Windows Live safety center - new virus found

[nightrax]

The WLSC has found a virus called: Win32/NewMalware.E - l have tryed to search for info, but found none. The Microsoft info is as usefull as a chocolate oven.

It is in a dir called: postoobe and the file is called favtool2.exe

Just wondering if anyone else has this problem or has found a solution.

Thanks in advanced,

AnDy

 

[linney]

http://groups.google.com/group/micr...lnk=st&q=NewMalware.E&rnum=1#327a22a7c9afd626

Is favtool2.exe a program you are familiar with? There is no mention of it when searching Google.

I thought it might be a false alarm, but "no hits" makes me more suspicios.

Have you tried a second and third opinion with different scanners?

Removing adware & spyware
faq608-4650

Microsoft (GIANT Antispyware) Beta available
Thread779-979113

Try the free version of "Ewido"

http://www.ewido.net/

HijackThis log file analysis

http://www.hijackthis.de/index.php

 

[nightrax]

Thanks for the reply, l have checked the hijackthis log and run two spyware removing programs and found nothing in relation to this file.

l found the file in a dir called system.sav, which seems to house a lot of the XP restore info. There is a text file called favtool so l include it here -

Started

Read LCID of ->0809

Which is ->English (United Kingdom)

Using LCID Alias of ->0409

Which is ->English (United States)

CreateDirectory ->C:\Documents and Settings\All Users\Favorites\HEWLETT-PACKARD Recommended Sites

CreateDirectory ->c:\documents and settings\Default User\favorites\HEWLETT-PACKARD Recommended Sites

CreateDirectory ->C:\Documents and Settings\Administrator\Favorites\HEWLETT-PACKARD Recommended Sites

CreateDirectory ->C:\Documents and Settings\Administrator\Favorites\HEWLETT-PACKARD Recommended Sites

CreateDirectory ->FAILED -->Cannot create a file when that file already exists.

RemoveDir() - RemoveDir() - Invalid File Handle - C:\Documents and Settings\LocalService\Favorites\*.*

RemoveDir() - FindFirstFile(C:\Documents and Settings\LocalService\Favorites\*.*) 3-The system cannot find the path specified.

CreateDirectory ->C:\Documents and Settings\LocalService\Favorites\HEWLETT-PACKARD Recommended Sites

CreateDirectory ->FAILED -->The system cannot find the path specified.

RemoveDir() - RemoveDir() - Invalid File Handle - C:\Documents and Settings\NetworkService\Favorites\*.*

RemoveDir() - FindFirstFile(C:\Documents and Settings\NetworkService\Favorites\*.*) 3-The system cannot find the path specified.

CreateDirectory ->C:\Documents and Settings\NetworkService\Favorites\HEWLETT-PACKARD Recommended Sites

CreateDirectory ->FAILED -->The system cannot find the path specified.


l think it is to do with the OEM, so when there is a full restore of the system there website is always in the fav-toolbar as the startup page, checky little so and so's!!