Comments for Spyware Techie

Comment on IE Antivirus or IEAntivirus 3.2 Removal Guide by Leo

Leo — Thu, 03 Jul 2008 03:25:01 +0000

This is a log of my scan using SmitFraudFix. I never instaled IE Anti Virus but I do get the pop up stating a critical error each time I try to open any kind of folder.

SmitFraudFix v2.328

Scan done at 23:19:46.57, Wed 07/02/2008
Run from C:\Users\fLuiD\Desktop\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\jureg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\AOL\1209725682\ee\aolsoftware.exe
C:\Windows\system\wcdvtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\AIM6\aolsoftware.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Windows\system32\jusched.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\BitLord2\BitLord.exe
c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\DllHost.exe
c:\windows\system32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler’s .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLs”=”"
“LoadAppInit_DLLs”=dword:00000000

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Userinit”=”C:\\Windows\\system32\\userinit.exe,”

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Comment on XpAntivirus Removal Guide by momo

momo — Wed, 02 Jul 2008 00:44:43 +0000

sorry if this is included, but i’ll probably read your instructions over again.
every time i try to unregister the .dll files (shlwapi & wininet) it says that access denied, or when i try to delete them it says; x.dll was loaded, but the DllUnregisterServer entry point was not found. dllunregisterserver may not be exported, or a corrupt version of wininet.dll may be in memory. consider using Pview to detect and remove it.

help anyone?

Comment on Online-spy-scanner.com Removal Guide by Łukasz

Łukasz — Sun, 29 Jun 2008 03:55:58 +0000

Hi, I from Poland and I’ve problems about online-spy-scanner —-> they’re trying “scan” my computer. Busters. Why? :> .

Thanks for article, Łukasz from Poland. :> .

Comment on WinlFixer Removal Guide by Navid

Navid — Fri, 27 Jun 2008 15:02:49 +0000

Thanks guy!

I got the blue screen with warning today, and I was near to heart attack.
I had a lot of data that need to back up and you know this blue screen and warning…

thank you for your helpful article.

Navid

Comment on Transform XP to Vista (exe) by ashok

ashok — Fri, 27 Jun 2008 10:50:41 +0000

please send this theam in my email id

Comment on AntiSpywareMaster Removal Guide by AntivirusExpert

AntivirusExpert — Thu, 26 Jun 2008 21:23:30 +0000

According to wordtracker stats, antispyware master is just a bit less searched query than XP antispyware, which lets me conclude that it will gather many more victims in no time… looks like someone found wide holes in Windows security concept ;-(

Comment on Malware Protector 2008 Removal Guide by John

John — Thu, 26 Jun 2008 19:26:02 +0000

I am having a really tough time getting rid of this thing… i tried the directions above and also tried the spyware doctor program which proclaims it can remove this insidious program… Has anyone else run into difficulties??? Should i load the malware proctector 2008 and try to run through the above checklist again??? Any suggestions are much appreciated.

Thank you.

Comment on Malware Protector 2008 Removal Guide by Richard Ogima

Richard Ogima — Wed, 25 Jun 2008 23:43:02 +0000

The most exciting part of this virus, after I finally destroyed, I think, is that I get to choose a new Wallpaper for my desktop, lol.

Comment on Ultimate Antivirus 2008 Removal Guide by AntivirusExpert

AntivirusExpert — Wed, 25 Jun 2008 14:21:06 +0000

OMG, seems like a new variation of XP scam appears daily! Just an hour ago I was reading complaints about the removal guide for XP antivirus not working for people because… they searched for ANTVRS.EXE which was not to be found on their systems. These scams are using different filenames to stay as diverse as possible.

Comment on Malware Protector 2008 Removal Guide by Albert

Albert — Mon, 23 Jun 2008 16:49:16 +0000

What a great site! Thank you so much for posting the removal instructions, and thanks to everybody who posted supplemental info. I got hit at work Friday when I was goofing around, and would have been in deep doo-doo if I hadn’t been able to clear the problem with the help of this site.

Now, here’s something I can contribute that will help. I followed all of the instructions but, like several of you, couldn’t get rid of everything. Here’s the key: The file names seem to change from user to user; the software doesn’t use the same naming convention every time. When I looked under processes, I didn’t see shcev9j0e1b1 but I saw something similar, so I took a chance and deleted that. I also realized that my lingering problem files all had “ee3t” in the name, so I searched for those at each step and deleted them. That’s how I got rid of the screen saver and warning message that wouldn’t go away. I found three files in c:\windows\prefetch and three in c:\windows\system32. Once I deleted those, problem solved.

Thanks again and good luck to everyone (except the scumbags who created this problem for the rest of us).