Viruses and Adware Help!

So I followed all your instructions on the "Do this stuff first" page. I now have logs that I can post from Hijackthis, Runkey, NewFiles, and Activescan.

Everything seems to have been eliminated by use of Norton, Spyware Doctor and the programs you recommended here. However there is still at least one adware that I can't get rid of that none of these programs can detect. It's a fake Spyware hunter that looks like a windows program called Spyware Detection Alert. It puts itself in my icon tray and tells me I have infections and sports the Windows logo. I can't find it on my computer to delete it. This also makes me afraid that there are still others hiding in my system that can't be found.

I know I had several viruses that seemed to have been removed. I had "Trojan.Busky" which seems to be gone finally. I also had Trojan.downloader.small.CMS or something like that which also seems to be gone. I am afraid to plug my computer back into the net because it kept getting around all my protection and downloading a bunch of crap I had to re-remove.

Right now I am operating off my mac laptop and transferring dowloaded files from it to my PC in order to keep any dowloaders offline.

I have uploaded all my logs except for NewFiles because for some reason it is 608KB which is larger than the max file you allow. IF you need this file, please let me know how you'de like me to give it to you.

Thanks so much for your help. Help me get these files of my comp.

 

My system specs are:
Pentium 3.2 G
1G Ram
OS Windows XP SP2
250G Seagate HD

 

You need to rename and relocate Hijack This before we can continue.

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

 

Here is the new Hijack this logfile run as analyze.exe.

Thanks for your help.

- Mike

 

Please see the below thread on how to install and run VundoFix.

• Virtumonde aka Trojan Vundo Fix w/ Tool ...

Once you complete the above thread, attach the log from the scan and a fresh HJT log.

 

Here are the new files. The Vundo text file and a new Hijack this log run as analyze.exe.

 

Scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/ search/search.html

R3 - Default URLSearchHook is missing

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {25FB9D12-FC30-4029-8820-57E2BAAE2EE3} - C:\WINDOWS\system32\ddcyv.dll (file missing)
O2 - BHO: (no name) - {37F953EA-64CC-DB0B-2854-07E88BBBDAFF} - C:\WINDOWS\system32\xrglcod.dll (file missing)
O2 - BHO: (no name) - {7170FA06-487B-8534-D904-059EE824BA72} - C:\WINDOWS\system32\pfgdolk.dll (file missing)

O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvwok.dll,startup

O9 - Extra button: (no name) - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm (file missing) (HKCU)

Again, make sure ALL browser windows are closed when you click FIX.

Next, run CCleaner to clean up cookies and temp files.

FINAL STEP

Reset Web Settings & Default Security Settings:

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After you complete this post, reboot and attach a fresh HJT log.

 

TaDa. It's done. Here is the newest Hijack this log. Still run as analyze.exe

 

Your log looks good, are you having any current problems?

 

I've plugged my computer back into the net and there doesn't seem to be anything wrong with it anymore. Thanks so much for your help. Never would have known how to do that stuff without you.

Very Appreciated.

Much Love,
Mike

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!