Specialty Forums Security and Virus
General Hardware
CPUs/Overclocking
Networking
Digital Photo/Video
Office Software
PC Gaming
Console Gaming
Programming
Database
Web Development
Digital Home
General Forums Windows XP
Windows Vista
Windows 95/98
Windows Me
Windows NT
Windows 2000
Win Server 2008
Win Server 2003
Windows 3.1
Linux
PDAs
BeOS
Novell Netware
OpenVMS
Solaris
Disk Op. System
Unix
Mac
OS/2
Drivers Driver Scan
Driver Forum
Software Automatic Updates
BIOS Updates My Computing.Net Solution Center Free IT eBook Howtos Site Search Message Find RSS Feeds Install Guides Data Recovery About Home
Persistent Spyware/Virus Problem
Original Message
Name: ctrueman82 Date: July 9, 2007 at 20:11:26 PacificSubject: Persistent Spyware/Virus ProblemOS: XP Profesional SP2CPU/Ram: Core 2 Duo 6300/2GB OCZModel/Manufacturer: Intel
Comment: Having a problem getting rid of some spy ware, my computer has been spy ware/virus clean for the last 6 months or so and earlier today I came home and I guess someone in my family used it cause I had spy ware problems.Anyways, I have Ad-Aware SE personal, Spybot - Search and Destroy for system scans. I also have Spy ware Blaster and AVG running in the background. Used all of these and have been unable to nuke this last batch of spy ware. I use COMODO fore firewall.
The spy ware problem is as follows;
Windows Security Alert pop up, when I close it I get taken to a page to download Ultimate Defender or Privacy Protector. Also when I boot up my system I get 3 Icons on my desktop for Error Cleaner, Privacy Protector and Spy ware & Mal ware Protection. I also get a small red triangle with an exclamation point inside it that pops up in my system tray, warning me that there is virus activities going on in my computer. And finally I get another pop that says Security Alery, click Yes/No to download critical software etc.
Any help would be appreciated, I have downloaded and installed Highjackthis.
Thank you in advance.
Report Offensive Message For Removal
Response Number 1
Name: XpUser4Real Date: July 9, 2007 at 20:16:12 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )copy and paste your HJT log into http://hijackthis.de/ I really don't need monkeys on my back....hint...hint!
Report Offensive Follow Up For Removal
Response Number 2
Name: ctrueman82 Date: July 9, 2007 at 20:56:10 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )Okay, did as you say. Found 2 files that were identified through google as bad news so I nuked them and rebooted.Got the same 3 icons appearing on the desktop and the inital security alert asking me to download Ultimate Defender. As of yet no secondary alert, or the icon in my taskbar.
Thanks for a start on the problem.
Report Offensive Follow Up For Removal
Response Number 5
Name: XpUser4Real Date: July 9, 2007 at 21:25:56 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )try this free online scan and remove all it finds:http://www.spywareinfo.com/xscan.php This has worked for me on many occasions:http://www.avast.com/eng/download-a...
I really don't need monkeys on my back....hint...hint!
Report Offensive Follow Up For Removal
Response Number 6
Name: ctrueman82 Date: July 10, 2007 at 05:44:45 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )Well that online Scan didn't find anything, so I got Avast.Avast found 1 thing but it kept crashing over and over during a deep scan.
And ever since I got Avast my computer won't stop reading my HD constantly. My system is moving at a snails pace, I can close everything and it still won't stop reading the HD. I'm completely stumped here. =/ I've uninstalled Avast and all the other programs I downloaded recently and its had no affect. I guess if I ever needed an excuse to reformat and get Vista this is it.
Report Offensive Follow Up For Removal
Response Number 7
Name: XpUser4Real Date: July 10, 2007 at 12:19:00 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )did your PC EVER have Norton or McAfee installed?Getting Vista would be a new can of worms for you, from all I've seen and heard, it is a big head-ache untill they get all the drivers and software straightened out.
I really don't need a monkey on my back....hint...hint!
Report Offensive Follow Up For Removal
Response Number 9
Name: smifff Date: July 10, 2007 at 14:09:08 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )RogueRemover From Here will remove your Privacy Protector and I would try Comodo BOClean From Here for the rest
If any advice helps, please post back as it might help others.
Report Offensive Follow Up For Removal
Response Number 10
Name: MrExacta Date: July 10, 2007 at 19:31:14 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )ctrueman,In order to obtain a truly good HJThis log, you must be in safe mode and rename HijackThis.exe to something random like testhjt99.exe or whatever you want that isn't close to the original name, then run it. You want to look for any c:\windows\system32 filenames with .dll in the BHO area and also farther down in the "winlogon = c:\windows\system32\ same .dll file as the above BHO.
If you have those, it will be easy to get rid of, just download the following applications: (search in google to find them, they are all free)
smitfraudfix.exe
Get back with some results of that HJThis log when you run it in safe mode with the file renamed.
MrExacta -`
Report Offensive Follow Up For Removal
Response Number 11
Name: ctrueman82 Date: July 10, 2007 at 20:33:07 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )Logfile of HijackThis v1.99.1Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.ph... http://messenger.zone.msn.com/binar... http://go.microsoft.com/fwlink/?lin... http://messenger.zone.msn.com/EN-US... http://update.microsoft.com/windows... http://messenger.zone.msn.com/binar... http://messenger.zone.msn.com/binar...
Report Offensive Follow Up For Removal
Response Number 12
Name: MrExacta Date: July 10, 2007 at 22:15:12 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )Download Killboxhttp://killbox.net/downloads/KillBo... Boot into safe mode, save a HiJackthis log and copy and paste the "C:\Program Files\SUPERAntiSpyware\SASWINLO.dll" into the killbox file location window. Then choose the delete file on reboot.
Make sure you also manually delete all the files in your temp user profile under "documents and settings/username/local settings/temp" and under "c:\windows\temp" and "c:\windows\prefetch".
Boot back into safe mode, and run another Hijackthis log.
MrExacta -`
Report Offensive Follow Up For Removal
Response Number 13
Name: ctrueman82 Date: July 10, 2007 at 22:48:30 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )Before I post the updated log I wanted you to know the highjackthis log file website flagged this;O21 - SSODL: msqnx - {CB30118A-5FF8-4B43-9CD5-6BD70159FDF2} - C:\WINDOWS\msqnx.dll
Should I nuke it via killbox in safe mode?
Logfile of HijackThis v1.99.1
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.ph... http://messenger.zone.msn.com/binar... http://go.microsoft.com/fwlink/?lin... http://messenger.zone.msn.com/EN-US... http://update.microsoft.com/windows... http://messenger.zone.msn.com/binar... http://messenger.zone.msn.com/binar...
Report Offensive Follow Up For Removal
Response Number 14
Name: MrExacta Date: July 10, 2007 at 22:59:43 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )You can now check that entry in Hijackthis and it will remove it permanently. I would run a spybot scan in safe mode once you've updated all the definitions. You should remove that other entry you mentioned above with HJT also. If it won't remove in safe mode, just use Killbox to delete in on a reboot.MrExacta -`
Report Offensive Follow Up For Removal
Response Number 15
Name: ctrueman82 Date: July 10, 2007 at 23:55:15 PacificSubject: Persistent Spyware/Virus Problem
Reply: (edit )Done and done, HD is still reading 24/7. As of yet no popups. I'm going to reformat regardless I shoved all my important stuff to my external HD.Thank you for your help everyone
Report Offensive Follow Up For Removal
Use following form to reply to current message:
