Win32?Clspring!generic

[PaddyP]

Everytime I log on to my computer my e Trust anti virus tells me it has found and deleted the above virus located in my C:\Documents and Settings\luvduk\Local Settings|Temporary InternetFiles\Content.lE5\85INKPQJ\!update-3395-[1].0000 My question is if it has been deleted how come it comes back? I have searched for the files and location and nothing comes up. I have performrd all the scans etc recomended by you and still no luck. As requested I have attached my log files.

[chaslang]

Welcome to MGs!

Note: It is a very bad idea to install software like you are doing it in some instances. Like this for example:
E:\gcasDtServ.exe

This looks more like malware posing as MS Antispyware then MS Antispyware. You should always install software in the default recommended folders to avoid problems.

Make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.
C:\WINDOWS\System32\j?vaw.exe

After killing all the above processes, click Back.
Then please click Scan and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R3 - URLSearchHook: (no name) - {AE766337-ABD5-A602-84ED-A00FA5914F97} - (no file)
O2 - BHO: (no name) - {19D5FACE-6E2F-68FD-7A72-39B60D48F9CB} - (no file)
O2 - BHO: (no name) - {492223BB-B82D-BE8A-7A37-ECEBAA4FD7C9} - (no file)
O2 - BHO: (no name) - {84F74138-D3AD-8D0A-AAAD-85BD2FD24F93} - (no file)
O2 - BHO: (no name) - {AE766337-ABD5-A602-84ED-A00FA5914F97} - (no file)
O4 - HKCU\..\Run: [Xwewnv] C:\WINDOWS\System32\j?vaw.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZNxdm414YYNZ

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\SYSTEM32\feeds
Just look for the below (do not delete) and tell me what you find. It probably is javaw.exe but see if you find two of them of different file sizes and one that is not in alphabetical order in the folder.
C:\WINDOWS\System32\j?vaw.exe
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.
Additional step to delete f3initialsetup1.0.0.15.inf:
- Click Start, Run, and enter cmd in the box and click OK. This opens a command prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\Downloaded Program Files\
attrib -r -h -s f3initialsetup1.0.0.15.inf
del f3initialsetup1.0.0.15.inf
exit

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

[PaddyP]

Thanks for all your help. The virus hasn't shown up again as yet after going through all the steps in your post. There was a javaw.exe 48.0kb which appears to be legit Sun Microsystems and out of alphabetical order with no icon was javaw.exe 392kb. Should I delete this one?
Your note about installing software in different drives: I do this because I am always getting messages about C drive having low disk space so try to avoid loading it up any more.

[chaslang]

Originally Posted by PaddyP

Your note about installing software in different drives: I do this because I am always getting messages about C drive having low disk space so try to avoid loading it up any more.

You're welcome. I'm not talking about the fact of installing to different drives. I referring to the fact that you are not installing them into properly labeled folders for the applications. You should not just be installing programs into the root folder of drive E. It makes them look like malware, it makes them susceptable to getting over written by something else that you install there and could cause the programs to not operate properly.

All programs should be install in their default folder names even if you do change it to a different drive letter.

You should use folders like
E:\Program Files\Microsoft Antispyware
E:\Program Files\iTunes
E:\Program Files\QuickTime

Your HJT log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!