after removing spy falcon, one of my programs crashes

[dtes816]

Earlier this week, I ended up getting hit with spy falcon (still don't know how). Visited several different sites, and successfully removed it. Immediately after removal my browser was still being hijacked and being brought to www.securityprecaution.net (part of the spy falcon program I think).

I then found a posting on this site from january 31st, detailing how to resolve this exact issue, and followed the instructions contained in that thread (turn off system restore, Vundu removal, hijack-this, etc.).

Anyway, the instructions seemed to be working perfectly until I tried to play one of the games installed on my system (in this case Airfix Dogfighter). Prior to all this, this game was working perfectly, it now crashes every time that I run it anytime between 30 seconds to 3 minutes after the program starts.

I have tried unistalling and reinstalling the game, checked the settings, and updated the patches for the game and the computer. It still crashes every time.

Any Ideas? Any help would be appreciated.

Thank you.

 

[howard_hopkinso]

Hello and welcome to Techspot.

I don`t know why your game is crashing. However, if you would like to post a HJT log. I`ll take a look at it for you. There may still be something nasty on your computer.

See HERE for instructions on how to post your HJT log.

Regards Howard :wave: :wave:

 

[dtes816]

Thank you for any help you may be able to give.

I have done some further checking on my own and discovered that the game is crashing because it is automatically minimizing at certain time intervals ( 1 minute and 47 seconds or multiples thereof ) apparently never seeming to exceed 8 minutes. I have also noticed this pattern in other things, such as if I am typing in IE ( such as this post ) the cursor disappears until I click my mouse.

I am attaching the HJT file, and hope that this new information helps.

Thank you again.

 

[howard_hopkinso]

Your system is infected with quite a few baddies.

Go HERE and have your computer scanned.

Then, go and read both these threads by RBS. Follow all the instructions exactly.

How to remove Trojans and its ilk! and How to remove Begin2search / coolwebsearch and other nasties.

Only after doing the above, post a fresh HJT log.

Regards Howard

 

[dtes816]

I finally managed to run all the programs listed in the two links except Spyware Eliminator. Every time I try to run it I recieve an error message that states that
"Problems with this web page might prevent it from being displayed properly or functioning properly. In the future you can display this message by double clicking the warning icon in the status bar."

details are:

Line: 42
Char: 1
Error: Object Expected
Code: 0
URL: http://www.aluriasoftware.com/index.php?menu=litescan&id=e090850e20daec8d9d9364c99e2769ac

Attached is the Latest HJT log.

Thank you again

 

[howard_hopkinso]

Boot into safe mode. See how here. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by pressing the ctrl/alt/delete keys together.

Click on the processes tab, end process for(if there).

p2pnetworking.exe
n?tdde.exe

close task manager.

Click start/run and type services.msc into the run box and press the enter key.
When the window appears, maximise it, and locate this service. [p2pnetworking] p2pnetworking.exe
Double click on it, and stop the service if it`s running. Set the startup type to disabled. click apply/ok.


Run HJT with no other programmes open, and have HJT fix the following, by placing a tick in the little box nect to(if there).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dslstart.verizon.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
R3 - URLSearchHook: (no name) - {19226E0C-A1B7-DF13-96A0-F48ADDA3FDC3} - C:\WINDOWS\system32\levfrkpq.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll (file missing)

O4 - HKLM\..\Run: [p2pnetworking] p2pnetworking.exe
O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
O4 - HKCU\..\Run: [Lirqr] C:\WINDOWS\system32\??pPatch\n?tdde.exe

Fix all 016 DPF entries.

O20 - Winlogon Notify: winier32 - winier32.dll (file missing)

click on the fix checked button.

Close HJT.

Locate and delete the following bold files(if there).

C:\WINDOWS\system32\??pPatch\n?tdde.exe
p2pnetworking.exe

Reboot into normal mode and turn system restore back on.

Regards Howard

 

[dtes816]

Browser problem occurred after my last posting. After shutting down and restarting the computer I could not access any site that required a password ( the site would not load on the browser ) and some of my system settings had changed ( appearance went from windows xp style to windows classic style ). I went back to the previous spyware adware programs and restored all the files. I am going to have to need a day or two to start over.

Will update to let you know what is happening soon.

 

[cwskiller]

here is a guide that helped me to clean spyfalcon: http://www.spyware-removal-guideline.com/spyfalcon-removal