Stubborn SpySheriff

Discussion in 'Malware Help (A Specialist Will Reply)' started by PCDr, Feb 1, 2006.

  1. PCDr

    PCDr Private E-2

    This is my first post. Windows XP with SP2.

    I have a stubborn SpySheriff infection. I have follwed all the steps mentioned in your forum and read me first.

    Here is my HijackThis log.
    I have upoaded this + Pnada active scan + bitdefender scan logs

    My problems: unable to access internet in normal mode only (not in safe mode).
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You also are running both Panda and McAfee AV's. See step three of the READ ME.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure viewing of hidden files is enabled (per the tutorial).
    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O21 - SSODL: ubtlbr - {20C74083-55F4-4EA3-842B-549C5567224F} - ubtlbr.dll (file missing)

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete
    :
    C:\windows\system32\ubtlbr.dll
    C:\WINDOWS\SYSTEM32\vx.tll
    C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
    C:\WINDOWS\uniq
    C:\WINDOWS\inet20004
    C:\Documents and Settings\Venkat\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-133fc29e.zip
    C:\Documents and Settings\Venkat\Desktop\winzipfiles\Jasc_Paint_Shop_Pro_v8[1].10.zip[Crack PSP810 ITA.EXE]

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).


    Now reboot in normal mode and post a new HJT log. And tell us how things are working.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  5. PCDr

    PCDr Private E-2

    Dear Chaslang

    Thanks a lot !!! Problem solved.

    As instructed I did uninstall Panda AV, as I have Mcafee. I followed your instruction about deleting the files in windows explorer. Subsequently I have scanned using Mcafee virus scan, Xoft, Ad ware and seem to be clean.

    I am uploading my final HijackThis log after clearing the mess. Please let me know what else I need to do to complete the process. Also what will your advise for future.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You still have some aspects of Panda installed and running. See the below from your log:
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    Does Panda still appear in Add/Remove programs? If so, uninstall it. Otherwise we will have to use manual steps to remove this.
     
  7. PCDr

    PCDr Private E-2

    I have successfully taken off Panda Titanium. Here is my final HijackThis log.

    What are the next steps?
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds