Computing.Net > Forums > Security and Virus > Help with a virus/spyware

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Help with a virus/spyware

Reply to Message Icon

Original Message
Name: dalamar23666
Date: March 14, 2006 at 17:18:54 Pacific
Subject: Help with a virus/spyware
OS: windows xp sp2
CPU/Ram: celeron 2.4ghz 192 ram
Model/Manufacturer: Hp Pavilion ze4500
Comment:

Hi,

I need some major help. I have hit a brick wall and can't get anywhere. I know I have a LOT of problems with this computer.

First problem is that it has cws.msconfig. cwshredder will not remove it. I also have a problem getting to regedit. I have to do both in safe mode.

Also, I am not able to completely run ewido, stinger, spybot, ad-aware in safe mode or regular mode without the computer rebooting in the same place everytime (shortly after the I386 folder sacn completes). Ewidio finds 4 things but never finishes. I have tried running hijack this and been unsuccessful.

The following items keep showing up in the startup list and started duplicating themselves in safemode. After I would remove them, they would appear back and a copied version would appear as well. This started happening after trying to run ewido.

fdos.exe (labeled windows update)
sys(various numbers).exe
xzhj.exe
ipmppp.exe (labeled Ywp7RVjtU)

I also had something called media pass that I removed a while ago come back to the registry. I had cleaned it and deleted all instances I could find.

This computer can connect to the internet but I can't get to any pages. I have the about.blank thing going on as well.

I have thought about hooking up the computer to a network and scanning with another computer, but I am worried about getting the crap on another computer.

I do not want to format and reinstall as I have programs on the laptop that I can't replace. But as a last resort I am afraid I may have to.

Any ideas????

Thank you
Jared


Report Offensive Message For Removal


Response Number 1
Name: jabuck
Date: March 14, 2006 at 17:32:08 Pacific
Reply: (edit)

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. You can download Hijack This at this link http://www.tomcoyote.org/hjt/ then place it into a folder of it's on, such as C:\HJT, so that back up copies can be made and not clutter your desktop or other folders and the backup copies of deleted items can be easily located if needed.

Once saved double click HijackThis.exe, and press "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its contents into the text editor at this forum.

Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.


Report Offensive Follow Up For Removal

Response Number 2
Name: dalamar23666
Date: March 15, 2006 at 04:24:15 Pacific
Reply: (edit)

Hi,

I am not able to completely run hijack this without the computer rebooting. I have attempted to run it in safe mode and in regular mode. Any suggestions how to get the hijack this to complete without the computer rebooting?

As a side note, I found that the computer only reboots when I am trying to run hijack this, adaware, spybot, virus scan etc. Anything else works fine.


Report Offensive Follow Up For Removal

Response Number 3
Name: question (by fixit01)
Date: March 15, 2006 at 07:01:36 Pacific
Reply: (edit)

Because you are having so many problems I would suggest that you wipe and reload it.


Report Offensive Follow Up For Removal

Response Number 4
Name: bofra
Date: March 15, 2006 at 10:56:16 Pacific
Reply: (edit)

try running hijack this and virus/spyware scans in safe mode,

empty temp folders,
empty temporary internet folder,
delete trash,

try to reinstall/repair iexplorer,



Report Offensive Follow Up For Removal

Response Number 5
Name: dalamar23666
Date: March 15, 2006 at 13:21:13 Pacific
Reply: (edit)

I was hoping I would not have to wipe and start from scratch. I have used a program called clean up on it to wipe all the temp files. I will have to try to reinstall IE.


Report Offensive Follow Up For Removal


Response Number 6
Name: jabuck
Date: March 15, 2006 at 14:33:36 Pacific
Reply: (edit)

Download aboutbuster from this link http://www.malwarebytes.org/AboutBuster.zip and extract it to your desktop, run it, update the files but do not scan yet.

Download cwshredder from this link http://cwshredder.net/bin/CWShredder.exe but don't run it yet.

Reboot into safe mode.

Once you get into safe mode run cwshredder and click "fix".

Next Then please run About:Buster and click Start to begin the scan. If prompted to end the Explorer.exe process, click Yes. Your desktop may disappear, this is normal. Allow the program to scan twice, and when complete click "Save Log". This will create a text file called "AB Logfile.txt" in the folder where About:Buster is saved. If you have any errors just stop and post the error message.

See if you can run Hijack this now.


Report Offensive Follow Up For Removal






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home








Do you have your own blog?

Yes
No
I did before
I will soon


View Results

Poll Finishes In 5 Days.
Discuss in The Lounge
Poll History




Data Recovery Software