also @ TechSpot: Exploit allows command prompt to launch at Windows 7 login screen

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

Work PC hit hard with Spyware Protect

Discussion in 'Virus and Malware Removal' started by pfexpress, Mar 26, 2009.

Thread Status:
Not open for further replies.

  1. pfexpress Newcomer, in training

    I saw another post in this forum that sounds like this one. My work PC gets used by alot of different people and I noticed today some pop-ups from a program called Spyware Protect 2009. It's pretty much taken over my PC. I cant run any programs. Or run any install programs to check for Malware/Spyware etc. I tried in safe mode and was able to download, but still could not install. When trying to use the internet, it blocks some sites and if I do a Google search, and click on a result, it takes me to a different site.

    I understand the 8 steps that are required before posting here, but as of now, I dont have the option to get those programs. Any ideas would be appreciated.
    pfexpress, Mar 26, 2009
    #1

  2. pfexpress Newcomer, in training

    HIJackThis Log attached

    I havent been able to get any of the programs to install, or run due to this infection. I did, however get HiJackThis to run, if it's any help. The log is attached.
    pfexpress, Mar 27, 2009
    #2

  3. Bobbye Helper on the Fringe

    I ask all users who are having a problem with a computer in a work setting if they have contacted whoever is the IT person for the office- have you done this?

    You have Malwarebytes running on the system:
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    Why can't you update and run a scan with it?

    As for the HijackThis log:
    Remove bad HijackThis entries
    • Run HijackThis
    • Click on the System Scan Only button
    • Put a check beside all of the items listed below (if present):
    • Close all open windows and browsers/email, etc...
    • Click on the "Fix Checked" button
    • When completed, close the application.

    Regarding the following entry:
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    Since you are in an office setting, please see the following site about determining whether the entry should remain:
    http://www.pchell.com/support/nwprovau_dll_file.shtml

    When done, run the MalwareBytes scan, being sure to UPDATE first. Follow that by running SuperAntispyware, then a new HijackThis scan.

    Attach all three logs.
    Bobbye, Mar 28, 2009
    #3

  4. pfexpress Newcomer, in training

    Thanks for the reply. I cant run any of my protection programs because it seems the infection is stopping them from working. Even in safe mode. I click on the program and it just stalls there. It never opens.
    Our setting really isnt an office its just a computer in a store and lots of people use it at random times. Which is now going to stop.
    I will be back in the store on Monday and will fix what you have asked me to, and try and get another report.
    pfexpress, Mar 28, 2009
    #4

  5. Bobbye Helper on the Fringe

    Are those people employees or customers? Sounds like a really bad set up for security no matter which they are if there is internet access.
    Bobbye, Mar 29, 2009
    #5
Thread Status:
Not open for further replies.