Shoutbox

Hello Everyone,

I (with the help of Matty) have created a removal tool to clean infections by the MSN Funmaker Virus (Currently I've named it Herustic.AdwareDropper.A).  The tool will end the processes known to start by the virus and delete the files associated with the virus. The virus is NOT yet detected by Symantec (Norton) or McAfee.  Detection from other vendors is unknown.

Removal Tool: Download Now
Important Notice:  I have confirmed that SOME VERSIONS of McAfee AntiVirus are currently reporting my removal tool as a virus.  Please update to the latest DAT/definition file to fix this problem.  I can assure you 100% that my file is not a virus, and has passed the Symantec Norton AntiVirus Web Scanner as well as Norton AntiVirus 2005.  , McAfees latest update fixes the problem and will prove it .

Update 1.0.04 (Current Version):
-Tool is now redesigned for a smaller file size and better look.
-Tool now has lots of increased stability in many areas
-KNOWN ISSUE: McAfee Products detect my tool as a virus.

Update 1.00.03:
-Removal tool will now output a removal log of what actions it did exactly. (Excluding Killprocesses, it will not report if it killed any processes)
-Removal tool will inform you whether or not you had the virus when you press the start button.  There is a known delay, this is due to the "Kill Process" of any of the possible infections.

Version 1.0.02:
-Removed the "MSN Butterfly New" logo due to disputes about it; The program now has a PLAIN QUESTIONMARK.

Version 1.0.01:
-Removes files not removed by original tool (Cookies Files)
-Limitation: Cannot remove the files in C:\WINDOWS\SYSTEM32\PREFETCH\, Although these shouldnt pose a risk unless you execute them.

Version 1.0.00:
-Removes infections from the AdwareDropper.A
-First Release

What are the process...

"Systray.exe", and in some cases, "MediaAccess.exe" and "MediaAccK.exe".  It shuts them down, waits 4 seconds to ensure they are all shut down, then deletes the files and then deletes the startup entries.

kk, thanks

Are you sure any isn;t called aircity.exe?

To be honest, Im not 100% sure.  The virus actually "mutated", so to speak, tonight as I was making the removal tool.  Same executeable performed different actions tonight than it did lastnight during the tests.  If you want to send a copy of aircity.exe to me, I can analyze that for you.

sistray or systray??

Systray.exe

PS:
The next release should be like right away, some more files have been been added to the removal...Thanks to me. AHAHA

The tool has been updated now to remove files that Cookie originally reported.

nice work Dane! this should be posted on mess.be, along with all the other fixes that other forum members have made

Thanks,
I have a FAR better tool coming out this afternoon if I can fix this one bug, and it probably will appear on Mess.be, Im sure you can guess what it is, Web based and My Website, Msgpluszone .  Btw, it will detect this virus .