Hoping for help

bradnyk · Nov 6, 2006

Hi there,

I am getting desperate here.. I'm pretty computer savvy but this particular virus/spyware seems impossible to beat. I clicked on something I shouldn't have and now I have the following symptoms:

1. Random popups in Internet Explorer consistent with Vundo

2. BHOs that HiJackThis can't seem to fix.

3. Random DLL files appearing in Windows/System32 (i.e., aksdaskljd.dll) - just gibberish, but they can't be deleted. If I delete them they are recreated instantly, even in safe mode.

4. An infected "ctfmon.exe" which also cannot be deleted and shows up in the taskbar even in safe mode. If I remove references to it in the registry or delete/rename the file, the file recreates itself on the spot and the registry changes won't save, even in safe mode.

I have AVG, Kaspersky, AdAware, SpyBot, and VundoFix. If I start into safe mode and run them, I typically get messages that a virus has been found (usually says VirtuMonde) but that the files are in use and can't be deleted, would I like it to run at next book. If I select yes and reboot, the system boots back up and does a new scan at boot time, but I get the exact message.. file is in use, would I like to restart - and it just loops like that until I select "No."

I am at my wit's end! I have never, ever had something this persistant. Booting into safe mode does nothing. System restore is off.

I am using Windows XP MCE 2005 with all latest patches. Here is a HiJackThis log. Notice the BHO dll files which cannot be removed no matter how I try.

Can ANYONE help me?! Thanks so much.

Brad

DavidGP · Nov 6, 2006

Hi

Please run through the below guide as many of the steps many well remove the majority of the infection, but as Hijackthis now needs a bit of a name change to something like analyze.exe as we mention in our guide, because a few of the newer varients of malware hide themselfs from the HJT scan so are never picked up.

The other logs will show various other locations in which the malwares could be hiding again areas HJT may not scan, so I find it best to do each step and therefore making sure I dont miss anything.

If you still have malware after running the below guide this somethimes is normal, which is where the logs come in as one of our malware gurus will be able to post some further instructions tailored to your infection an pc to remove the pest.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy - ONLY IF you were not able to run Windows Defender

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

hope this helps

Log in or Sign up

Hoping for help

bradnyk Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member