Hi
click on the link "Essential spyware removal steps and other hijackthis help forums" below and follow all the instructions (Step 1-5) (Especially cwshredder in your case) and post the hijackthis log(In the virus forum) after reading (Instructions a/b/c) after downloading/running all the programs mentioned there alongwith the Online anti-virus scans .Update all the programs ie spybot http://www.safer-networking.org/en/howto/update.html ,AND adaware http://www.colby-sawyer.edu/information/technology/updates/ad-awareusage.html
before logging into safe mode to run it .
Contain's malware analysis, self-help information, and short tutorials on various security tools.
http://www.bleepingcomputer.com/forums/forum55.html
http://forums.subratam.org/index.php?showforum=29
How to use the Microsoft AntiSpyware Beta to remove Spyware
http://www.bleepingcomputer.com/forums/tutorial98.html
Microsof Antispyware direct download link
http://download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
http://www.microsoft.com/athome/security/spyware/default.mspx
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Watch the video
Top 3 things you can do to prevent spyware http://www.microsoft.com/athome/security/spyware/video1.mspx
Then download, and run the Fix Binet tool. Be sure to follow directions on their page.
Download, unzip to your desktop
CWShredder and run it, then:
1. Click "
Check For Update"
(
If an update isn't available, skip to step #4.)
2. Click "
Click here to Download the upate".
3. When the new version has been downloaded, click "
Save".
4. Click "
Fix ->"
Run
HiJackThis then:
1. Click "
Config..."
2. Click "
Misc Tools"
3. Click "
Open Process manager"
-
Next, while holding down the
CTRL key, locate (
if present) and click on (
highlight) each of the following:
C:\WINDOWS\System32\bcronz.exe
Now double-check and make sure that only those item(s) above are highlighted, then click "
Kill process". Now, click "
Refresh", check again, and repeat this step if any remain.
Now, let's open a
command prompt and unregister the dll(s) we're going to remove, by entering the following:
It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to a command prompt to save on the typing.
Before we begin, let's move
HiJackThis to it's own folder; like
c:\HJT. When we're done '
cleaning' off your system, we're going to '
flush' the temporary folders which, with
HiJackThisin it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later.
Also move the "
Backups" folder, for
HiJackThis, if present.
Run
HiJackThis and click "
Scan", then check(tick) the following, if present:
jamez kann
860 Posts
0
January 22nd, 2005 00:00
click on the link "Essential spyware removal steps and other hijackthis help forums" below and follow all the instructions (Step 1-5) (Especially cwshredder in your case) and post the hijackthis log(In the virus forum) after reading (Instructions a/b/c) after downloading/running all the programs mentioned there alongwith the Online anti-virus scans .Update all the programs ie spybot http://www.safer-networking.org/en/howto/update.html ,AND adaware http://www.colby-sawyer.edu/information/technology/updates/ad-awareusage.html
before logging into safe mode to run it .
Contain's malware analysis, self-help information, and short tutorials on various security tools.
http://www.bleepingcomputer.com/forums/forum55.html
http://forums.subratam.org/index.php?showforum=29
How to use the Microsoft AntiSpyware Beta to remove Spyware
http://www.bleepingcomputer.com/forums/tutorial98.html
Microsof Antispyware direct download link
http://download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
http://www.microsoft.com/athome/security/spyware/default.mspx
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Watch the video
Top 3 things you can do to prevent spyware http://www.microsoft.com/athome/security/spyware/video1.mspx
Malware Removal Procedures
http://www.net-integration.net/tools/procedure.html
Midnight Star
4.8K Posts
0
January 22nd, 2005 04:00
Let's see what we can do...
Go to Add/Remove programs and remove(uninstall) the following, if present:
TVMedia
Web Savings Ebates
anything with 'search' in the entry that you didn't install.
anything with 'toolbar' in the entry that you didn't install.
Next, go here:
http://securityresponse.symantec.com/avcenter/venc/data/adware.binet.html
Then download, and run the Fix Binet tool. Be sure to follow directions on their page.
Download, unzip to your desktop CWShredder and run it, then:
1. Click " Check For Update"
( If an update isn't available, skip to step #4.)
2. Click " Click here to Download the upate".
3. When the new version has been downloaded, click " Save".
4. Click " Fix ->"
Run HiJackThis then:
1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"
-
Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:
C:\WINDOWS\System32\bcronz.exe
Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.
Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:
regsvr32 /u CSBB.DLL
regsvr32 /u BTGrab.dll
regsvr32 /u systb.dll
regsvr32 /u gsim.dll
It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to a command prompt to save on the typing.
Before we begin, let's move HiJackThis to it's own folder; like c:\HJT. When we're done ' cleaning' off your system, we're going to ' flush' the temporary folders which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later.
Also move the " Backups" folder, for HiJackThis, if present.
Run HiJackThis and click " Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=20520068119218204
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=20520068119218204
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000002230} - C:\PROGRA~1\Lycos\IEagent\CSBB.DLL
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O2 - BHO: GSIM - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\gsim.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM\..\Run: [ocvbmjdb] C:\WINDOWS\System32\bcronz.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKCU\..\Run: [ssate.exe] C:\WINDOWS\System32\irun4.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [JavaUpdate0.07] C:\WINDOWS\System32\sgzii.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O23 - Service: Windows User Mode Driver Framework - Unknown - C:\WINDOWS\System32\wdfmgr.exe (file missing)
Now, with all windows closed except HiJackThis, click " Fix checked".
Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
folders...
C:\Program Files\TV Media
C:\PROGRA~1\Lycos
(Check this folder and make sure nothing in there is what you've installed.)
files...
C:\WINDOWS\System32\bcronz.exe
C:\WINDOWS\BTGrab.dll
C:\WINDOWS\systb.dll
C:\WINDOWS\gsim.dll
C:\WINDOWS\Belt.exe
C:\WINDOWS\satmat.exe
C:\WINDOWS\System32\irun4.exe
C:\WINDOWS\System32\sgzii.exe
Post back a new log.
-
Mike.
Message Edited by Midnight Star on 01-22-2005 12:38 AM