cannot get updates on anything

But what exactly did you remove?

While you had the spyware on your PC could you get updates and email?

This could be a topic for the Software Forum but let's make sure you do not have any remaining malware.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis
​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
  • Bitdefender
  • Panda Scan
  • HijackThis

.

 

Please try to write your problems more clearly. I'm not sure exactly what you were saying in all of your last message. You do not have anything from Norton showing in your HJT log but you apparently did have Norton on your PC at one time because Bitdefender shows the below Quarantine.

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\



Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)
O4 - HKCU\..\Run: [Yox4RjZng] tfsontr.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: *.musicmatch.com (HKLM)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\Norton Internet Security <--- Since you don't use Norton, this folder if it exists
C:\windows\system32\tfsontr.exe

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

You're welcome but did you follow those instructions yet?

 

Well it is not due to anything that I asked you to do because everything I asked you to fix is still in your HJT log. Nothing was fixed.

Also it sounds like you have not uninstalled Norton since it would not let you delete the file and some processes from it are still running.

Let's get an installed programs list from HijackThis too!

• Run HijackThis, click Open the Misc Tools section
• Click Open Uninstall Manager
• Click Save List (generates uninstall_list.txt)
• Click Save, to save it to a file where you can find it.
• Attach the uninstall_list.txt file to your next message.

 

Are you actually using Add/Remove Programs from Control Panel to uninstall Norton? Look at all the stuff you still have installed from it:

CC_ccProxyExt
ccCommon
ccPxyCore
Norton AntiSpam
Norton AntiSpam
Norton AntiVirus 2005
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security 2005 (Symantec Corporation)
Norton WMI Update
Norton WMI Update
Symantec Script Blocking Installer
SymNet

Use Add/Remove Programs to Uninstall All of these. Start with the Norton Internet Security 2005 (Symantec Corporation)

If you still cannot uninstall them, try the below tool from Symantec:

Using the Norton Removal Tool


If the Symantec Tool does not work, use the below to uninstall all this Symantec software.

Your Uninstaller! 2006



Also note a view other issues observed in your installed programs list:

1. Viewpoint Media Player - should have been uninstalled in step 0 of the READ ME
2. Spybot - Search & Destroy 1.3 - you did not follow the directions in the READ ME for check all links for proper versions of software. This version of Spybot has not been use in more than a year. Uninstall it and install the correct one from our link. Make sure you update it and also use the Immunize feature after it is installed.
3. Java 2 Runtime Environment, SE v1.4.2 - your Sun Java version is way out of date. You must get this updated.

 

Attach a current HJT log! Have you tried another browser? Like: Mozilla FireFox

 

Okay! The below trojan keeps renaming itself:

O4 - HKCU\..\Run: [Yox4RjZng] crytres.exe

You need to attach a new HJT log when you come back AND DO NOT REBOOT OR SHUTDOWN after posting the new HJT log (or the below stuff). Just wait for new instructions. It may take awhile because I will not be around until later tomorrow night.

Now run the below procedure and attach the runkeys.txt log.

• Using GetRunKey

Now run the below procedure and attach the newfiles.txt log.

• Using ShowNew

 

Start by downloading two tools we will need

- Pocket KillBox

Extract to its own folder somewhere that you will be able to locate it later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O4 - HKCU\..\Run: [Yox4RjZng] crytres.exe



Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
Now back on Killbox's main window, Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note some of the files listed below may not exist but we need to check for them anyway.

C:\WINDOWS\System32\crytres.exe


If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot delete all files in the below folder. Windows will have a few in use that it will block. Just work around them:
C:\Documents and Settings\Jim Nutsch\Local Settings\TEMP

Now attach a new HJT log and tell me how the steps went.

Make sure you tell me how things are working now!

 

This is possibly due to the fact the the O4 line I asked you to fix is still showing. Did you fix this:


O4 - HKCU\..\Run: [Yox4RjZng] crytres.exe


Did you actually locate the crytres.exe file with Killbox and fix it? Look for the file yourself. Do you see C:\WINDOWS\System32\crytres.exe


If not use the below procedure and search for it.

Click Start and select Search
Now Select "All files and folders"
Enter the crytres.exe in the "All or part of the file name:" box
Now select "More advanced options"
Make sure the following check boxes are checked:

• Search system folders
• Search hidden files and folders
• Search subfolders

Then click the Search button. Tell me what you find.

 

Okay! Run this XP TCP/IP Repair and see if it helps!

Your HJT log should be clean now that you fixed that last item. So any remaining issues are more than likely not malware.

I will be on vacation until 7/31/06. One of the other Mods or Admins here may be able to pickup where I leave off.