Please help me remove viruses/spyware!

Status
Not open for further replies.
Hi,

This is truly puzzling, as the software has been tried, tested and proven to be effective against xpdt. I'd like you to try this other anti-rootkit software and see if it works.

http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
I downloaded and ran Sophos and it found one thing.

Area: Local hard drives
Description:Unknown hidden file
Location: C:\Documents and Settings\Sam\Local Settings\Temporary Internet Files\Content.IE5\C480GNUJ\hi[1].htm
Removable:Yes (but clean up not recommended for this file)
Notes:(no more detail available)
 
Hi,

This is getting quite mindboggling. Could you post a fresh ComboFix log again?
Thanks.


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Hi,

Please follow these instructions carefully.

1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached sublimescript.txt (from my attachment) and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh ComboFix log.


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Hi,

Your ComboFix log appears clean except for the xpdt detection.
Avenger could not fix it, which I find odd. I shall have to check with Howard if he has any suggestions for this. We'll try to get back to you as soon as possible.


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Hi,

I've checked with Howard, and this variant of xpdt could be new, and potentially very very difficult to get rid of. Do have the mental preparations for a reformat if this fails.

Download the blacklight program HERE. It has only a 30 day trial, but will be good enough for now.

Run the program and see if it detects xpdt. Fix xpdt if it does, and let me know any other entries if found.


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Sure thing. Maybe I'm doing the rootkit thing wrong, but neither Blacklight or AVG rootkit has found anything. Do I need to remove internet from the equation or do I need to do anything other than just double click the program and scan?
 
Hi,

Please try disconnecting from the net and run the program to scan. Did you disconnect from the internet and perform a deep scan with AVG antirootkit previously?


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Yeah, I always alternated disconnecting my internet each time i ran avg antiroot. But I'll try it with blacklight now.
 
Hi,

I'm sorry to have to say this, but it's time for a reformat. ComboFix has an inbuilt antirootkit removal, but it did not remove the file. Since AVG and blacklight also did not manage to remove it, I'm afraid you have only that last option.

Although your system may be temporarily functioning now, with that rootkit running free in your system, there's no telling when it will wreak havoc. Thus I have to recommend a reformat.


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
I have no idea how to reformat... I used an HP program in the past but after the last unsuccessful reformat my friend loaded my comp up w/o any of those programs. So plz tell me how to do this! I want everybody completely gone, except the bare essentials.
 
I have finished reformatting and have ran combofix and hijackthis so far. I have just finished downloading AVG AntiSpyware but I figured that I should just show you my combofix and Hijack This! while AVG finishes scanning.

I get frequent popups that read... "Message from FROM to TO on 5/28/2007 9:45:22 PM
STOP! WINDOWS REQUIRES IMMEDIATE ATTENTION.
Windows has found 55 Critical System Errors.
To fix the errors please do the following:

1. Download Registry Update from: www.regfixit.com
2. Install Registry Update
3. Run Registry Update
4. Reboot your computer

FAILURE TO ACT NOW MAY LEAD TO SYSTEM FAILURE!"
 
Hi,

Please follow these instructions carefully.

1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt (from my attachment) and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh ComboFix and AVG Antispyware log.


Regards,
Your friendly momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Hi,

Please reboot into safe mode and unhide your files and folders like previously.

Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

ezcu.exe

Navigate in Windows Explorer and delete the following files and folders in bold.

C:\WINDOWS\system32\ezcu.exe
C:\WINDOWS\system32\nyqcccf.bat

Reboot into normal mode and rehide your protected OS files.

Thereafter, please post fresh HJT and ComboFix logs from normal mode as attachments into this thread.


Regards,
Your friendly momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Hi,

The reason why your system is getting infected so easily and quickly even after a reformat is because you are not running a firewall.

Here are some recommended software and links to them.

For antivirus, please use one and only one. Using more than one is not recommended as it may cause serious conflicts in your system.
AVG freeAvast

For firewalls please use one and only one. Using more than one is not recommended as it will hog your system resources.
Zonealarm
Kerio
Comodo

Here are some other miscelleneous programs which I recommend.
Spybot Search & Destroy. < use this if you have no other real time monitoring programs such as spyware doctor.
Ccleaner.

Whenever you do a reformat, the first thing after installing windows should be getting these programs as your first line of defence. Then go ahead and download your other software like WoW and BitComet.

That said, have HijackThis fix this entry:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Navigate in Windows Explorer and delete this file:

C:\WINDOWS\ALCXMNTR.EXE

Go to Start > Run. Type regedit and press enter.
Press ctrl + f and find all instances of ALCXMNTR.EXE and delete them.

Apart from that, your logs are clean.

Delete all files in AVG Antispyware Quarantine folder.

Turn off system restore (XP/ME only). Learn how to do that HERE.
This will remove all the remaining nasties from your old restore points.

After that turn system restore back on.
This would have created a new safe and clean restore point for your system.

Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
May I recommend you to read this article.
This can help to prevent future infections.

Should you have any further problems, please post in this thread.


Regards,
Your friendly momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
 
Status
Not open for further replies.

Similar threads

M
Virus warning popup
Replies
1
Views
531
Mark Fuller
M
A
Please help: Intel Core i9-11900KF with a H510M H V2 motherboard
Replies
2
Views
276
HardReset
H
B
Help with "special permissions" please
Replies
1
Views
509
Nelson28
N

Latest posts

Back