Spyware Removal Uncertain?! Help... :)

Discussion in 'Malware Help (A Specialist Will Reply)' started by farahly, Jul 14, 2007.

  1. farahly

    farahly Private E-2

    Hello all! I got infected when I clicked on a link while browsing through Wiki about some Italian sculptor! :( My computer immediately popped something up & said I was infected & started running my Anti-virus scan. I ran Spybot Search&Destroy afterwards & it notified me that I have been infected by a spyware called Torpig & it hid 2 keyloggers in my Temp folder with the following names: $_2341233.TMP & $_2341234.TMP. I disconnected from the internet & ran to this forum for help! You guys have done an amazing job in helping others out; I truly am amazed by your efforts! Thank you. :)

    I followed ALL of the Read & Run Me First Thread's Instruction. But when I did the Counterspy scan in Safe Mode, I did not see anywhere that said I could view the history. Perhaps because everything was oversized in Safe Mode... but either way, I couldn't get the log to Counterspy? :( I hope this won't severely affect anything. Also, when I unzipped GetRunBat.zip, BEFORE all the scans,... I believe I accidentally double-clicked the .bat file & didn't wait until all the other instructions. I believe I mixed my instructions up at that point, so I quickly closed it. Hopefully it didn't cause any errors?

    Another matter was, Bitdefender WOULD NOT run. It said there was an error and so it couldn't run it. So I followed the instructions to move on to Panda ActiveScan. The first time I scanned it, I accidentally scanned my My Computer & it noted that it detected TWO spyware threats... but I apparently didn't follow instructions & was supposed to scan the Local Disks instead, so I ran the scan again in Local Disks, but this time, it said it only found ONE spyware threat... I am not sure what difference this makes, but I made sure I saved both scan logs. :)

    Here they are, I just hope that my computer is safe again b/c I am not fully certain if it is? Thank you so much again all! :)

    NOTE:
    The Activescan.txt is using Panda ActiveScan scanning "Local Disks"
    The Activescan1.txt is using Panda ActiveScan scanning "My Computer"
     

    Attached Files:

    farahly, Jul 14, 2007
    #1
  2. farahly

    farahly Private E-2

    Here is the .txt from the ShowNew.bat scan & my HiJackThis! log. :) Thank you again! :)
     

    Attached Files:

    Last edited: Jul 14, 2007
    farahly, Jul 14, 2007
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download DelCmdService, and save it to your Desktop.

    * Unzip the content to your Desktop (a folder named delcmdservice)
    * Double-click on the delcmdservice folder
    * Double-click on delreg.bat to launch the tool
    * When the tool has finished, please reboot your computer

    Attach a new RunKeys, ShowNew and HJT log.
     
    TimW, Jul 14, 2007
    #3
  4. farahly

    farahly Private E-2

    Thank you for the further assistance TimW! :) Here are my new logs.
     

    Attached Files:

    farahly, Jul 14, 2007
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do you know what this is? If not have HJT fix it.
    O16 - DPF: {462B59A7-6399-4A22-B94A-B53D585AA832} (SdjbDetector Class) - http://moocs.com/sdjbinstall/SDJB_Detector.cab

    Otherwise....Your logs look clean. You may uninstall any programs we had you download (including Counterspy).

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used Pocket Killbox during your cleanup, do the below
    * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
    * go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
    * How to Protect yourself from malware!
     
    TimW, Jul 14, 2007
    #5
  6. farahly

    farahly Private E-2

    Yay! Thanks so much TimW! I didn't know what it was so I went ahead & removed it. Thanks for all the help everyone... it's hard surviving on such a dingy PC, lol. G'day! :)
     
    farahly, Jul 14, 2007
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No problem....safe surfing.;)
     
    TimW, Jul 14, 2007
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds