Calling Momok!! Nasty Spyrus!!

[almcneil]

Momok and other spyrus experts,

I have a customer with some nasty spyrus on his system. I've run Ad-Aware 2007, Spybot Search & Destroy, AVG Anti-Spyware, Combofix and HijackThis. Ran Windows XP repair but did not resolve all spyrus symptoms. The following are still happening:

o Windows Explorer hangs
o Internet Explorer does not launch, instead a shortcut appears on the Desktop
o Internet Explorer does launch from Start Menu but does not process web addresses entered manually.
o cannot access devices on USB port (Windows does report the detection but cannot access it)
o cannot download Windows updates.

ComboFix and HijackThis logs attached. Please reply ASAP!

TIA,
-- Andy

 

[almcneil]

Still looking for help with this sticky spyrus problem! Can anyone decifer the logs for me pls?

-- Andy

 

[stangpride]

tcpcheck.exe is an Undesirable program, which appears in your HJT log quite a few times. I would love to tell you to delete them, but as I am rather new to HJT, I do not want to misinform you. Hopefully, this post will help others respond faster to you and get you the exact instructions for dealing with this Undesirable program posted throughout your log.

Description of this program: Added by the Troj/Vbbot-B TROJAN, which installs a service called EthernetService and also uses that displayname.

I found my information from this webpage, by googling tcpcheck.exe: http://www.bleepingcomputer.com/startups/tcpcheck.exe-8510.html

I hope this helps get you started!