Mywebsearch and 180com.assistant

Re: Spyware removal - I've followed your instructions

Hi there

Tried running Spybot recently as part of my regular spyware check. However, it keeps freezing. I've run all the checks (took a couple of days on and off) and have discovered some rogue files; Mywebsearch and 180com.assistant.

How can I get rid?

Thanks.
MonkeyCat

PS Bitdefender came back clean and HJT log to follow. Can't see a file called HJT.exe so I haven't renamed.......

 

Re: Spyware removal - I've followed your instructions

HJT log attached

 

Run CounterSpy as requested by our tutorial and post the log.

 

Schoolboy error!

Sorry - I didn't know how to save a copy of the scan results. I've copied and pasted into word and attach here (it was too big so I've had to zip the file to compress it).

Hope you can now help.

Thanks.

 

Nay news on this guys?confused

 

Don't bump your thread. It just takes me that much longer to get to yours as it makes it newer.

C:\Program Files\HJT Folder\HijackThis.exe <<--- This is not where our instructions say to install HijackThis. You did not rename HijackThis as instructed. Rename HJT Folder to HJT and HijackThis.exe to analyse.exe. Do this before continuing with my instructions.

Run CounterSpy again and this time fix everything it finds.

Download
- Pocket Killbox

Using Add or Remove Programs in the Control Panel; uninstall the following:

Every one of these Poker Games are responsible for at least 1 piece of spyware on your system. Although, fun to play they render your system vulnerable to pop-ups.

Morpheus is a Spyware laden P2P program.

Everything else is out of date.

Install the current version of Adobe Acrobat Reader from: Adobe Acrobat Reader Download

Install Java Runtime Environment (JRE) 6 available from Sun Microsystems.

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

REBOOT to Normal Mode.

Post fresh logs for the following:
1. CounterSpy This time do not copy and paste the wordpad and put it in a zip file. CounterSpy Scan Results is a menu option.
2. ShowNew
3. GetRunKey
4. HijackThis

 

Hi

OK. I haven't removed the poker applications as I do use those on a regular basis. As well, I don't know what I'm missing in CounterSpy, but I have gone into every option and cannot display the scan result and then save. That option isn't there (definitely) !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Other than that, I followed all your instructions and they seemed to run smoothly. I attach all the other logs you're after. As I say, I can't find anything in CounterSpy to show the scan result with the option to save the file.

Thanks for your help and please advise.

MonkeyCat

 

To access the CounterSpy scan log...

1. View >> Spyware Scan >> Spyware Scan History

2. Select the scan you'd like to view

3. Hit "View Details"

I need you to run this ptach again to reset a value. Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Otherwise your logs look fine. Post the CounterSpy log.

 

I've done that and it shows the log which I previously pasted into word. The problem is, when the log appears, I can't do anything with it other than 'print' (that's the only option). Do you want me to paste the log directly into the thread?

I ran the patch again as requested; no problems there.

Please advise!

Thanks.
MonkeyCatconfused

 

Copy and paste the log into notepad, save it; and then post it.

 

Ok SPD - here you go.

Please advise.

Thanks.
MonkeyCat

 

I'm bumping cos it'd been 3 days........think you've forgotten about me?:cry

 

No, I didn't forget about you; just been really busy on the home front the past few days.

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Delete the following folder: C:\Program Files\Common Files\Real\WeatherBug

Empty the Recycle Bin

Run CCleaner

If you are not having any other malware problems, it is time to do our final steps:

• If we used Pocket Killbox during your cleanup, do the below
  • Run Pocket Killbox and select File, Cleanup, Delete All Backups
• If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
• If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
• If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
• If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
• If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
• You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
• If you are running Windows XP or Windows ME, do the below:
  • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
  • Then reboot and Enable System Restore to create a new clean Restore Point.
• After doing the above, you should work thru the below link:
  • How to Protect yourself from malware!