Spam Mass Mailer

Hi I have a problem with a PC after running AVG (Ewido) and Spybot S&D over it and then activating and updating Norton Internet Security 2006 on it, I boot it up and see it sending loads of new e-mails with spam headers and content, I immediately blocked the Internet Access and ran the AV and other programs again.

I have run AVG in safe mode and disabled System restore then re-enabled it.

Edit: Removed inline log

 

Hi

I have now followed all of the steps as directed and have the following log files for you

The scans found numerous problems and removed most, however there were reported problems that could not be dealt with which apper to be duplicates of ones that were.

I would be realy great if you could confirm that the system is now clean or how to deal with any remaining issues.

Thank you

Magic

 

The remaining log files

 

Using add/remove programs which can be accessed from the control panel, uninstall the following:

Download

- Pocket KillBox

Extract to its own folder somewhere that you will be able to locate later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Make sure you have rebooted in Normal Mode (do not open any other processes)


Run HijackThis. Click the 'Do a system scan only' button.


Once the scan has completed click Config

Click Misc Tools

Click Open Process Manager

Terminate the following processes by selecting them from the list and clicking Kill Process
These may not be running but we need to check.

Click back to return to the scan results.

Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.


REBOOT to Normal Mode.

Let me know how things are running now

Post a fresh HijackThis log, a fresh newfiles log and a fresh activescan log.

 

Hi thanks for that

I have followed your instructions and all of the files you said to remove in the last step were not there so I assume that killbox removed them.

The PC runs OK in safe mode but when I boot to normal mode it displays the MS error that the system has recovered from a serious error, loads all startup processes then reboots if I click "don't send".

 

Did it do this before you posted here? Or is it the result of the fix I just wrote for you?

 

Hi

Not until I installed Windows Defender, I have updated the BIOS and tried to run the update for Defender and Norton Internet Security blocks it. If I disable the Security Defender goes off to get the updates then the PC crashes.

 

Oh and Defender reported 2 more infections this morning but couldn't deal with them.

 

discovered that this is a video driver issue, do the logs look OK now?

 

This file is still on your system. Try using Pocket Killbox to delete it again

Also try fixing this line again, Im pretty sure the service has gone but HJT doesn't seem to have fixed it, if its still there after we will need to manually remove it.

 

Sorry for taking so long to reply, everything is sorted out now. Thanks very much for your help.

 

No problem, if your sure everything is working ok no then you should have a look at this link:

How to Protect yourself from malware!