="color:darkred"> >>> Hello, >>> Thanks a lot for all of you guys help! I really appreciate. >>> I ran Windows Defender, Spybot S&D, OneCare on demand and my virus check >>> program again. Right now, only the OneCare on demand detected 2 Trojan: >>> Trojan:Win32/Meredrop >>> TrojanDownloader:Win32/Matcash.L >>> All other programs did not detect anything. I also ran the HijackThis >>> 2.0.2 >>> and did not see any suspicious entries. I will run that OneCare on >>> demand >>> again. If the two Trojans still exist, I will post my HijackThis log >>> file >>> to >>> one of the forums. >>> Have a good weekend! >>> >>> Vincdc >>> >>> >>> "PA Bear [MS MVP]" wrote: >>> >>>> When all else fails, HijackThis v2.0.2 >>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to >>>> use >>>> (in conjuction with some other utilities). HijackThis will NOT fix >>>> anything on its own, but it will help you to both identify and remove >>>> any >>>> hijackware/spyware with assistance from an expert. Post your log to >>>> http://aumha.net/viewforum.php?f=30, >>>> http://forums.spybot.info/forumdisplay.php?f=22, >>>> http://spywarehammer.com/simplemachinesfor....php?board=10.0, or >>>> other >>>> appropriate forums for review by an expert in such matters, not here. >>>> -- >>>> ~Robear Dyer (PA Bear) >>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >>>> AumHa VSOP & Admin http://aumha.net >>>> DTS-L http://dts-l.net/ >>>> >>>> Vincdc wrote: >>>>> Hello, >>>>> Thanks for all your suggestions! >>>>> I am confused by the scan results from Windows Defender, OneCare and >>>>> Spybot >>>>> S&D. Windows Defender did not detect anything on my PC right now; >>>>> OneCare >>>>> detected Trojan.Downloader, but could not fix it; Spybot found >>>>> something >>>>> else named 22nd Street and fixed it... I do not know which one I >>>>> should >>>>> believe. As my computer seems working fine at this moment, I do not >>>>> know >>>>> what else I should do. >>>>> Thanks a lot! >>>>> >>>>> Vincdc >>>>> >>>>> "Malke" wrote: >>>>> >>>>>> Vincdc wrote: >>>>>> >>>>>>> Hello, >>>>>>> I tried to use the Autoruns program to find out what the >>>>>>> winsp3fc.dll >>>>>>> is. >>>>>>> The Autoruns found it as "MsUpdateTask" under C:WindowsTasks (I >>>>>>> am >>>>>>> using XP) with "rundll32 C:WINDOWSwinsp3fc.dll,fnOpen" (which is >>>>>>> missing). Therefore, I disabled the task and the warning message no >>>>>>> longer >>>>>>> showing up. It seems that winsp3fc.dll is not a malware or virus. >>>>>> >>>>>> Your conclusion is wrong. In all probability your computer is >>>>>> infected, >>>>>> possibly with a Vundo or SDBot trojan. Windows Defender has not >>>>>> removed >>>>>> the >>>>>> entire infection. The "MsUpdateTask" is not part of Windows. At this >>>>>> point >>>>>> you should get guided help at one of the specialty forums listed >>>>>> below. >>>>>> >>>>>> PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS. >>>>>> >>>>>> http://aumha.org/downloads/hijackthis.zip >>>>>> http://aumha.net/ - Click on the HijackThis forum. Read the >>>>>> announcement >>>>>> and the stickies first . >>>>>> http://www.atribune.org/forums/index.php?showforum=9 >>>>>> http://aumha.net/viewforum.php?f=30 >>>>>> http://www.bleepingcomputer.com/forums/forum22.html >>>>>> http://www.dslreports.com/forum/cleanup >>>>>> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25 >>>>>> http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html >>>>>> http://www.malwarebytes.org/forums/index.php?showforum=7 >>>>>> http://gladiator-antivirus.com/forum/index.php?showforum=170 >>>>>> http://spywarewarrior.com/viewforum.php?f=5 >>>>>> http://forums.techguy.org/54-security/ >>>>>> http://forums.tomcoyote.org/ >>>>>> http://www.thespykiller.co.uk/index.php?board=3.0 >>>>>> http://forums.subratam.org/index.php?showforum=7 >>>>>> >>>>>> Malke >>>>>> -- >>>>>> MS-MVP >>>>>> Elephant Boy Computers - Don't Panic! >>>>>> FAQ - http://www.elephantboycomputers.com/#FAQ </span></span></span> Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.