TechSpot - PC Technology News and Analysis

Scorpio55 · #1 01-06-2009

Hey gang. Was having the same problem with sagispul pop ups and also one called zabasphere. Followed the 8 steps and am attaching my logs. Can somebody knowledgeable please check them and see if I got everything? There was LOTS of garbage.
Any ideas as to where the sagispul trojan comes from? The only thing I've done recently out of the ordinary was to charge my nieces ipod on my computer.

Many thanks for your help and the great, thorough instructions on this site.

rf6647 · #2 01-06-2009

Code:

C:\WINDOWS\SYSTEM32\iylyyb.dll (Trojan.Vundo) -> Delete on reboot.

MBAB did not handle all that it found until the computer restart.

It appears that the infection is mostly handled.

Rescan with MBAB & SAS (run as pairs) until clean or something that cannot be cleaned.

HJT scan informs what has not been handled (computer restart before HJT scan)

Caught by HJT.

Code:

O20 - AppInit_DLLs: iylyyb.dll
Confirm file has been deleted.
HJT  Tick & fix will remove this.
Or wait for updated MBAM to clean this reference.

If symptoms remain, post new logs and describe conditions.

Following clean scans establish a clean restore point.

Establish a new clean restore point and Clear your existing System Restore points:

New
- Go to Start > All Programs > Accessories > System Tools > System Restore>
- Select Create a restore point> OK.
Clear Old
- go to Start > Run > cleanmgr > Select the More options tab >
- Choose the option to clean up System Restore > OK
  - This will remove all restore points except the new one you just created.

Similar Topics
Topic	Category	Replies	Last Post
Sagispul Popups	Virus & Malware removal	4	01-12-2009 11:19 PM
Help removing sagispul.com	Virus & Malware removal	6	01-10-2009 12:35 PM
Sagispul.com pop-up	Virus & Malware removal	5	01-04-2009 09:47 AM
Sagispul.com has got me	Virus & Malware removal	0	01-03-2009 10:25 PM
Sagispul attack and maybe others	Virus & Malware removal	7	01-03-2009 02:07 AM