What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

First Time User

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi there all,

please find logfile below

problems began on 11/11/04 shortly after down loading an update to my ZoneAlarm firewall. Note I had been rxg requests for auto update to ZA for a couple of days but couldnt naage to auto download. On the 11/11 I decided to take the ZA firewall down and download froma specified ZA site. This downlaod seemed to work ok, after installing and rebooting I started getting unusual files in the C:\windows\system32 or …. \bnrth dirs. requesting internet access including :-
beird.exe
wshield (H4x0rbt0t 2.0 lame stuff) ??
wupdat32x.exe
cdaccess
I also got between two and three error message from repcale.exe during start up (after GUI running) indicating a specified command could not be run.

There is also a continious "flashing timer (hourglass)" next to my cursor.

I am running XP home edition 2002, 256M AMD 180+, I usually use Netscape Navigator 7.1 (but used IE for the above down load. I also use Avast virus s/w which produced the following "Warning file" at the time of my problems

Any help greatly appreciated

JABER

AVAST Warning file

11/11/2004 19:48:09 KELLY-AJ11I28VX\kelly 3592 aswChestInterface - Program error description: CChestListView::OnDropFiles() - User can drop files into USER section only..
11/11/2004 17:41:44 NT AUTHORITY\SYSTEM 1412 Sign of "Win32:LowZones-C [Trj]" has been found in "C:\WINDOWS\System32\iel.exe" file.
11/11/2004 17:43:41 NT AUTHORITY\SYSTEM 1412 Sign of "Win32:Trojan-gen. {UPX!}" has been found in "C:\WINDOWS\System32\bntrth\cult.exe" file.
11/11/2004 17:44:11 NT AUTHORITY\SYSTEM 1412 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\System32\bntrth\ymnz.exe" file. Logfile of HijackThis v1.98.2
Scan saved at 18:56:01, on 14/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\NILaunch.exe
C:\Program Files\Caere\OmniPagePro90\opware32.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Program Files\Oxigen\bin\Oxigen.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\System32\cdaccess.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
c:\windows\system32\bntrth\beird.exe
C:\Program Files\FreeRAM\FreeRAM XP Pro 1.40.exe
C:\PROGRA~1\NETSCAPE\NETSCA~1\NETSCP.EXE
c:\windows\system32\bntrth\wshield.exe
C:\lotus\organize\easyclip.exe
C:\lotus\smartctr\suitest.exe
C:\Program Files\ONSPEED\onspeed.exe
C:\WINDOWS\System32\wupdt32x.exe
C:\WINDOWS\System32\svdll32.exe
C:\lotus\wordpro\wordpro.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.co-operativebank.co.uk/"); (C:\Program Files\Netscape\Communicator\Users\ntlworld\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ONSPEED\PBHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Net-It Launcher] C:\WINDOWS\System32\NILaunch.exe
O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [OxigenClientAdmin] C:\Program Files\Oxigen\bin\Oxigen.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [Auto CD-ROM Startup] cdaccess.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] wupdt32x.exe
O4 - HKLM\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKLM\..\RunServices: [Auto CD-ROM Startup] cdaccess.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] wupdt32x.exe
O4 - HKLM\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\FreeRAM\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\NETSCAPE\NETSCA~1\NETSCP.EXE" -turbo
O4 - HKCU\..\Run: [Auto CD-ROM Startup] cdaccess.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] wupdt32x.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKCU\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Startup: ONSPEED.lnk = C:\Program Files\ONSPEED\onspeed.exe
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O15 - Trusted Zone: http://www.ntlworld.com
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.command2.co.uk/cod_ev/cabs/cssweb.cab
Post #2
hello,

i would limit my time online until its cleand up. print this out or save it to a text file where you can view it.

Make sure your PC is configured to show hidden files

Double click my computers & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
—————————————————————————————————
first turn off system restore:

You must be logged in as an Administrator to do this. If you are not logged in as an Administrator, the System Restore tab will not be displayed.
Turning off System Restore will clear out all previous restore points.
To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives" as shown in this illustration:
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
———————————————————————————————
FIRST; boot into SAFE MODE by tapping f8 key at restart, chose safe mode from the options screen
Next:
now run HJT again
Check the following items in HiJackThis:
Close all open windows except HiJackThis and press 'Fix Checked


O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] wupdt32x.exe
O4 - HKLM\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKLM\..\RunServices: [Auto CD-ROM Startup] cdaccess.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] wupdt32x.exe
O4 - HKLM\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe

O4 - HKCU\..\Run: [Auto CD-ROM Startup] cdaccess.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] wupdt32x.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKCU\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe

now >>> restart computer again back into >>>SAFE MODE


ok once in safe mode bring up taskmgr by hitting ctrl alt delete keys at same time,

if you see any of the above 04 items running, select them then use end task button.

next you have to find and delete these files:

cdaccess.exe>> just this file located here>C:\WINDOWS\System32

>>note, this next one may be a folder if so delete entire folder:
beird.exe>> just this file located here>c:\windows\system32\bntrth\

>>same for next one:
c:\windows\system32\bntrth\wshield.exe

wupdt32x.exe>>delete just this file located here: C:\WINDOWS\System32
svdll32.exe>> delete just this file located here;C:\WINDOWS\System32
————————————————————————————————
still in safe mode
Empty Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

Click Start>Run then type %temp%
Hit OK. Delete all the files you'll see in the folder that will open
———————————————————————————————-
reboot normally and do some online scans at one or two of these:
http://security.symantec.com/sscv6/default…id=ie&venid=sym

http://www.mwti.net/antivirus/free_utilities.asp

http://www.pandasoftware.com/activescan/co…n_principal.htm

http://housecall.trendmicro.com/housecall/start_corp.asp

http://www.bitdefender.com/scan/licence.php

http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
————————————————————————————————–
also get ad aware: http://www.lavasoft.de/
spybot search and destroy: http://security.kolla.de

another good malware remover 15 day trial version only:
http://www.giantcompany.com/%28tnjqh355g3n…9/products.aspx

afterwards post a new HJT log………..shelf life
Post #3
Hi there shelf life etc.

followed your advice, many thanks

JABER

new log file below

every thing went fine, ……… except when I logged onto one of your online scanning site (mwti.net) which scanned and produced the following extract from its log report :-

Mon Nov 15 10:23:17 2004 => Scanning File C:\WINDOWS\System32\mnyz.exe
Mon Nov 15 10:23:35 2004 => File C:\WINDOWS\System32\mnyz.exe infected by "Trojan.Win32.LowZones.d" Virus. Action Taken: No Action Taken.


I also used the trendmicro.com site which did not find any virus???
Any thoughts please?



Logfile of HijackThis v1.98.2
Scan saved at 11:18:34, on 15/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\NILaunch.exe
C:\Program Files\Caere\OmniPagePro90\opware32.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Program Files\Oxigen\bin\Oxigen.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\FreeRAM\FreeRAM XP Pro 1.40.exe
C:\lotus\organize\easyclip.exe
C:\lotus\smartctr\suitest.exe
C:\Program Files\ONSPEED\onspeed.exe
C:\PROGRA~1\NETSCAPE\NETSCA~1\NETSCP.EXE
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.co-operativebank.co.uk/"); (C:\Program Files\Netscape\Communicator\Users\ntlworld\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ONSPEED\PBHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Net-It Launcher] C:\WINDOWS\System32\NILaunch.exe
O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [OxigenClientAdmin] C:\Program Files\Oxigen\bin\Oxigen.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\FreeRAM\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\NETSCAPE\NETSCA~1\NETSCP.EXE" -turbo
O4 - Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Startup: ONSPEED.lnk = C:\Program Files\ONSPEED\onspeed.exe
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O15 - Trusted Zone: http://www.ntlworld.com
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.command2.co.uk/cod_ev/cabs/cssweb.cab
Post #4
hello jamesaber1,

good job, log looks much better. you need to pay a visit to windows update and get all citical updates and patches.

one found virus, one didnt. what i would do is run your resident antivirus (avast) then do another online scan. you can get false postives with these things. you could also browse for the offending file then use the right click context menu and scan it with avast, if avast adds itself to the right click menu.

another option would be to browse for the offending file and have it scanned at one of these;

http://www.ravantivirus.com/scan/indexn.php
http://virusscan.jotti.dhs.org/
http://www.virustotal.com/xhtml/index_en.html

Please follow a few tips to remain malware free:

1) Make sure you keep your Windows OS current by visiting Windows update occasionaly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.
http://v4.windowsupdate.microsoft.com/en/default.asp

Also download, install and keep updated- Antivirus Software (and use only one):
Free for home users:
http://www.avast.com/eng/free_virus_protectio.html
http://free.grisoft.com/freeweb.php/doc/2/
http://www.free-av.com/

2) Watch what you download, and where you download it from. Many programs come bundled with crapware. Make sure you know what it is you will be downloading and installing. Visit the makers website, learn more about the program, read the privacy policy,a link way down at the bottom of the page. Does the program you want come bundled with other "3rd party" programs? What do the 3rd party programs do? Will they deliver ads? Track your surfing habits?.You may be installing more than you think., Stay away from warez and crack sites. Becarful what you download from file sharing networks.If you are not sure, scan it with your Antivirus app. A small file (in KB) is probably not what you think it is.

3)Adjust your browser settings: Change your(active x) settings in IE. With IE open go to tools, internet options, security tab. Click on the internet globe, then custom level. Set the first option "download signed active x controls" to prompt, the next two to disable. Read more: https://netfiles.uiuc.edu/ehowes/www/btw/ie/ie-opts.htm
http://www.microsoft.com/windows/ie/using/…y/settings.mspx
Many exploits are directed at Internet Explorer, you dont have to use it. Try a different browser: http://www.mozilla.org/products/firefox/

4)Install a firewall. A firewall will control what comes in from the internet and what leaves your computer to the internet. A firewall will also alert you when a application trys to connect to the internet from your computer, this is a good way to catch crapware or trojans, trying to connect out bound from your computer- whats that and why does it need a internet connection? You can deny it access it until more investigation is done. Zone Alarm is a free and easy to use firewall, that will provide in and outbound protection. Microsoft XP firewall only provides inbound protection. SP2 adds in and out bound protection which is better than nothing, but is not as robust as third party firewalls, but better than nothing. Be sure to run only >one< firewall.If you use another, be sure to disable XP's built in firewall.
Zone Alarm: http://www.zonelabs.com/store/content/home.jsp
Kerio Personal Firewall: http://www.kerio.com/us/kpf_home.html
Outpost Firewall: http://www.agnitum.com/products/outpost/

5)Download, install and update before using:(if these are constantly finding malware, then you need to make some changes.)
Ad-Aware SE Personal edition: http://www.lavasoft.de/
Spybot Search and destroy: http://www.safer-networking.org/en/index.html
Becarful with spyware "removers and scanners"– there are many "rogue/suspect" programs that "claim to remove" spyware.


6)Other programs to consider:
SpywareBlaster: http://www.bleepingcomputer.com/forums/ind…showtutorial=49
IE-SPYAD: https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD

7) Learn More:
http://www.doxdesk.com/parasite/
http://www.cexx.org/adware.htm
http://www.markusjansson.net/erecent.html
Post #5
Hi Shelf life, thanks for the additional feedback, have already taken some of the steps you suggest including updating Windows, obtaining and running current versions of Spybot and Adware. Will try to check out the iffy file as suggested. I,m a silver surfer and can remember things like "commmand line iterfaces" so perhaps this is a stupid idea but ………. hows about deleting that file? Does anybody know what it is used for anyway? Thanks again for your time, much appreciated from a greatful Limey :) jaber
Post #6
hello jamesaber1, yes the DOS days,command lines,paths,switches etc etc. i remember too. do you mean this file: mnyz.exe i cant find alot of info on it, looks like it could go if you want to delete it, make sure files are set to show and go for it. if it gives you trouble, try booting into safe mode then deleting it. or to be sure you could do another online scan or upload it to one of those links. up to you, i dont think deleteing it would hurt anything though. its located here: C:\WINDOWS\System32 once you feel your computer is clean, then turn system restore back on: Turn ON System Restore.( will make new restore points on a clean system) On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore*. Click Apply, and then click OK, then reboot shelf life
Post #7
Hi shelf life, I think I have a clean machine (for now) :- Win XP SP2 installed with updates etc etc System restore back in operation I looked at the mnyz.exe file again and it had a creation date/time which tied in with the initial virus warning on the 11/11/04 so its been zapped. I have recently gone over to Broadband (512K service) and started using a web based email service so I guess I need to keep my OS and protection up to date. thanks again for your help, I guess this posting is closed now? Jaber
Post #8
hello, last logs looks good. with sp2 you can turn on (or off) automatic updates under the security center, i found it annoying, just be sure to check for updates once in awhile, also since you have zone alarm disable xps built in firewall. happy surfing…….
Post #9
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI