In-laws Computer Loaded W/spyware

Hoping you can help, and let me just apologize for my computer ignorance up front. My inlaws have a major problem w/pop up ads (spyware?) and several folders added to favorites and taskbar. I loaded Ad-aware and Spy Bot and did scan. Lots of things found…ad aware found LOTS and could not remove all. I'm not currently at their computer but hope to help them again later this week. Assistance would be GREATLY appreciated! PS - not sure if the problem may have been w/McAfee expiration…several of their protections are showing very low.

Hi seatangl.

I'm 'KotaGuy and I am going to see if I can help you with this situation.

When you get the chance to work on the infected computer again, this is what I would like you to do.

I would like you to do a few online scans for me. Please do scans at TrendMicro Housecall, eTrust AntiVirus Web Scanner, and Windows Security Trojan Scan.

Let them fix anything they find, rebooting between each scan. Please note, and let me know about, anything the online scans found and could not fix.

Next, download and install Ad-Aware and Spybot S&D. Visit this page for proper configuration. Run and scan with both, letting them fix whatever they find. Remember to reboot between each scan.

Now download HijackThis. Extract it to its own folder(eg: C:\Program Files\HJT\HijackThis.exe). This is extremely important! HijackThis creates backup files and cannot do that if run from inside a Temp folder, zip/rar archive, CD, etc. Please make sure it is in its own folder.

Run and scan with HijackThis, DON'T FIX ANYTHING YET!!! Copy and paste the log into a reply here.

Thanks for your help KotaGuy! Hope that I'm getting this reply posted in the right place. I ran the following as requested: (1) TrendMicro Housecall Found 12 Viruses. All were listed as "non-cleanable". As best I can tell, all were addressed somehow with the exception of 3 C:\WINDOWS/SYSTEM32\picvr\psvr.exe C:\WINDOWS/SYSTEM32\expcfgx(3).exe C:\WINDOWS/SYSTEM32\gidihost.exe …said, "unable to clean because currently in use"… (2) AntiVirus Web Scanner Unable to run, prompt "Starting signature update. Please wait … Connecting to FTP server:" never cleared allowing for scan (3) Windows Security Trojan Scan- ok (4) Ad-Aware Found objects - received prompt that said, "Some objects could not be removed c:\WINDOWS\SYSTEM32\n?lookup.exe (5) Spybot S&D Ran, objects found/deleted ok I wasn't successful in downloading Hijackthis. I created a separate folder in c:\Program Files\HJT, but couldn't open and kept receiving a message from McAfee stating "Virus Detected" c:\Program Files\HJT\hijackthis.zip. I'll wait to hear what you suggest next. Again, thanks so much for your help and patience w/my lack of computer savvy!!!!

Do one more online scan for me please, Panda ActiveScan. Again, note anything that could not be cleaned.

Download and run CWShredder. Press Fix.

Download and run Stinger.

Try downloading HJT from here.

See if you can run HijackThis. If you can, post a log please, if not, let me know.

Morning KotaGuy… Ran the (1) Panda ActiveScan, found 54 infceted files. Copy of report below: Incident Status Location Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\System32\nsvsvc\nsvsvc.exe Virus:Bck/Agent.KO No disinfected Operating system Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\gdihost.exe Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\expcfgx(3).exe Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Len Weikum\Application Data\eetu.exe Adware:Adware/Hotbar No disinfected C:\Program Files\ShopperReports\Bin\1.0.4.0\ShprRprt.dll Adware:Adware/eZula No disinfected C:\WINDOWS\system32\sysfile.dll Adware:Adware/SaveNow No disinfected C:\DOCUME~1\LENWEI~1\LOCALS~1\Temp\vmstmp\vmstmp.exe Adware:Adware/nCase No disinfected Windows Registry Adware:Adware/Hotbar No disinfected C:\Documents and Settings\Len Weikum\Application Data\ShopperReports Adware:Adware/Apropos No disinfected C:\Program Files\cxtpls Adware:Adware/SideSearch No disinfected C:\Program Files\sep Adware:Adware/IPInsight No disinfected C:\WINDOWS\farmmext.ini Adware:Adware/WUpd No disinfected C:\WINDOWS\Downloaded Program Files\PrevAdX.dll Adware:Adware/BroadcastPC No disinfected Windows Registry Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Len Weikum\Application Data\eetu.exe Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\!update.exe Adware:Adware/nCase No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\Del66.tmp Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\i20.tmp Virus:Trj/Multidropper.QW Disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\RAZR.exe Adware:Adware/DelFinMedia No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\rm05040901.Stub.exe Adware:Adware/SideSearch No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\SEPInst.exe Adware:Adware/Apropos No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\temp.fr19A5 Adware:Adware/WUpd No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\temp.fr4CEA Adware:Adware/Apropos No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\temp.frA581 Virus:Trj/Startpage.FE Disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\twc\installer\bin\AddFavorites.vbs Virus:Trj/Downloader.BBB Disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\vmstmp\vmstmp.exe Virus:Trj/Bhotcher.A Disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temp\WBCM_Installer.exe Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Len Weikum\Local Settings\Temporary Internet Files\Content.IE5\EYDU4Q93\!update-1784[1].0000 Adware:Adware/Envolo No disinfected C:\Documents and Settings\Nonie Weikum\Local Settings\Temp\AutoUpdate0\setup.inf Adware:Adware/Minibug No disinfected C:\Program Files\AIM\Sysfiles\WxBug.EXE Adware:Adware/Minibug No disinfected C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll Adware:Adware/BroadcastPC No disinfected C:\Program Files\bpc_search\bpc2_re_inst.exe Adware:Adware/BroadcastPC No disinfected C:\Program Files\bpc_search\bpcv2_rem.exe Adware:Adware/BroadcastPC No disinfected C:\Program Files\Common Files\Java\bpc2_re_inst.exe Adware:Adware/BroadcastPC No disinfected C:\Program Files\Common Files\Java\bpt.cfg Adware:Adware/BroadcastPC No disinfected C:\Program Files\Common Files\Java\bptre.exe Adware:Adware/DelFinMedia No disinfected C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe Adware:Adware/WUpd No disinfected C:\Program Files\Preview AdService\PrevAdKeep.exe Adware:Adware/Hotbar No disinfected C:\Program Files\ShopperReports\Bin\1.0.4.0\ShprRprt.dll Adware:Adware/Hotbar No disinfected C:\Program Files\SpamBlockerUtility\bin\4.6.1.0\Contact.dll Adware:Adware/Hotbar No disinfected C:\Program Files\SpamBlockerUtility\bin\4.6.1.0\SbWallpaper.dll Virus:Trj/Tofger.AT No disinfected C:\WINDOWS\cerbmod.dll Adware:Adware/Hotbar No disinfected C:\WINDOWS\Downloaded Program Files\HbInstIE.dll Adware:Adware/WinAD No disinfected C:\WINDOWS\Downloaded Program Files\PrevAdX.dll Adware:Adware/Transponder No disinfected C:\WINDOWS\INF\Pynix.inf Virus:Trj/Imiserv.D Disinfected C:\WINDOWS\systb.exe Adware:Adware/SAHAgent No disinfected C:\WINDOWS\SYSTEM32\bln02nqv.exe Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\SYSTEM32\delfin.dll Adware:Adware/Apropos No disinfected C:\WINDOWS\SYSTEM32\expcfgx(3).exe Adware:Adware/Apropos No disinfected C:\WINDOWS\SYSTEM32\gdihost.exe Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\SYSTEM32\nsvsvc\nsv.ocx Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\SYSTEM32\nsvsvc\nsvsvc.exe Virus:Bck/Agent.KO Disinfected C:\WINDOWS\SYSTEM32\picsvr\picsvr.exe Adware:Adware/BroadcastPC No disinfected C:\WINDOWS\Temp\bpc_inst.exe (2) downloaded/ran CWShredder…no CoolWeb Search found (woo hoo!!!!!) (3) downloaded/ran Stinger…said # of clean files: 106063 (4) attempted to download/run HijackThis…still detects as virus. Thanks for continued help!

Hmmm. I'm confsued as to why Mcafee keeps detecting HJT as a virus You mentioned their virus protections were out of date… how old is the installation of Mcafee? Is the program itself a few years old? Try something for me… disable Mcafee or uninstall it… doesnt much matter now as the computer has many infections. If its an older version of the product, it would be best to uninstall it anyways as the scanning engine would be old and unable to catch most of the newer strains of virus/malware. If you have to uninstall it, don't worry, I'll point you in the direction to a few good free scanners. Once Mcafee is disabled/uninstalled, try running HijackThis. If you can, post a log, if not… let me know!

Excellent! Got something I can work with now Still strange that Mcafee detected HJT as a virus… how old is the Mcafee installation anyways? As I said… if it's old, you should uninstall it as the scanning engine is outdated. Anyways… this is going to take a little bit for me to go through a formulate a fix for you. Lots of nasty stuff in the log. Will reply as soon as I can!

KotaGuy, My in-laws got their computer about a year ago (probably March or April of last year) so the McAfee would have been loaded around that time. Think it was done online. When all this mess first started I looked at the McAfee and it showed the virus stuff had expired. I downloaded the free 30-day McAfee trial thinking that it would help protect in the interim. Thanks SOOOOOOOOO much for all of your help! ")

Nice…. looking lots better. You're doing great! How is the computer running?

But remember…

C:\Documents and Settings\\Local Settings\Temporary Internet Files\Content.IE5\P8S9CUO9\HijackThis[1].exe

Don't run HijackThis from a Temp directory… please run it from its own folder, that way it can create the backups it needs.

With that said…

Scan with HijackThis, with all browsers and windows closed, place a check beside the following and Fix:

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Also, I missed something from your last log… search for and delete:

C:\WINDOWS\SYSTEM32\notepad.exe

NOTE!!: When doing this search, you may find an entry for C:\WINDOWS\NOTEPAD.exe. Do NOT delete that copy… it is legit. Delete only the copy found in C:\WINDOWS\SYSTEM32\notepad.exe.

Reboot, scan with HijackThis and post a new log please.

Good Work! That is a CLEAN log!

Now, reset your System Restore Points. This will ensure a clean backup to roll back to if needed. To do this:

1. Right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Check the "Turn off System Restore" or "Turn off System Restore on all drives"

Reboot your computer, follow the steps above, this time unchecking the "Turn off System Restore" and reboot.

Now… about the AntiVirus situation…. if they aren't going keep their susbscriptions up to date, Mcafee is probably not the best solution as this will happen again. I would go with a free solution. Try AVG AntiVirus Free Ed.. Install it, update it, do a full system scan, let it clean anything it finds. With the amount of stuff that had infected this machine, there may be remnants left that haven't been totally cleaned yet. You may want to do one or two of the previous online scans as well, just in case. If you go with AVG(it is a very good AntiVirus program), uninstall Mcafee as you may get conflicts between the two. That or disable Mcafee's resident(always active) AV scanner.

If you do uninstall Mcafee, you will probably lose the Firewall protection. In this case, download and install the free version of ZoneAlarm.

I also recommend downloading and installing SpywareBlaster, SpywareGuard, and IE-SPYAD. All the programs are free and can be updated so remember to do so! You can grab the programs from the links in my sig. Installing these will go a long way in preventing this from happening again. It is, of course, no guarantee

You may also want to visit the links named "Understanding Spyware" and "How did I get Infected?", some good information for you.

Other than that… remember to update Windows Components, your protection programs, scan often, and…

Surf Safe!

THANK YOU KOTAGUY!!!! Can't tell you how much I appreciate your expertise and patience (not to mention you made me look like a hero to my inlaws…that can't hurt ") You and TomCoyote Forums are invaluable!!! I'll get w/my inlaws and try to figure out the best way to procede w/antivirus protection. Seatangl ")