Specialty Forums Security and Virus
General Hardware
CPUs/Overclocking
Networking
Digital Photo/Video
Office Software
PC Gaming
Console Gaming
Programming
Database
Web Development
Digital Home
General Forums Windows XP
Windows Vista
Windows 95/98
Windows Me
Windows NT
Windows 2000
Win Server 2008
Win Server 2003
Windows 3.1
Linux
PDAs
BeOS
Novell Netware
OpenVMS
Solaris
Disk Op. System
Unix
Mac
OS/2
Drivers Driver Scan
Driver Forum
Software Automatic Updates
BIOS Updates My Computing.Net Solution Center Free IT eBook Howtos Site Search Message Find RSS Feeds Install Guides Data Recovery About Home
Subject: Need help removing spyware
Original Message
Name: Dave8603 Date: October 1, 2007 at 08:01:30 PacificSubject: Need help removing spywareOS: Windows XPCPU/Ram: P4 2.66/1gbModel/Manufacturer: Dell
Comment: I get random ads popping up in IE and Firefox. Not sure what I clicked on but its very annoying. Also McAfee detected it and said it removed it but i still get ads popping up. McAfee calls it a trojan, "Downloader.gen.a" and also detected "Spyware-JuanSearch" and "Generic.dx" It tells me the location but I can't manually delete them. Thanks for the help. I can post a HJT log if anyone wants to help me out and see it.
Report Offensive Message For Removal
Response Number 1
Name: jabuck Date: October 1, 2007 at 15:11:48 PacificSubject: Need help removing spyware
Reply: (edit )Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Please download and install the latest version of HijackThis v2.0.2:
Download the HijackThis Installer from this link: HijackThis
1. Save " HJTInstall.exe" to your desktop.
Report Offensive Follow Up For Removal
Response Number 2
Name: Dave8603 Date: October 1, 2007 at 15:18:03 PacificSubject: Need help removing spyware
Reply: (edit )SmitFraudFix v2.234Scan done at 18:15:43.65, Mon 10/01/2007
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
SrchSTS.exe by S!Ri
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Intel(R) PRO/100 VE Network Connection - Packet Scheduler Miniport
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E54772EE-31C0-44B2-B0DD-09764460EBCB}: NameServer=192.168.1.1
Report Offensive Follow Up For Removal
Response Number 3
Name: Dave8603 Date: October 1, 2007 at 15:19:18 PacificSubject: Need help removing spyware
Reply: (edit )Logfile of Trend Micro HijackThis v2.0.2Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://drmlicense.one.microsoft.com...
--
Thanks a lot for your help
Report Offensive Follow Up For Removal
Response Number 5
Name: Dave8603 Date: October 1, 2007 at 15:51:38 PacificSubject: Need help removing spyware
Reply: (edit )ComboFix 07-10-02.2 - David 2007-10-01 18:31:06.1 - NTFSx86 ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\check_LSA7.txt
.
2007-10-01 18:28 51,200 --a------ C:\WINDOWS\NirCmd.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsioReg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
.
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
**************************************************************************
Report Offensive Follow Up For Removal
Response Number 6
Name: jabuck Date: October 1, 2007 at 16:05:07 PacificSubject: Need help removing spyware
Reply: (edit )I have to leave for about 3 hrs.Go to this link, VirusTotal
C:\WINDOWS\system32\idavikix.dll
Post a new Hijack This log with the above results please.
Report Offensive Follow Up For Removal
Response Number 7
Name: Dave8603 Date: October 1, 2007 at 16:17:25 PacificSubject: Need help removing spyware
Reply: (edit )Hey, not sure if you wanted the results from VirusTotal but here they are anyway. I'm gonna restart and post a new HTJ log in a minute. Thanks again for helping me out.Antivirus Version Last Update Result
Report Offensive Follow Up For Removal
Response Number 8
Name: Dave8603 Date: October 1, 2007 at 16:24:41 PacificSubject: Need help removing spyware
Reply: (edit )Logfile of Trend Micro HijackThis v2.0.2Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://drmlicense.one.microsoft.com...
--
Report Offensive Follow Up For Removal
Response Number 9
Name: jabuck Date: October 1, 2007 at 18:57:46 PacificSubject: Need help removing spyware
Reply: (edit )Please download “Avenger” by swandog46 to your desktop from this link Avenger 2. Copy all the text contained in the area between the X"s below to your Clipboard by highlighting it and pressing (Ctrl+C):
Next , run Hijack This, close all windows and browsers except hijack this, place a check to the left of the following item and press "fix checked":
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\idavikix.dll",sitypnow
Post a new Combofix log and a new Hijack This log please.
Report Offensive Follow Up For Removal
Response Number 10
Name: Dave8603 Date: October 1, 2007 at 20:04:20 PacificSubject: Need help removing spyware
Reply: (edit )Logfile of The Avenger version 1, by Swandog46*******************
Script file located at: \??\C:\WINDOWS\system32\mlqvlvye.txt
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\system32\idavikix.dll deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Report Offensive Follow Up For Removal
Response Number 11
Name: Dave8603 Date: October 1, 2007 at 20:06:46 PacificSubject: Need help removing spyware
Reply: (edit )I am also now getting an error message when I start the computer now. It says "Error loading C:\Windows\System32\idavikix.dll The specified module could not be found." Should I disable this in msconfig?
Report Offensive Follow Up For Removal
Response Number 12
Name: Dave8603 Date: October 1, 2007 at 20:13:02 PacificSubject: Need help removing spyware
Reply: (edit )Actually, ignore my last post. I didn't put 2 and 2 together as to what I would be deleting in HJT and what the error message said. The error message is gone after deleting that key in HJT. Here's the new log:Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://drmlicense.one.microsoft.com...
--
Report Offensive Follow Up For Removal
Response Number 13
Name: Dave8603 Date: October 1, 2007 at 20:23:38 PacificSubject: Need help removing spyware
Reply: (edit )Combofix log:ComboFix 07-10-02.2 - David 2007-10-02 23:19:52.2 - NTFSx86
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\cookies.ini
.
2007-10-01 18:28 51,200 --a------ C:\WINDOWS\NirCmd.exe
.
((((((((((((((((((((((((((((( snapshot@2007-10-02_18.44.23.34 )))))))))))))))))))))))))))))))))))))))))
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsioReg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
R3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
.
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
**************************************************************************
Report Offensive Follow Up For Removal
Response Number 14
Name: jabuck Date: October 1, 2007 at 20:28:37 PacificSubject: Need help removing spyware
Reply: (edit )This should stop the "error loading" message, let me know if it does not.Open notepad (Start Menu > Run > Type notepad and press "ok".
Copy and paste everything into notepad between the x's making regedit4 the top line.
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.
Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.
Restart the computer
Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Restart to normal mode
Run this free online scan from Kaspersky http://kaspersky.com/kos/english/kavwebscan.html
Report Offensive Follow Up For Removal
Response Number 15
Name: Dave8603 Date: October 1, 2007 at 20:31:33 PacificSubject: Need help removing spyware
Reply: (edit )The error message went away after I deleted the key in HJT. I didn't realize the file you were telling me to delete was also the reason for the error message. I guess I don't need to go through those steps you just posted. Thanks anyway though. I really appreciate all your help.
Report Offensive Follow Up For Removal
Response Number 16
Name: jabuck Date: October 1, 2007 at 20:52:26 PacificSubject: Need help removing spyware
Reply: (edit )Ok, you should run AFT cleaner and clean out the restore folder.Also you java is out of date and will cause a reinfection.
Download the latest version of http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
. Then from your desktop double-click on jre-1_6_2-windowsi586-p.exe to install the newest version.
You should consider adding "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.
Glad we could help.
Report Offensive Follow Up For Removal
Use following form to reply to current message:
Version Tracker Pro
Driver Agent