Wetlook World Forum

I googled for sagipsul.com and found no solutions. First Infections seem to have occurde around 30 December 2008.

This kind of malware can mostly be eliminated with the following steps (You should know, how to work with the windows registry):

Startup in protected mode.

Check the 'Run' commands in your registry and search for commands starting files you don't know. (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)

Write down the path and filename that is in the command and rename the file in the path.

Example: For Adobe reader this would be "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe", you'd have to delete 'Reader_sl.exe' which you would find in 'C:\Program Files\Adobe\Reader 9.0\Reader\'

Mark and export the command to a *.reg-file, just in case you delete something, you still need.

Delete the command

Check the 'RunOnce' commands, they sould be empty (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce)

Do so for every command, you don't know. If you have any doubts, google for the filename that is in the command and you'll soon know, what it is for.

Delete all your temp files in the windows-dir and in all the users dirs.

Restart your PC. If we're lucky (that means, the malware used this structure), the problem should be solved.

If not, post again and I'll try to find a solution.

Hobie