What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Virus That Will Not Go Away!

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

I still get a lot of little spy ware bugs when I scan every day


Can you please give me the details of your latest scan. What bugs, which scanner? Please post the detailed report.
Post #17
I have CA anti virus and spyware on my computer right now. The virus that I still get pop ups about it being quarantined is called " Win32/VMalum" sometimes it ends in .BAT .JSS or .KLE the spyware I trashed, but they are (well CA says anyway) low level tracking cookies Im not sure what to post, but here is my "real time scanner log" 5/24/2007 6:04:52 AM File infection: C:\Documents and Settings\Liz\Incomplete\T-202477-Manga Studio EX v3.0 Full + 3CD + Serial No + WEBSEED.zip is Win32/Alcan.I worm. Deleted 5/24/2007 6:04:52 AM File infection: C:\Documents and Settings\Liz\Incomplete\T-202477-Manga Studio EX v3.0 Full + 3CD + Serial No + WEBSEED.zip is Win32/Alcan.I worm. 8/28/2007 4:46:08 AM File infection: C:\Documents and Settings\Liz\Local Settings\Temporary Internet Files\Content.IE5\8T4O6MIW\index[4].htm is JS/MS06-014!exploit trojan. 8/28/2007 4:47:13 AM File infection: C:\Documents and Settings\Liz\Local Settings\Temporary Internet Files\Content.IE5\8T4O6MIW\index[4].htm is JS/MS06-014!exploit trojan. Deleted 9/3/2007 4:58:34 AM File infection: C:\Documents and Settings\Liz\Desktop\din dash\keygen.exe is Win32/Harnig!generic trojan. Quarantined 9/3/2007 4:58:34 AM File infection: C:\Documents and Settings\Liz\Desktop\din dash\install.exe is Win32/VMalum.ISR infection. Quarantined 9/3/2007 4:58:36 AM File infection: C:\WINDOWS\system32\ssqpmjg.dll is Win32/Vundo!generic trojan. Deleted 9/3/2007 4:58:36 AM File infection: C:\WINDOWS\system32\ssqpmjg.dll is Win32/Vundo!generic trojan. 9/3/2007 4:58:36 AM File infection: C:\WINDOWS\system32\ssqpmjg.dll is Win32/Vundo!generic trojan. 9/3/2007 4:58:36 AM File infection: C:\WINDOWS\system32\ssqpmjg.dll is Win32/Vundo!generic trojan. 9/3/2007 4:58:39 AM File infection: C:\Documents and Settings\Liz\Local Settings\Temporary Internet Files\Content.IE5\28PCGJ7Y\xc23[1].exe is Win32/Kastem.AG trojan. Deleted 9/3/2007 4:58:39 AM File infection: C:\DOCUME~1\Liz\LOCALS~1\Temp\winE88.tmp is Win32/Kastem.AG trojan. Deleted 9/3/2007 4:58:39 AM File infection: C:\DOCUME~1\Liz\LOCALS~1\Temp\winE88.tmp is Win32/Kastem.AG trojan. 9/3/2007 5:00:10 AM File infection: C:\WINDOWS\system32\rqrqnno.dll is Win32/Vundo!generic trojan. Deleted 9/3/2007 5:00:10 AM File infection: C:\WINDOWS\system32\rqrqnno.dll is Win32/Vundo!generic trojan. 9/3/2007 5:00:10 AM File infection: C:\WINDOWS\system32\rqrqnno.dll is Win32/Vundo!generic trojan. 9/3/2007 5:00:10 AM File infection: C:\WINDOWS\system32\rqrqnno.dll is Win32/Vundo!generic trojan. 9/3/2007 5:00:16 AM File infection: C:\Program Files\Common Files\Yazzle1162OinAdmin.exe is Win32/Clspring.GZ trojan. Quarantined 9/3/2007 5:00:16 AM File infection: C:\Program Files\Common Files\Yazzle1162OinAdmin.exe is Win32/Clspring.GZ trojan. 9/3/2007 5:00:16 AM File infection: C:\Program Files\Common Files\Yazzle1162OinAdmin.exe is Win32/Clspring.GZ trojan. 9/3/2003 5:00:21 AM File infection: C:\WINDOWS\system32\nusrmgr.exe is Win32/Vapidab.C trojan. Quarantined 9/3/2003 5:00:24 AM File infection: C:\WINDOWS\system32\nusrmgr.exe is Win32/Vapidab.C trojan. Quarantined 9/3/2003 5:00:26 AM File infection: C:\WINDOWS\system32\nusrmgr.exe is Win32/Vapidab.C trojan. Quarantined 9/3/2007 8:05:50 AM File infection: C:\WINDOWS\TEMP\win3B.tmp is Win32/Kastem.AG trojan. Deleted 9/3/2007 8:05:50 AM File infection: C:\WINDOWS\TEMP\win3B.tmp is Win32/Kastem.AG trojan. 9/3/2007 8:05:51 AM File infection: C:\WINDOWS\TEMP\win3B.tmp is Win32/Kastem.AG trojan. 9/3/2007 8:05:51 AM File infection: C:\WINDOWS\TEMP\win3B.tmp is Win32/Kastem.AG trojan. 9/3/2007 8:05:52 AM File infection: C:\WINDOWS\TEMP\win3B.tmp is Win32/Kastem.AG trojan. 9/3/2007 8:07:13 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. Quarantined 9/3/2007 8:07:14 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. 9/3/2007 8:07:14 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. 9/3/2007 8:07:14 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. 9/3/2007 8:07:14 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. 9/3/2007 8:07:14 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. 9/3/2007 8:07:14 AM File infection: C:\WINDOWS\system32\urqnmkh.dll is Win32/Vundo!generic trojan. 9/3/2007 11:13:34 AM File infection: C:\Documents and Settings\Liz\Local Settings\Temporary Internet Files\Content.IE5\8DE66GRJ\xc23[1].exe is Win32/Kastem.AG trojan. 9/3/2007 11:13:35 AM File infection: C:\Documents and Settings\Liz\Local Settings\Temporary Internet Files\Content.IE5\8DE66GRJ\xc23[1].exe is Win32/Kastem.AG trojan. 9/3/2007 12:22:06 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. Deleted 9/3/2007 12:22:06 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:06 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:06 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/3/2007 12:22:07 PM File infection: C:\WINDOWS\system32\rqrrqpq.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:21 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. Deleted 9/4/2007 0:58:22 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:22 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:22 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:22 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:22 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:23 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:23 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:23 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:23 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 0:58:23 AM File infection: C:\WINDOWS\system32\xxyvtuu.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:32 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. Deleted 9/4/2007 1:34:33 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:33 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:34 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:34:35 AM File infection: C:\WINDOWS\system32\hggdcbx.dll is Win32/Vundo!generic trojan. 9/4/2007 1:50:56 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. Deleted 9/4/2007 1:50:56 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. 9/4/2007 1:50:56 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. 9/4/2007 1:50:56 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. 9/4/2007 1:50:56 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. 9/4/2007 1:50:56 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. 9/4/2007 1:50:57 AM File infection: C:\WINDOWS\system32\ljjgeee.dll is Win32/Vundo!generic trojan. 9/4/2007 4:30:21 AM File infection: C:\Documents and Settings\Liz\Incomplete\T-202477-Cake Mania 1.0.zip is Win32/Alcan.I worm. Deleted 9/4/2007 4:30:21 AM File infection: C:\Documents and Settings\Liz\Incomplete\T-202477-Cake Mania 1.0.zip is Win32/Alcan.I worm. 9/4/2007 4:30:51 AM File infection: C:\Documents and Settings\Liz\Incomplete\T-202477-Cake Mania 1.0.zip is Win32/Alcan.I worm. Deleted 9/4/2007 4:30:51 AM File infection: C:\Documents and Settings\Liz\Incomplete\T-202477-Cake Mania 1.0.zip is Win32/Alcan.I worm. 9/4/2007 11:50:33 AM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP120\A0008850.exe is Win32/Kastem.AI trojan. Deleted 9/4/2007 14:40:50 PM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP120\A0008851.exe is Win32/VMalum.BAT infection. Quarantined 9/9/2007 21:43:24 PM File infection: C:\Documents and Settings\Liz\Incomplete\T-233472-Wedding Dash.exe is Win32/Alcan.J worm. Deleted 9/9/2007 21:43:24 PM File infection: C:\Documents and Settings\Liz\Incomplete\T-233472-Wedding Dash.exe is Win32/Alcan.J worm. 9/9/2007 21:49:29 PM File infection: C:\Documents and Settings\Liz\Incomplete\T-202476-PC- Wedding Dash + Fever Frenzy.zip is Win32/Alcan.I worm. Deleted 9/9/2007 21:49:29 PM File infection: C:\Documents and Settings\Liz\Incomplete\T-202476-PC- Wedding Dash + Fever Frenzy.zip is Win32/Alcan.I worm. 9/10/2007 9:11:22 AM File infection: C:\qoobox\Quarantine\C\WINDOWS\system32\drvcak.dll.vir is Win32/VMalum.JSS infection. Quarantined 9/10/2007 9:11:22 AM File infection: C:\qoobox\Quarantine\C\WINDOWS\system32\drvleb.dll.vir is Win32/VMalum.JSS infection. Quarantined 9/10/2007 9:11:22 AM File infection: C:\qoobox\Quarantine\C\WINDOWS\system32\drvtax.dll.vir is Win32/VMalum.JSS infection. Quarantined 9/10/2007 9:12:26 AM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP125\A0009439.dll is Win32/VMalum.JSS infection. Quarantined 9/10/2007 9:12:26 AM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP125\A0009442.dll is Win32/VMalum.JSS infection. Quarantined 9/10/2007 9:12:26 AM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP125\A0009444.dll is Win32/VMalum.JSS infection. Quarantined 9/12/2007 15:08:46 PM File infection: C:\qoobox\Quarantine\C\WINDOWS\system32\drvhor.dll.vir is Win32/VMalum.KLE infection. Quarantined 9/12/2007 15:08:46 PM File infection: C:\qoobox\Quarantine\C\WINDOWS\system32\drvxaf.dll.vir is Win32/VMalum.KLE infection. Quarantined 9/12/2007 15:09:49 PM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP125\A0009435.dll is Win32/VMalum.KLE infection. Quarantined 9/12/2007 15:09:50 PM File infection: C:\System Volume Information\_restore{3C2A2416-5396-450A-9B8A-FCBD1C252F85}\RP125\A0009437.dll is Win32/VMalum.KLE infection. Quarantined
Post #18
Hi,

Did you carry out the instructions in post #14? I think CA report was reporting the same items. Please make sure that you carry out the instructions in post #14 first. Also delete the Smitfraudfix from your desktop, if you haven't already. Then, empy the recycle bin.

You might like to print the following instructions so that you can have access to them while you're in Safe Mode later.

=============================

Please download Ccleaner and save it to your desktop.
Tutorial for CCleaner
Do not scan with it yet.

=============================
  • Please download AVG Anti-Spyware and save it to your desktop.
  • Double click on avgas-setup-7.5.1.36.exe to install AVG Anti-Spyware. Install it in the default location.
  • Once installed, start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  • In the main screen, you should see Your Computer's Security.
    • Next to Resident Shield, click on Change state. It should now be Inactive.
    • Next to Automatic Updates, click on Change state. It should now be Inactive.
    • Next to Last Update, click on Update now. Should you be unable to update it, download the updates from here. Save it to your desktop. Double click to run the installation and the updates will be installed. Make sure AVG Anti-Spyware is closed during the installation.
    • Right-click the AVG Anti-Spyware icon near the clock and uncheck (untick) Start with Windows. Confirm by clicking Yes.
  • Now click on the Scanner button at the top.
  • Select the Settings tab.
  • Under How to act?, click on Recommended actions and select Quarantine.
  • Under How to scan?, check (tick) all the boxes.
  • Under Possibly unwanted software:, check (tick) all the boxes.
  • Under Reports, select Do not automatically generate reports and uncheck (untick) the Only if threats were found box.
  • Under What to scan?, select Scan every file.
Do not run a scan yet.

===============================

Reboot your computer in Safe Mode using the F8 method below.
a. If the computer is running, shut down Windows, and then turn off the power.
b. Wait 30 seconds, and then turn the computer on.
c. Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
d. Ensure that the Safe Mode option is selected.
e. Press Enter. The computer then begins to start in Safe mode.

================================

From Safe Mode run Ccleaner
  • Click on Options,
  • Select Advanced
  • Now UNCHECK "Only delete files in Windows Temp folders older than 48 hours"
  • Make sure the Cleaner block on the left is selected.
  • Do not use the "Registry" block . It's meant for professionals.
  • Choose the Windows tab.
  • Check everything EXCEPT Advanced part of the Menu.
  • Click on "Analyze". This process could take a while.
  • If you don't want to loose your login passwords to certain sites, click on Options
  • Select cookies and move the ones you want to keep to the "cookies to keep" section, by highlighting and using the arrows in the middle.
  • Choose Run Cleaner.
When CCleaner shows how much has been removed, cleaning is finished. Click Exit.

========================================

Still in Safe Mode:
  • Go to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  • Click on the Scanner button at the top.
  • Select the Scan tab.
  • Click on Complete System Scan to start the scan.
  • When the scan has finished, follow the instructions below.
    IMPORTANT: Don't click on the Save Scan Report button before you did hit the Apply all Actions button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      [external image: Posted Image]
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
==========================================

Restart your computer in Normal Mode.

==========================================

Scan with HijackThis and save the log.

==========================================

Please post back the AVG Anti Spyware log and the fresh HijackThis log.
Post #19
Hello again :) yes I did step 14, still have to empty the bin though. I'll do the steps you posted just now, just wanted to give you a heads up that I will be away for a week or so on work and may not be able to do this step before I fly out. If you can hold off closing this thread I will be back! :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI