log for spyquake problem - HELLLLLLLLLLLLLLPPP!

Hi,

I've had a look through your log and I now have some instructions for you to follow.

Before you start, please read through these instructions and make sure that you understand them.
If you are not sure about anything, post a reply in this thread with your questions.

Please follow and carry out all the steps in the instructions in the order I've listed them.

Please do not try any other "fixes" you may have found on the internet while we are sorting this problem out, it's important that we work through the fix in a systematic manner.

Step 1
Download this program:-

Download SmitfraudFix from http://siri.urz.free.fr/Fix/SmitfraudFix.zip and save the file to your desktop.
Extract the content (a folder named SmitfraudFix) to your Desktop.

Step 2
Open the SmitfraudFix folder created in step 1 and double-click "smitfraudfix.cmd". Please do not try to use any of the other files in the folder until instructed.
Select option "1 - Search" by typing "1" and pressing "Enter" on the keyboard.
A text file will appear, which lists infected files (if present). We are only generating a report at this stage, not cleaning yet.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
See http://www.beyondlogic.org/consulting/proc...processutil.htm

Please copy/paste the content of the report generated into your next reply. The report can be found at the root of the system drive, usually at C:\rapport.txt.

I'll check the report and get back to you with the next stage of the fix.

Thanks,

Bod

Hi again,

Next stage of the fix.

Again, before you start, please read through these instructions and make sure that you understand them.
If you are not sure about anything, post a reply in this thread with your questions.
You will be booting into Safe Mode at some point in these instructions, so you should print out these instructions for reference. You will not have internet access in Safe Mode.

Please follow and carry out all the steps in the instructions in the order I've listed them.

Step 1
Re-boot in Safe Mode by pressing F8 during Boot-up and choosing Safe Mode from the boot options list.

The next part of this fix will be carried out in Safe Mode.

Step 2
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd

Select option "2 - Clean" by typing "2" and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; type "Y" and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); type "Y" and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, reboot as normal.

A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Step 3
Download, install, and update the free version of Ewido Anti Malware from http://www.ewido.net/en/download/.
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
When you run Ewido for the first time, you will get a warning "Database could not be found!". Click "OK". From the main Ewido screen, click on "update" in the left menu, then click "Start update".
After the update finishes, the status bar at the bottom will display "Update successful"

Click Scanner > Complete System Scan, and choose "Remove" then click "OK" for everything found. Beware of false positives, so check each item found before choosing to remove.
At the end of the scan, click "Save Report".
Please copy this log into your next post.

Step 4
Run Hijack This, "Scan" and post the log, together with a copy of the SmitFraudFix and Ewido logs, as a reply to this thread. I'll check it through, and get back to you.

Thanks,

Bod

Hi,

I am looking into this, I'll get back to you as soon as I can.

Bod

Hi again,

Am I right in thinking that you don't have any problem booting as normal?

Getting lines of code as the pc boots into safe mode is normal. When booting into safe mode, Windows only runs a very basic VGA video driver, which will have a different scan rate from your normal video driver.

The error box you describe sound very much like the sort of error box put up by the monitor firmware rather than Windows. I've had a play around with the settings on my monitor and I get the same result with certain settings. In all cases with my monitor, hitting the "Auto" button sorts it out because this forces the monitor to re-adjust to the new video signal.

Give it a try and let me know.

Bod

Hi,

Lets try an older tool that doesn't need to be run in safe mode.

As always, before you start, please read through these instructions and make sure that you understand them.
If you are not sure about anything, post a reply in this thread with your questions.

Please follow and carry out all the steps in the instructions in the order I've listed them.

Print out these instructions as we will need to close every window that is open later in the fix.

Step 1
Download roguescanfix_setup.exe from http://users.telenet.be/Beamerke/tools/rog...anfix_setup.exe

Confirm that the file roguescanfix_setup.exe is now on your desktop, and double-click on the roguescanfix_setup.exe file.

Select your language from the drop down menu and click OK > Next

Select the option that says "I accept the agreement" and click Next > Next > Install

The installation program will start installing RogueScanFix into C:\Program Files\Roguescanfix and then display a new screen. At the next screen, leave the checkmark in the "Launch RogueScanFix" checkbox and click "Finish".

RogueScanFix will automatically be started and you will be presented with the Credits screen. Simply press the spacebar on your computer to continue the removal process.

Note: Please note that when the program starts it will download a program from the Internet that it needs to use during the cleanup. If your firewall gives an alert about this, please allow the download.exe or run.bat program to access the Internet.

When the program starts, your desktop will disappear, which is normal, so please do not be concerned. It will then start the uninstallation program. When that program starts, click "Uninstall". When it has finished uninstalling, you can Click "OK" to finish the uninstallation.

When this program is finished, and it was able to delete all the files, you will see a small prompt that says "Completed script execution". Click "OK". It
will then open the Brute Force Uninstaller program. Close this by clicking "Exit". If there a notepad file open called "task.txt", you can close that as well.

If there were more files that needed to be deleted, the program will prompt you to reboot your computer. Click "Yes" and allow the computer to reboot.
When you are back at the desktop, close the "task.txt" notepad file if it is open.

Step 2
Download, install, and update the free version of Ewido Anti Malware from http://www.ewido.net/en/download/.
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
When you run Ewido for the first time, you will get a warning "Database could not be found!". Click "OK". From the main Ewido screen, click on "update" in the left menu, then click "Start update".
After the update finishes, the status bar at the bottom will display "Update successful"

Click Scanner > Complete System Scan, and choose "Remove" then click "OK" for everything found. Beware of false positives, so check each item found before choosing to remove.
At the end of the scan, click "Save Report". Please copy this log into your next post.

Step 3
Run Hijack This, "Scan" and post the log, together with the Ewido log, as a reply to this thread. I'll check it through, and get back to you.

Thanks,

Bod

Hi again,

Sorry I couldn't get your system sorted, it always was going to be a hard fight not being able to boot into safe mode.

If you want to donate, follow the link to Malware University in my sig., and click on the "Support Us" link, but don't feel as though you must, we all do this as a hobby.

These are my standard suggestions for keeping a system clean, I hope the are of some assistance now you've done a system recovery.

Step 1 - Microsoft Windows Update
Click Start > All Programs > Windows Update. This will take you to the Windows Update site. Follow the instructions to download and install all of the latest critical updates. Repeat this as many times as necessary, until there are no more updates available. Reboot whenever instructed.
Click Start > Control Panel > Security Centre and make sure that Automatic Updates are On.

Step 2 - Hide System Files
Click Start > My Computer > Tools > Folder Options > View Tab. Un-check "Show hidden files and folders" in the Hidden files and folders section, and Select "Hide protected operating system files (recommended)" option. Click Yes > OK.

Step 3 - Make your Internet Explorer more secure
Open Internet Explorer click Tools > Options > Security tab >Internet icon to highlight >Custom Level, then select the following options:-
Change "Download signed ActiveX controls" to "Prompt"
Change "Download unsigned ActiveX controls" to "Disable"
Change "Initialise and script ActiveX controls not marked as safe" to "Disable"
Change "Installation of desktop items" to "Prompt"
Change "Launching programs and files in an IFRAME" to "Prompt"
Change "Navigate sub-frames across different domains" to "Prompt"
Click "OK", then Apply
Click on the "Privacy" tab and move the slider up to "Medium High", then Apply > OK to exit the Internet Properties page.

Step 4 - Anti Virus Software
It is very important that your computer has an anti-virus software running on your machine and that it is kept up to date.

Make sure your anti-virus is updated at least weekly, preferably daily. If your anti-virus is a trial copy or your subscription has expired, you can use one of these, both of which have a free version for home, non-networked, single user use.
Grisoft AVG http://free.grisoft.com/doc/1
Avast http://www.avast.com/

For more information on anti-virus programs see http://forum.malwareremoval.com/viewtopic.php?p=53#53

Step 5 - Firewall
XP SP2 includes the Windows Firewall which is enabled by default. You need to use this as a minimum, it is a very basic firewall, so you would be better off using one of these, both of which have a free version for home, non-networked, single user use.
ZoneAlarm http://www.zonelabs.com/store/content/home.jsp
Kerio http://www.sunbelt-software.com/Kerio.cfm

For more information on firewalls see http://forum.malwareremoval.com/viewtopic.php?p=56#56

Step 6 - Windows Defender
Download and install Windows Defender from http://www.microsoft.com/athome/security/spyware/software/default.mspx

Step 7 - Spybot Search & Destroy
Download and install Spybot Search & Destroy from http://www.safer-networking.org/en/download/index.html
Enable the TeaTimer and SD Helper options during the installation process. Update this and scan your PC on a weekly basis.

Step 8 - AdAware
Download and install Lavasoft Adaware SE Personal from http://www.lavasoftusa.com/software/adaware/
Update this and scan your PC on a weekly basis.

Step 9 - SpywareBlaster
Download and install Javacools SpywareBlaster from http://www.javacoolsoftware.com/spywareblaster.html. When installed, run SpywareBlaster, click "Enable All Protection", then "Download Latest Protection Updates" and follow the instructions to download and enable the latest update.
SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. You need to manually check for updates regularly.

Hopefully these will help keep your computer clean,

Bod