Spyware & Some Viruses Probably too

Yeah, I think I have a bunch of stuff, haha. I have no idea. I could use some help.

BUT I did follow those first six or seven steps that were required --& to be honest, that already helped a lot! I think the major problem I had [& probably still have anyway yet nothing's happening right now] was this program called Spy Sheriff [which would open up a page in IE every so often & tell you to buy the program because you had spyware; it would redirect you to this page resembling one of microsoft saying that your computer security was in a bad state or something; and in the task manager (you know, next to the computer clock) there would always be this yellow, triangular alert icon with an exclamation point & it would say the computer was infected or that there wasn't enough memory]. Yeah, haha, a lot of stuff that I don't know about.


So anyway, I'm going to post the log things as well as a computer report [from EVEREST Home Edition, because I really can't tell you about my computer].


& In my next post I'll attach the HijackThis log [that I have yet to ..configure] & the BitDefender log [which I have to find, haha].


But yeah, I hope I can be helped. I swear I'm not as worthless with computers as I seem, but I'm still really not that knowledgeable either...


Thank you!

-- Amy :]

 

I hope this is right!


Thank you again :]

 

Please download smitRem.exe and save to your desktop.

Double click on the smitRem.exe file to extract it to it's own folder on the desktop. (this should be the default selection). Now open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. The tool will create a log named smitfiles.txt in the root of the drive that you ran the batch file on, eg; Local Disk C: or partition where your operating system is installed.

After you complete the above, please see the below thread on how to install and run VundoFix.

• Virtumonde aka Trojan Vundo Fix w/ Tool ...

Once you complete the scan above, attach the log from the scan, a fresh HJT log and a fresh Panda log.

 

I apologize for replying back to this so late!

But anyway, I ran the smitRem program last night, & because it was taking so long, I left it & went to bed. But I don't believe that it ever ran the disk clean-up....So I re-ran it again today & followed the steps, & it arrived at something like 'preparing for disk clean-up...could take a couple of minutes...[at bottom] compressing files..." & That was it. Nothing happened after that went away. I do have smitfiles.txt though, so I'm just going to attach that anyway.



Thank you very much for you help!

I just have to attach the panda log in my next post :]

 

& Here :]

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.yahoo.com

O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6mons.dll (file missing)

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Again, make sure ALL browser windows are closed when you click FIX.

Next, run CCleaner to clean up cookies and temp files.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\system32\sklmnf.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\instreg_tmp.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, REBOOT and proceed with the rest of this fix...

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Okay, so I followed all of those steps without any problem--thank you, again!


The new log is attached.


& Everything seems to be running fine!
Hopefully all is well now...but if not, I'm glad to have your help! :]

 

Your log looks good, are you having any further problems?

 

No no, not anymore. Everything's working fine now. --Thank you very much for your help!

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!

 

Woah, so I went to that link you posted, uninstalled microsoft java, went to the website to download the sun java, clicked on the link, & my computer just went to this blue screen & said a problem had been encountered, & if it was the first time I had seen that screen to just restart, otherwise to ask for professional support...& at the bottom it said 'deleting physical memory [or harddrive?] & then it said completed' & yeah.

I mean...everything works now again --but I'm just telling you just in case!



& One more thing--I swear--I've disabled the Windows Firewall before to access different programs, but now, since I've downloaded a software firewall, I'm trying to disable it & it won't allow me to. The disable option is just grey, you know, I can't click on it or anything...
I don't know if this totally matters but I'd figure to ask. :]

 

If you install another firewall, it should disable it automatically for you, the windows firewall that is.

 

Okay, really late reply but that's because my internet hasn't been working.

It appears the firewall I had downloaded [I believe it was the Outpost Firewall] blocked just about EVERYTHING. It took me awhile to realize what was wrong.
So anyway, I deleted it & I guess I'm just going to stick with what I have for now.

 

Okay, Outpost should do a good job for you.

Surf Safely!