What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Spyware Virus

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, i'm terrible with computers so thank you for any help

I'll try and explain the problem the best i can. I'm in the UK and have Windows 98


Something keeps popping up saying "Your computer is infected! it is recommened to start spyware cleaner"

I have anti spyware but it's telling me i need to upgrade to Windows 2000 inable for it to work. When i click ok on the pop up it scans and says 6 item detected 5 issue found, i click to remove and it says it will cost x amount. Now being a tight arse i've tried looking for a free one but i've downloaded 3 different cleaners and when it's time to remove the credit card page comes up and my wallet hides.

I don't have a firewall i didn't know what one was untill someone on another forum told me i should download one, he told me to get this

http://www.personalfirewall.comodo.com/

I haven't done that yet i'm waiting to get this sorted first i've trieid several cleaners and nothings gotten rid of the problems. Other things like these keep popping up

"Driver Disk.sys is out of memory"

"System error access violation at address 00000000:00f754d2"

For the memory problem i was told to delete some files, which like an idiot i did and then i started getting problems with my BTYahoo browser.


I'm on BT and use there browser but when i click to be connected to the net all i get is

"BTyahoo broadband unable to connect to the server. please check connection before trying again"

I then try the HUB manager but get this

"We were unable to connect to your hub would you like to launch broadband desktop help"

but then as its loading i get "This has performed an illegal operation and will shut down"

I've had a look to see if theres any wires out or something but there fine and all the lights on the hub are on.

I'm thinking maybe i've deleted something and i should delete all the BT stuff and start the hub again like when i first connected it.

I've tried downloading firefox as a new browser but that came back with

Server not found
Firefox can't find the server at en-gb.start2.mozilla.com.

* Check the address for typing errors such as
ww.example.com instead of
www.example.com

* If you are unable to load any pages, check your computer's network
connection.
* If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web.

I'm not sure what else i can put. So i hope you can help. Log below

——————————————————————————

Logfile of HijackThis v1.99.1
Scan saved at 19:13:29, on 10/09/07
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\BTBB_WCM\MCCITRAYAPP.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE
C:\PROGRAM FILES\BLINK\BLINK.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\BT BROADBAND DESKTOP HELP\SMARTBRIDGE\BTHELPNOTIFIER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\BLINK\BLINK.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\PROGRAM FILES\BT BROADBAND DESKTOP HELP\BIN\MPBTN.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\PROGRAM FILES\YAHOO!\BROWSER\YSIDEBARIEBHO.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRAM FILES\YAHOO!\COMMON\YIESRVC.DLL
O2 - BHO: H - {CC9BC69C-F035-46bc-A67B-353B8BAE61CD} - qwww1m.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTRAY.EXE
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\PROGRAM FILES\BTBB_WCM\MCCITRAYAPP.EXE
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\YAHOO!\BROWSER\ybrwicon.exe
O4 - HKLM\..\Run: [Blink Service] C:\PROGRA~1\BLINK\BLINK.EXE C:\PROGRA~1\BLINK\BLINK.DLL Service
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTBROA~1\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\DEFWATCH.EXE
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\RTVSCN95.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Broadband Desktop Help\bin\matcli.exe
O4 - User Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - User Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Broadband Desktop Help\bin\matcli.exe
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRAM FILES\YAHOO!\COMMON\YIESRVC.DLL
O9 - Extra button: Go to Blink - {95F6242A-62E4-4756-892F-F5D5D399CA25} - C:\Program Files\Blink\home.js
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ct2-flights.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = club-travel2000.co.uk
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 10.0.0.76
O21 - SSODL: WFjppGwDMIQWiUfjU - {2E6B190D-84C1-B3A7-4CAA-A6AA60CB8F58} - C:\WINDOWS\SYSTEM\LG.DLL
Post #2
Try a scanreg /restore. Boot the system and just after the POST (Power On Self Test) hold down either the Ctrl or F8 key. This should give you the Microsoft Boot Menu. Choose "Command Prompt Only". Once you get the C:\> prompt, type in;
scanreg /restore <–Note the space between the g /r. It needs to be there.

and pick a date ~prior~ to the problem starting. (You should have a choice of up to five dates.) This will replace your registry and the main windows boot files with backups. If this doesn't work, it indicates your paths have been lost or corrupted. (Usually c:\msdos.sys.)
Post #3

Try a scanreg /restore. Boot the system and just after the POST (Power On Self Test) hold down either the Ctrl or F8 key. This should give you the Microsoft Boot Menu. Choose "Command Prompt Only". Once you get the C:\> prompt, type in;
scanreg /restore <–Note the space between the g /r. It needs to be there.

and pick a date ~prior~ to the problem starting. (You should have a choice of up to five dates.) This will replace your registry and the main windows boot files with backups. If this doesn't work, it indicates your paths have been lost or corrupted. (Usually c:\msdos.sys.)

Hi mate sorry about this but i didn't understand most of that :huh: as i said totally clueless.

I'm very thankful for your time and help becasue i'm really starting to stress out about this but can you give me the dummy/idiot guide
Post #4
Turn the computer off, then back on. As soon as it's starting up, start tapping the F8 key

This should give you the Microsoft Boot Menu. Choose "Command Prompt Only". Once you get the C:\> prompt, type in;
scanreg /restore <–Note the space between the g /r. It needs to be there.

and pick a date ~prior~ to the problem starting. (You should have a choice of up to five dates.)
Post #5 last edited

Turn the computer off, then back on. As soon as it's starting up, start tapping the F8 key

This should give you the Microsoft Boot Menu. Choose "Command Prompt Only". Once you get the C:\> prompt, type in;
scanreg /restore <–Note the space between the g /r. It needs to be there.

and pick a date ~prior~ to the problem starting. (You should have a choice of up to five dates.)

Cheers for your help. Is this just for the connection or will this get rid of the virus? and do i shut down or just switch off at the wall?
Post #6
I hope it will fix both issues. Use the switch on the computer to turn it off and on. As soon as it starts up, you need to start tapping the F8 key.
Post #7
Hi mate, i've done that and the virus seems to have gone and i can now use Firefox as my browser but the BT Browser is still coming back with "Unable to connect to server. please check your connection before trying again" any idea on that? And thanks a lot for this
Post #9

When you installed your broadband did you have a disk or CD to install it?

Yes and i still have it. i was thinking maybe i should uninstall and then install again
Post #12

Lets have a look at a new HijackThis log before you do anything else.

Please post a new HijackThis log

Hi mate, is it alright if i do this tomorrow, it's 2.45 am over here lol

or is it important we do it now?
Post #13

Lets have a look at a new HijackThis log before you do anything else.

Please post a new HijackThis log

Hi mate, is it alright if i do this tomorrow, it's 2.45 am over here lol

or is it important we do it now?

Tomorrow is OK :thumbup:
Post #14

Lets have a look at a new HijackThis log before you do anything else.

Please post a new HijackThis log

Hi mate, is it alright if i do this tomorrow, it's 2.45 am over here lol

or is it important we do it now?

Tomorrow is OK :thumbup:

Cheers mate and thanks for the help. I'll do the log as soon as possible tomorrow. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI