Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

What kind of malware is this?

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

What kind of malware is this?

Unread postby Mackintire » February 24th, 2010, 12:38 pm

So one of our computers here got nailed with some malware.

Spybot didn't detect anything. and was banned from updating
Malwarebytes didn't detect anything. and was banned from updating
Superantispyware wouldnt run

I deleted the parts that loaded via the registry,killed the running process, updated and ran all three programs again.

Superantispyware removed 11 components (one of which was funweb)

I thought that it was gone.

This morning our corporate install of Kasperksy Antivirus killed this:
c:\documents and settings\alan\local settings\application data\ebnveh\tkhqsftav.exe

I deleted the directory.


    Showed fake virus warnings
    Gave false warning on Windows Security settings
    Porn pop-ups
    Taskbar infected pop-up
    Blocked updates to anti-malware programs
    Installed Proxy into Internet explorer 8 : 5000

Hyjack this shows nothing unusual and I mean not a thing.
Everything in the Hyjackthis log version 2.0002 has been verified.
Nothing is listed in MSconfig
Nothing unusual is loading from the (Run or Run once) listings in the Registry

I 'm down to checking for a rootkit at this point.

Short of setting the machine to create a bootlog and dissecting it I'm running short on ideas.

Somehow this bugger is still reloading the proxy and rebuilding the directory on boot.

Any ideas?



Update 2/24/2010

The proxy reloading may have been a fluke leftover from the last reboot. The rootkit scan came clean and we rebooted with no signs of infection. It'll be a few days before I call it verified clean.
Active Member
Posts: 1
Joined: February 24th, 2010, 11:58 am
Register to Remove

Re: What kind of malware is this?

Unread postby NonSuch » February 25th, 2010, 1:54 am

This forum was set up specifically to help home users, we do not work on business machines.

Computers used in a business environment often have policies and other modifications made to them. It is impossible for us to differentiate these from ones that have been made by an infection, so in removing what we think is an infection, we may compromise the business set up of your computer.

The scans we run often reveal information that most businesses would not want exposed in an open forum, and there are other legal constraints and ramifications involved with business machines that we are not equipped or trained to deal with.

I'm sorry but we can't help you.

As this computer is likely to contain sensitive business data, it is in the best interest of the company to reformat and reimage the drive.

This topic is now closed
User avatar
Posts: 27257
Joined: February 23rd, 2005, 7:08 am
Location: California

  • Similar Topics
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!

Who is online

Users browsing this forum: No registered users and 54 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware