Tom's Guide | Tom's Hardware | Tom's Games

Computing.Net > Forums > Security and Virus > Can't get rid of virus/spyware

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Can't get rid of virus/spyware

Reply to Message Icon

Name: sherumann
Date: February 9, 2008 at 04:13:31 Pacific
OS: Win XP pro SP2
CPU/Ram: 3,67 GHz/2,00 GB
Comment:

I have some kind of virus/spyware, i cant open any antivirus, antispyware or similar programs (also cant open Flash CS3, among others). I can open Spyhunter, but it detects nothing.

Also i wasnt able to reboot in safe mode, but used SafeBootKeyRepair.exe and it worked. In safe mode, I run SmitfraudFix and cleaned registry and everything but nothing happened, i was unable to open antivirus or others. If i reboot in normal mode sometimes a process with random numbers appears, or a process called wintems.exe

I dont know what to do, please help! :(



Sponsored Link
Ads by Google

Response Number 1
Name: sherumann
Date: February 9, 2008 at 04:23:15 Pacific
Reply:

Also, when i try to open HJT the virus doesnt let me to use it, it shows a "not a valid win32 apliccation" message and closes!!! I cant do a log file :(


0

Response Number 2
Name: jabuck
Date: February 9, 2008 at 04:37:39 Pacific
Reply:

Do a search for hijackthis.exe and rename it to show.exe then see if Hijack This will run and post it's log.


0

Response Number 3
Name: Intel 80486 (by meisinscotland)
Date: February 9, 2008 at 06:56:16 Pacific
Reply:

If the solution above doesn't work, see if you can run it in safe mode.

Why serve in heaven when you can reign in hell?


0

Response Number 4
Name: sherumann
Date: February 9, 2008 at 11:18:12 Pacific
Reply:

In safe mode, and after using the SmitfraudFix, I renamed hijackthis.exe to show.exe and tried opening it in different directories, but every time i got the "not a valid win32 aplication" message!!... :(


0

Response Number 5
Name: jabuck
Date: February 9, 2008 at 13:03:45 Pacific
Reply:

Go to the this link:

Disable Realtime Protection

Follow their directions to disable any realtime protection that you have as it will interfere with the fix by reinstalling the corrupt files.

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.


0

Related Posts

See More



Response Number 6
Name: sherumann
Date: February 9, 2008 at 14:38:47 Pacific
Reply:

I can't open combofix! I get the same message: "not a valid win32 aplication" :(
(I also tried in safe mode)


0

Response Number 7
Name: jabuck
Date: February 9, 2008 at 18:02:14 Pacific
Reply:

Please download SilentRunners from this link :

http://www.silentrunners.org/

Unzip it to the desktop and double-click on it. If you get any kind of warning message about scripts, please choose to allow the script to run. When the scan is finished, it will create a logfile on the desktop. Please post the entire contents of this logfile in a reply to this post.


0

Response Number 8
Name: sherumann
Date: February 11, 2008 at 14:07:22 Pacific
Reply:

Well, it seems that I could fix it. I did a SpyBot scan and all was clean. However, mozilla firefox doesn't work, don't know why.
Here is the HJT logfile:

Logfile of HijackThis v1.99.1
Scan saved at 23:00:36, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Archivos de programa\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TBLMOUSE.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - URLSearchHook: Barra Yahoo! con bloqueador de ventanas emergentes - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [WUSB54Gv4] C:\Archivos de programa\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe
O4 - HKLM\..\Run: [USBToolTip] "C:\Archivos de programa\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Archivos de programa\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\German_New\Menú Inicio\Programas\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\archivos de programa\bonjour\mdnsnsp.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/c...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binar...
O17 - HKLM\System\CCS\Services\Tcpip\..\{5AE34BE1-240B-4DE3-9DC0-73E63417F9E3}: NameServer = 194.224.52.36,194.224.52.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E69897-8EBD-4D8B-B7FC-41CE1CCFDB50}: NameServer = 194.224.52.36,194.224.52.67
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Something wrong?



0

Response Number 9
Name: jabuck
Date: February 11, 2008 at 18:44:27 Pacific
Reply:

This usually means there is a problem:

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

Could you post your combofix log.


0

Response Number 10
Name: delphilord
Date: February 26, 2008 at 01:42:39 Pacific
Reply:

Same problem Here
All antivirus+HijackThis(even renamed) give not a valid win32 app
Security task manager can not run too(ascode.dll)is deleted and after reinstall,In first run,virus deletes this dll !
Can not boot in safe mode(restart before entering windows)
Confiused



0

Sponsored Link
Ads by Google
Reply to Message Icon



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links
Ads by Google


Results for: Can't get rid of virus/spyware
downloader esepor can't get rid of www.computing.net/answers/security/downloader-esepor-cant-get-rid-of-/13255.html

Can't get rid of RUN entry/Service www.computing.net/answers/security/cant-get-rid-of-run-entryservice/17409.html

Can't get rid of onemoresearch.net www.computing.net/answers/security/cant-get-rid-of-onemoresearchnet/14181.html