Please Help me HJT & Scans

gazito · Mar 19, 2006

I have been having some problems lately with my computer and its driving me mad.

I continuely seems to have to scan several times a week because I keep getting various malware, spyware virus etc ... and something to do with a virus dropper.

I have also this screen that is popping up sometimes when I boot my computer :

Says : recording key strokes ....

It flashes fast so i cant get the whole load of what it says. Also I have having problems with Limewire, whenever install limewire it continuelly loads itself when I close it down again and again. I have of course removed this but I would like to have it on my computer without doing that.

Everytime I do a scan I keep getting Kazaa, and the same virus malware etc threats. Even if I do the scan over and over in a row still the same, when the program removes them they just pop back.

Thanks soooooo much !! I have included the panda, bit and hjt log that is requested in the post to do before asking for help.

Thanks very much for your time and help !

chaslang · Mar 19, 2006

Welcome to Majorgeeks!

Is there a reason you did not install and run MS Windows Defender? It has replaced MS Antispyware.

Now run this tool: Kazaa Spyware Removal

Did you setup Windows Media Player like below to load on startup? If not, delete the below file:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\wmplayer.exe

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4
[-HKEY_CLASSES_ROOT\CLSID\{147A976E-EEE1-4377-8EA7-4716E4CDD239}]
Click to expand...

Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto
O20 - Winlogon Notify: ExtShellViews - C:\WINNT\system32\cbm.dll (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\outlook <--- the whole folder
C:\Program Files\winsupdater <--- the whole folder
C:\WINNT\system32\cbm.dll
C:\WINNT\system32\backgrd.jpg

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.

Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

gazito · Mar 19, 2006

Thank you very much for your reply, I have complete everything that you said. I have not seen the pop up box for the last few times I rebooted .... and my machine seems to be booting much faster.

I did not run the windows defender because when I went to run and install it it popped up with an error stating it could not be installed .... etc so i tried again and it was the same so I continued on with that list of things to do.

I did have an error when deleting the files in the reg through HJT .... it said :
Error in deleting : O20 - Winlogon Notify: ExtShellViews - C:\WINNT\system32\cbm.dll (file missing) please email mmmm@mmmm.com with details of error .... then i clicked continue it conitued then i rescanned after and it was gone .... so I dunno what happened there.

Thanks loads for your help

chaslang · Mar 19, 2006

You're welcome.

Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Please Help me HJT & Scans

gazito Private E-2

Attached Files:

Activescan.txt

bdscan1.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

gazito Private E-2

Attached Files:

hijackthis2.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member