CiD Virus Help

[Sampapa]

Hello, TechSpot!

As you may be able to tell, im new at TechSpot so here is my Hello to all of you.

Anyways, onto my problem. I have been infected with the CiD Virus. Avast! AntiVirus has not been able to track it down. I have tried a free scan using XoftSpySE and the scan results make me believe that things called FlashGet and Lop.com may be the problem here, as they both are associated with Internet Explorer.

I would like to know the appropriate steps to dealing with this problem, attached is my HijackThis log file, please go over it. I have also looked at another thread And followed those steps, but nothing matched.

I look forward to your responses.

Much thanks
~Sampapa

 

[kritius]

Have you looked at this thread? Complete all the steps in there and you'll have a pretty good start.

https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

 

[Sampapa]

Thanks for the responses you two, but they didn't help. I have tried basically everything kritius has given me, and searched for MIXDOWNLOAD, no dice.

 

[kritius]

Thanks for the responses you two, but they didn't help. I have tried basically everything kritius has given me, and searched for MIXDOWNLOAD, no dice.

When you say you have tried basically everything what didnt you try? Or what didnt work?

 

[Sampapa]

Hmmm, well, one of the big things I missed was renaming HijackThis. Ill try renaming it later.

 

[kritius]

Just go to the folder that HiJackThis is in and rename the exe file to crusty

 

[Blind Dragon]

uninstall any of the following program(s) using Add/Remove Programs if they are present. To do this, go to Start > Settings > Control Panel and double-click on Add/Remove Programs. From within Add/Remove Programs highlight each one and select Remove.

Netpumper
BitRoll
CiD Help
CiD Manager
Download Plugin for Internet Explorer
Zone Media

Restart the computer

Run another scan with Hijackthis and attach a new log

 

[Sampapa]

Odd, I didn't find any of those in my Add/Remove Programs area.

 

[Blind Dragon]

Alright please follow through the directions in the first reply in the thread. complete the preliminary removal instructions located https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Then post the 3 logs back into this thread.
1)hijackthis
2)Combofix
3)avg log

* Removed by Blind Dragon

 

[Sampapa]

Sorry for the late reply, I had an internet issue. I fixed CiD. Apprently when I was installing Windows Live Messenger Plus! I accidentally signed up for their Sponsorship Program. This was named "Messenger Plus! Sponsorship (CiD)" in the add/remove program area (Or CCleaner is what I used.)

 

[Blind Dragon]

yes, that is what they call a LOP infection. There may be one additional step. Hopefully you uninstalled all the sponsors. But the last step is just to make sure they didn't create any "jobs" before the were removed.

post this into Notepad

dir c:\windows\tasks\##.job /a h > files.txt
notepad files.txt

Save it as jobs.bat on your desktop. Save it as type all types *.*.

Doubleclick the file jobs.bat. A notepad file called files.txt will be created.

attach files.txt

 

[Sampapa]

I believe its empty.

 

[Blind Dragon]

Indeed it is. Good job

 

[Sampapa]

Yay! Thanks!