Solved Strange icon disappears from taskbar

[gregaras]

I wonder, if someone know, what means this icon?

This appears rarely, maybe after three days. I got it on my taskbar, corner and I can't get no tittle about, I just move cursor on it and that gones. Is this a virus? I tried to scan my PC when I saw it and I find two trojans (Trojan-Downloader.Win32.Genome.bzbn and Trojan-Downloader.Win32.Genome.bzci), but that didn't help. I'm using Kaspersky Internet Security 2011 antivirus.

 

[A Guy]

Sorry, a bit too tiny for me to see what it may be. Blow it up and sharpen didn't help either. Suggest Hitman Pro and Malwarebytes Free for 2nd and 3rd opinions. A Guy

 

[EzioAuditore]

See if its listed under notification area settings.. Click the customize link at the notification tray area (inside the box where hidden icons lie).

 

[gregaras]

Omg! 9 infected files!

"A guy", thanks for Malwarebytes very much, because i found 9 INFECTED FILES AND REGISTRY'S!!! OMG! Two viruses was on 4 files: Spyware.Banker.Gen and RiskWare.Tool.CK. Two viruses was on 4 registry keys: Trojan.FakeAlert and Malware.Trace. And one virus was on one registry data: Broken.OpenCommand. I removed them immediately.

AND...

Thanks for "EzioAuditore" for a good hint to watch an info of notification icons...

 

[A Guy]

Ahhh, don't assume you are clean. Suggest you d/l and burn to CD a bootable Antivirus disc. That way you can scan outside of windows. Suggest you turn off system restore to delete all restore points where virus may lurk. Scan with the bootable AV disc. Boot to safe mode after and scan with Malwarebytes again. If you come up clean, I'd still scan with an online AV scanner to be safe.

Bootable AV Disc

Online Scanner

Once you are sure you are clean, turn system restore back on. You might also d/l SuperAntiSpyware as a 2nd Anti Malware scanner to back up Malwarebytes. A Guy

 

[EzioAuditore]

That icon seems like related to some sort of RAT (Remote Administration Tool). The infection named 'Riskware.Tool' supports this.
And after following excellent advice from our member A Guy, change all of your passwords of the sites you visit including but not limited to bank, forums etc..
Or better yet, I'd advise you to change all of your passwords immediately from another clean pc or your mobile and then continue with the steps mentioned by A Guy.

 

[A Guy]

Also, look into KeyScrambler . Scrambles your key strokes at the kernel level to thwart keyloggers. The free supports IE and Firefox. the paid supports more. A Guy

 

[gregaras]

Alright, I started download of Kaspersky Rescue Disk 11 .ISO file.

change all of your passwords of the sites you visit including but not limited to bank, forums etc..

So, I should to change passwords of sites like G-mail, Msn, Imageshack.us?

Also, look into KeyScrambler . Scrambles your key strokes at the kernel level to thwart keyloggers. The free supports IE and Firefox. the paid supports more. A Guy

I tried to download a personal KeyScrambler, but download.com page says:

We're sorry, but the page you requested could not be found.

 

[Irene]

I tried to download a personal KeyScrambler, but download.com page says:

We're sorry, but the page you requested could not be found.

Try this link for the download:
KeyScrambler Personal - Reviews and free KeyScrambler Personal downloads at Download.com

 

[EzioAuditore]

Absolutely. Change the passwords.

 

[gregaras]

Okay, I got installed a rescue disk into my USB.

Try this link for the download:
KeyScrambler Personal - Reviews and free KeyScrambler Personal downloads at Download.com

Doesn't work for me.

Absolutely. Change the passwords.

Ok.

 

[A Guy]

Try this download

KeyScrambler Personal Download - Softpedia

A Guy

 

[gregaras]

Try this download

KeyScrambler Personal Download - Softpedia

Thanks, it worked.

 

[gregaras]

Thanks, it worked.

Damn! Very bad end. KeyScrambler came with PDM.RootShell and exactly Uninstall.exe file is virused. I wanna to remove KeyScrambler with Uninstall, but I can't do this safely. I tried to switch into "Safe Run for Applications" but I still can't. (Uploaded Attachment)

AND

I just noticed a first symptom. Then I try to upload files to G-mail using IE, my screen goes black and I need to turn it off.

 

[EzioAuditore]

Hello,
Don't worry, Keyscrambler is a safe app. It installs driver at kernel level to intercept your keystrokes to scramble and encrypt them so as to prevent keylogging by any malicious program.
Just allow it.

 

[gregaras]

Keyscrambler is a safe app.

Well, it crashed the IE and when I just deleted a KeyScrambler and restarted a PC, everything worked fine again. (Or I need to search for another link...)

P.S. I have come across this virus 2nd time: http://www.sevenforums.com/system-security/130169-shield-exe-file-please-help.html (FIXED)

 

[Irene]

Seems you still have residual problems from before the help provided.
Try this on-line scan:
HouseCall 7.1 - Free Online Virus and Spyware Scan

Just select 32 or 64-bit...

 

[Jacee]

gregaras you have been infected with a 'backdoor Trojan'. As posted above, you definitely need to change ALL your passwords using another computer (Known clean), not from the infected one you're using now!

Also, flush the dirty DNS cache, and restore MS's Hosts file because they have been over-ridden.

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Right click and run as Administrator. Your computer will reboot itself.

Now, update and rescan with Malwarebytes' Anti-Malware. Select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. Copy and Paste that log into your next reply.

 

[gregaras]

Okay, thank you for this code I did it and I scanned my PC for viruses. Here's the log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5758
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
2011.02.14 16:05:57
mbam-log-2011-02-14 (16-05-57).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 319660
Time elapsed: 1 hour(s), 11 minute(s), 12 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

 

[EzioAuditore]

Its showing nil. Good.
Just to be sure, run that bootable rescue disc scan too.
Some malware are pretty good at hiding themselves from scanners while they're active.