Another AV Security Suite infection

Hey Chris....

First spot of sunshine. My Internet shortcuts are working now. WOW that is a relief!!!!

Thanks so much.

I scanned using ESET last night and was clean. Is there anything else I should run?

If not, should I run ESET (or something else) in the evenings to confirm the Trojan has not come back?

Eric

WOOHOO!!

I'm pretty confident you're clean but give it a day or so, and if you experience any more errors like in your first post please let me know.

If not, we'll just do some cleanup and you can be on your way with a clean machine

Thanks Chris,

One last thing. I have Online Armor running and I went to a site (emploment site) that I for the most part trust. It popped up wanting me to allow access to

C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe

I thought why would they need that and I blocked it. Now I have left the site and have only email and explorer up (now ie explorer as well) and I keep getting an information bubble (from the tray) with this information

aspnet_wp.exe, 1.1.4322.2463, (1.1.4322.2463)
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
Hash(MD5): 44EB2854E8A23A72BEAB9DAAB1A6E0CF

Can you shead some light on this? Should I allow it?

Thanks,

Eric

Lastly, we had talked about me scanning the other two systems I have. Is there a first step that I could do and if it finds anything then I will open another thread?

Hi Eric,

That's a legitimate file. You can safely allow it . As for your other two machines, if you read the link in my signature entitled Pre-Posting Instructions that will guide you through the proper steps to get things rolling. Please create separate threads for the two machines so we can fix one in one thread and one in the other. I'll keep an eye out for them and if I'm not beaten to it by one of the other staff I'll guide you through the removal process in those two threads. You've been a pleasure to work with so far.

Thanks Chris,

I will look at the link Friday. I thank you and enjoyed working with you as well!!!

Eric