Please run the following fix (which included the running of AVG AS, then run SpySweeper and if it still finds something, please take down as much information as possible regarding what has been detected:
1.Run AVG AntiSpyware and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"
Select "Automatically generate report after every scan"
Right click the BFU folder on your desktop, and choose Extract All
Click "Next"
In the box to choose where to extract the files to,
Click "Browse"
Click on the + sign next to "My Computer"
Click on "Local Disk (C:) or whatever your primary drive is
Click "Make New Folder"
Type in BFU
Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
3.RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover. Save it in the same folder you made earlier (c:\BFU).
Do not do anything with these yet!
4. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
5.IMPORTANT: Do not open any other windows or programs while AVG AntiSpyware is scanning, it may interfere with the scanning proccess:
Lauch AVG AntiSpyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG AntiSpyware will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your desktop (This is important)
Close AVG AntiSpyware and reboot your system back into Normal Mode.
6. Then, please go to Start > My Computer and navigate to the C:\BFU folder.
Start the Brute Force Uninstaller by doubleclicking BFU.exe
Behind the scriptline to execute field click the folder icon [external image: Posted Image] and select alcanshorty.bfu
Press Execute and let it do it’s job. (You ought to see a progress bar if you did this correctly.)
Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.
Reboot into normal windows and post the contents of AVG AntiSpyware text report that you saved and a new HiJackThis log.
avg anti spyware didnt detect any infections and i couldn't get the log for it. it said a log wasnt available.
Logfile of HijackThis v1.99.1
Scan saved at 4:01:01 PM, on 7/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Name Trojan-BackDoor-CZP
Unique Code 6Z8S0CQT
Type Trojan Horse
Severity Critical
Description
Trojan-BackDoor-CZP is a remote access Trojan that that may allow a hacker to gain unrestricted access to your computer when you are online.
Characteristics
Trojan-BackDoor-CZP may manage files on your computer, including creating, deleting, renaming, viewing, or transferring files to or from your computer. It can utilize a program manager that allows a hacker to install, execute, open, or close programs. The hacker can gain remote control of your cursor and keyboard and can even send mass e-mails from your infected computer. It can run in the background, hiding its presence.
Method of Infection
Trojan-BackDoor-CZP is usually disguised as a harmless software program and is generally distributed as an e-mail attachment. Opening the attachment may cause an auto-installation process that loads the Trojan onto your computer without your knowledge or consent.
Consequences
This Trojan may open a port on your computer that may enable a hacker to gain remote control of your computer. Additional Comments: It is recommended that you change all of your passwords after removing this program. If you bank online, you might consider changing your credit card and bank account numbers. You should also monitor your credit card and bank statements carefully over the next several months for signs of fraudulent activity.
Name Atlas DMT Cookie
Unique Code TARAF
Type Spy Cookie
Severity Low
Description
Atlas DMT Cookie is a cookie that may track the unique visitors to a Web site, as well as their personal preferences.
Characteristics
When you visit Atlas DMT Cookie’s Web site, a cookie may be placed in your Web browser that tracks your personal preferences and Web surfing habits through uniquely identifiable machine information.
Method of Infection
This cookie may be placed on your machine whenever you visit the author’s Web site.
Consequences
Cookies may create a user profile of your personal information for use in targeted advertising by tracking the Web pages visited, the frequency of visits, and personal preferences.
Those were the two things spysweeper found and the description it gave.
Click the button/link to download Blacklight Beta (graphical user interface version)
Save the download to your desktop.
To Run Blacklight
Double-click blbeta.exe
Accept the agreement and click NEXT.
In the following window, click SCAN
You'll see a list of all items found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).
Copy and paste this log in your next reply. Do not proceed with step #2 or choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"
Let us summarize:
1. The two best Antivirus programs (NOD32 and Kaspersky) can't find anything wrong.
2. One of the better anti-trojan/malware scanners (AVG AS) comes up empty.
3. Rootkit scanner does not find anything.
4. ComboFix does not find anything
5. Alcra BFU does not find anything.
The other two see something but can't identify the file. They may be false positives based upon the use of advanced heuristics. That is they are using behavioral patterns to attempt to diagnose potential malware.
Other than that, I am out of ideas.
here's part of the spysweeper log:
9:25 PM: Starting File Sweep
9:25 PM: Warning: SweepDirectories: Cannot find directory "a:". This directory was not added to the list of paths to be scanned.
9:25 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
9:25 PM: c:\documents and settings\andy\cookies\andy@atdmt[2].txt (ID = 2253)
9:25 PM: Found Spy Cookie: atlas dmt cookie
9:24 PM: Starting Cookie Sweep
9:24 PM: Registry Sweep Complete, Elapsed Time:00:00:26
9:24 PM: HKLM\software\classes\clsid\{7621f6d4-b28a-422e-d153-1855c15d59db}\ (ID = 2448960)
9:24 PM: Found Trojan Horse: trojan-backdoor-czp
9:24 PM: Starting Registry Sweep
9:24 PM: Memory Sweep Complete, Elapsed Time: 00:05:24
i don't know if it helps..
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.
Click Erunt.exe to backup your registry to the folder of your choice.
Note: to restore your registry, go to the folder and start ERDNT.exe
2. Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.
3. Locate fixme.reg on your Desktop. It should look like this [external image: Posted Image]. Double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.
4. Restart your computer and run SpySweeper and see if it still picks up traces.
