Help cant get rid of spyware

Discussion in 'Malware Help (A Specialist Will Reply)' started by Mopreme187, Feb 21, 2005.

  1. Mopreme187

    Mopreme187 Private E-2

    help, i just formatted pc and whilst setting up my siftware i got some spyware, and i cant remove it.

    i tried windows sypware remover spybot also ran agv and it still wont go.

    **EDIT: spybot found
    elitum.elitebar
    DyFuCa.internetoptimizer
    ISearchTech.Powerscan
    ISearchTech.Sidefinder
    ISearchTech.Slocth
    TIBS
    Webrebates/Topebates
    **


    can anyone out there help me pls.

    thanks in advance
    Mopreme187
     
    Last edited by a moderator: Feb 21, 2005
  2. Mopreme187

    Mopreme187 Private E-2

    sorry here is the log in an attachment
     

    Attached Files:

  3. PhilliePhan

    PhilliePhan Guest

    Hi Mopreme187,


    Please print out these instructions so that you can operate with All Browser Windows CLOSED.
    Please make sure System Restore is OFF and the Viewing of Hidden Files is Enabled as per the tutorial.

    Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

    4zLX3v.exe
    a64sddd.exe


    Now scan with HijackThis and Check the Boxes for the following:

    O4 - HKLM\..\Run: [4zLX3v] C:\windows\temp\4zLX3v.exe
    O4 - HKLM\..\Run: [popuppers64] C:\WINDOWS\a64sddd.exe
    O4 - HKLM\..\Run: [MsnExplorer] C:\WINDOWS\msexploren.exe /i
    O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass.exe

    O15 - Trusted Zone: *.media-motor.net
    O15 - Trusted Zone: *.popuppers.com

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Please boot into Safe Mode with the Viewing of Hidden Files Enabled and navigate to and DELETE the following if they should remain:

    C:\windows\temp\4zLX3v.exe
    C:\WINDOWS\a64sddd.exe
    C:\WINDOWS\msexploren.exe
    C:\WINDOWS\lsass.exe ---> Not to be confused with the Legitimate lsass.exe in C:\Windows\System32

    NEXT:
    Run CCleaner and Spybot S&D and have Spybot fix what it finds.

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.

    Reboot to Normal Windows and Scan with HijackThis and attach that log.
    Let me know of any problems you may have encountered with the above instructions and how your computer is running now. I will try to check back when time permits . . . . perhaps tonight.

    PP :)
     
  4. Mopreme187

    Mopreme187 Private E-2

    Hello i followed instructions whilst in safe mode and deleting files i could't find

    C:\windows\msexploren.exe
    C:\windows\lsass.exe

    also when i ran spybot it found all the spyware again and didn't fix as they are still in memory.

    here is new log file
     

    Attached Files:

  5. PhilliePhan

    PhilliePhan Guest

    Nothing evil in that log!

    Boot to Safe Mode and Scan with Spybot (and Fix what it finds) and save and attach that log.

    Reboot to Safe Mode and scan with Ad-Aware SE (Fix what it finds) and attach that log as well and we'll see what they have to tell us!

    PP :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds