Hi,
Some preliminary research on Google for Ws32 led to
several mentions of a potential key logger program. While I
cannot conclusively suggest that it is the same variant, it
is known to be bound with spyware. Thus, you may want to
consider disabling this particular aspect of it.
More information is available from:
http://www.pestpatrol.com/pestinfo/s/stealthlogger.asp
(It seems that pestpatrol catches this. I have never used
pestpatrol, so I cannot make any claims as to how it works -
but you may want to give it a shot.)
Regards,
Altrus
: Hi,
: Yes, I updated my scanner, but that was definetly worth
mentioning.
: One scanner said I had ws32agent.as . The other scanner
said I had backdoor
: bd. Neither one could keep it clean. They would fix what
was there, but it
: would keep coming back, even with the computer off the
internet.
: I found another site where they will look at your log
from hijack this and
: give you some tips. The site is
http://castlecops.com/forum67.html
: There is a lot of people there with the same problem. I
am going to try
: some of the fixes listed there.
: Thanks for you time and interest.
:
: "Altrüs" wrote:
:
: > Hi,
: >
: > Is your virus scanner up-to-date?
: >
: > Altrus
: >
: >
: >
: > : well, i installed and ran macfee. it found another 289
: > instances of trojans
: > : that the scanner from isp missed. macfee fixed them. i
: > reset my home page and
: > : rebooted. guess what? it still didn't work. any advice
: > would be appreciated.
: > : thanks!
: > :
: > : "gm" wrote:
: > :
: > : > Thanks. I should have mentioned that I already tried
: > CWShredder. It could
: > : > find no problems. I also ran Stinger in hopes it
could
: > clean up the
: > : > w32agent/as. It couldn't detect it. I was able to
borrow
: > a virus scanner from
: > : > work, McAfee enterprise. I will uninstall my current
: > scanner, install this
: > : > and run it. If it doesn't work, I don't know what to
do.
: > I will update this
: > : > thread with my results. Any other suggestions would
be
: > welcome. Thanks!
: > : >
: > : > "Altrüs" wrote:
: > : >
: > : > > Hi,
: > : > >
: > : > > You may want to consider CWShredder - this
program
: > may
: > : > > catch varients missed by AdAware or Spybot. Note,
: > CWShredder
: > : > > can catch CoolWebSearch varients missed by AdAware
or
: > : > > Spybot.
: > : > >
: > : > > Please note, it is recommended you download the
: > following
: > : > > fixes before downloading CWShredder. Some programs
can
: > cause
: > : > > your internet connection to be lost upon
uninstall,
: > and as a
: > : > > result, downloading these files now may prevent a
lot
: > of
: > : > > hassle later:
: > : > >
: > : > >
http://www.cexx.org/lspfix.htm
: > : > >
: > : > >
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
: > : > > Directions here:
: > : > >
http://www.tacktech.com/display.cfm?ttid=257
: > : > >
: > : > > In the event that removing these varients causes
your
: > : > > internet connection to stop, you should apply
these
: > : > > downloads.
: > : > >
: > : > > Further, you can download CWShredder here:
: > : > >
: > : > >
: >
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
: > : > >
: > : > > It may also be of benefit to view the following
: > resource on
: > : > > spyware:
: > : > >
: > : > >
http://mvps.org/winhelp2002/unwanted.htm
: > : > >
: > : > >
: > : > > Regards,
: > : > >
: > : > > Altrus
: > : > >
: > : > >
: > : > >
: > : > >
message
: > : > >
: >
: > : > > : i also have the same problem. i have run
adaware,
: > and
: > : > > spybot. they both find
: > : > > : problems and report that they have fixed them,
but
: > the
: > : > > problem is not fixed.
: > : > > : i have run anti-virus. it will find instances of
: > : > > WS32/AGENT.AS. it also
: > : > > : reports that they are now fixed. if i run it
: > immediatly
: > : > > following, it looks
: > : > > : clean, but my home page will not reset. the next
day
: > i run
: > : > > the anti virus
: > : > > : again and it finds more instances. I have turned
off
: > my
: > : > > system restore and
: > : > > : deleted the associated file. what else can i do?
: > : > > :
: > : > > : "AE" wrote:
: > : > > :
: > : > > : > Go to cnet.com and download adaware, install
it
: > and run
: > : > > it.
: > : > > : >
: >
: >
: >