HELP! Infected with Spyware...

Hi, hope someone can help...i'm having terrible problems with my laptop.

I've followed the instructions at:
http://forums.majorgeeks.com/showthread.php?t=35407

...i have carried out all the online checks and installed all the recommended programs, but the infection is still there.


Whenever I open up IE, I automatically get a few pop-ups (even though I have pop-up stopped enabled). A search through the registry shows that various folders have appeared containing URLS's of various weird sites. Also, a load of shortcuts (links to credit card sites, etc) appear on my desktop too.

I have installed various programs to detect/protect spyware (CW shredder, stinger, etc) but still no joy.

A copy of my hijackthis log file is attached.


Hope someone can help...

Many Thanks - the_nine.

 

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://216.130.185.122/sidesearch.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://216.130.185.122/sidesearch.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cafevik.fs.fujitsu.com

O2 - BHO: ohb - {988CAFC4-DC0D-4D8C-A35E-5028ABE9E641} - C:\WINNT\System32\ic2_win.dll (file missing)

O3 - Toolbar: Begin2Search.com Bar - {207AEF46-0596-4966-A7BF-098F247E85BB} - C:\WINNT\System32\ic2_win.dll (file missing)

O4 - HKLM\..\Run: [rkd] C:\WINNT\rkd.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.cafevik.fs.fujitsu.com

O16 - DPF: {0BA88017-39EC-4954-B6D3-C366B8C27CE6} (PWLibraryComponent.ctlProjectWEBLibrary) - http://pjweb-uk1.solutionnet.fs.fujitsu.com/GSN0002/pjwebroot/GSNPWLIBRARY/clien t/PWLibraryComponent.CAB

O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukiq0026/ukiq0026.cab

O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhelper/version7/dlhelper.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://32red.microgaming.com/32red/FlashAX.cab

O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab


Again, make sure All Browser Windows are Closed when you Click FIX.



NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:


C:\WINNT\System32\ic2_win.dll

C:\WINNT\rkd.exe



NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"


Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Once in normal mode, procede on!

NEXT:

Please download HOSTER and open it, select Restore Original Hosts > Press OK and then exit program.

After you have restored your original host file, Scan with HijackThis and attach the new log. Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi,
I have followed your helpful advice to the letter.

Attached is my latest HijackThis log.

Many thanks for your help thus far.

the_nine.

 

Did you set this as your homepage?





Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cafevik.fs.fujitsu.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cafevik.fs.fujitsu.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cafevik.fs.fujitsu.com


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.fel01.icl.local:80

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.fs.fujitsu.com;*.icl.fi;*.icl.se;145.227.*.*;172.19.*;192.168.*.*;*. icl.co.uk;*.fjcomp.com;172.30.*.*;

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\SxpInst\sxplog32.exe

O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhelper/version7/dlhelper.cab


Again, make sure All Browser Windows are Closed when you Click FIX.



Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After you do this, then attach a new HJT log and tell me how things are running now.

 

Hey BJ

Is this desktop?

D:\profiles\RodgersJ\Desktop\hjt\HijackThis.exe

 

It sure sure isnt C:\Program Files\HJT!

 

MOVE HJT BEFORE USING HJT!

Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:
Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder (C:\Program Files\HijackThis)and click Next.

Now run HJT from there. Please save your HJT Log as a .txt File and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.

 

I agree, sorry just copied and pasted it

Just trying to get the point to relocate HJT across.

 

Hi,

Thanks for all yoru help - I think my laptop is now running spyware-free!

Yes, this is my correct homepage:
http://www.cafevik.fs.fujitsu.com/

I didn't remove some of the checks you specified as they are the correct settings (they are the proxy settings & homepage I use for my work).

I have installed HijackThis in the correct place now...and I have attached the latest copy fyi.

As I said I think all the problems have gone away, so many thanks very much for all your assistance.


the_nine.

ps. my girlfriends laptop has got problems too and she's asked me to try and fix it, so i'll send the details of that in another post...hope you can help with that one too!

 

Are you familiar with these entries?