This bug is also known as TrojanDownloader.Win32.Agent.y [Kaspersky] and is
proving to be rather difficult to remove at times.
Destroy Autorun:
Delete the following keys
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates,
and/OR
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates0,
Reboot your system then:
Make sure
you click start --> Run and type in msconfig. Then select the startup tab. Any
references to the processes below.
End Processes (may
or may not exist):
2805e.exe
arupdate.exe
cashback.exe
cb.exe
djtopr1150.exe
flash.exe
nls.exe
disp1150.exe
webrebates0.exe
webrebates1.exe
webrebates_cdt_installsilent.exe
unstsa3.exe
Unregister DLLs:
C:\windows\3_0_1browserhelper3.dll
C:\windows\neti.dll
C:\windows\system32\imgconv.dll
C:\windows\system32\vic32.dll
Remove Directories:
C:\Program Files\web_rebates
C:\Windows\winskw
Clean your Registry:
You should be back to normal IF this was your only problem. I suggest you post
in our HJT forum since its not likely that this is your only bug.
Read this first