Before we begin removing the infection; you are running an unpatched and unprotected version of Windows
First we need to temporarily disable a program so it does not interfere with our fix
To disable
SpySweeper:
Open it click >Options over to the left then >program options >Uncheck " load at windows startup". Over to the left click " shields" and uncheck all there. Uncheck " home page shield". Uncheck ' automaticly restore default without notifiction".
Next Go
Here and download and install SP1 (Service pack 1)
Note: Do Not install SP2 until instructed to do so
Reboot your PC ->> Re run Hijackthis and post a fresh Hijackthjis log
spysweeper was a old program i had that does not work anymore so I uninstalled it. When I run the service pack 1 install it tells me that "the file c:\windows\system32\drivers\atapi.sys is open or being used by another application. Close all other applications and click Reply"... i closed everything I could but it still wont let me continue the install.... Any Ideas?
I will help you clean out what I can of the infection. But please understand that your risk of reinfection is great unless you are unable to update.
So lets continue with the cleaning
First Rerun Hijackthis (scan only) and place checks beside the following entries
Close all other open windows except Hijackthis and Select "
Fix checked"
If prompted to reboot Select
No and close Hijackthis
Next using Windows Explorer (Rt click Start->> Explore, and using the tree of folders on the left)
bamajim
10.4K Posts
0
September 6th, 2006 16:00
Welcome to DCF
Before we begin removing the infection; you are running an unpatched and unprotected version of Windows
First we need to temporarily disable a program so it does not interfere with our fix
To disable SpySweeper:
Over to the left click " shields" and uncheck all there.
Uncheck " home page shield".
Uncheck ' automaticly restore default without notifiction".
Note: Do Not install SP2 until instructed to do so
Reboot your PC ->> Re run Hijackthis and post a fresh Hijackthjis log
thanks bamajim Graduate of Malware Removal University
bbower215
4 Posts
0
September 6th, 2006 23:00
bamajim
10.4K Posts
0
September 7th, 2006 00:00
bblower215
How big is your Hardrive?
bamajim Graduate of Malware Removal University
bbower215
4 Posts
0
September 7th, 2006 06:00
bamajim
10.4K Posts
0
September 7th, 2006 12:00
bbower215
Normally when you get that error, it's related to Hardrives of over 100gig.
Since you have 30 gig How much space is left on you Hardrive?
To Check go Start->> Rt click MyComputer->>Explore->>Rt click C:\ ->>Properties. we need at least 15% room left.
The only other reason for that error would be a corrupt Windows file. Which would explain why you have been unable to update.
To check that you will need your OS (Operating System Disk) that came with your PC. Do you have it?
thanks bamajim Graduate of Malware Removal University
bbower215
4 Posts
0
September 7th, 2006 14:00
bamajim
10.4K Posts
0
September 7th, 2006 19:00
I will help you clean out what I can of the infection. But please understand that your risk of reinfection is great unless you are unable to update.
So lets continue with the cleaning
First Rerun Hijackthis (scan only) and place checks beside the following entries
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O4 - HKLM\..\Run: [nmnqz] C:\WINDOWS\nmnqz.exe
O4 - HKLM\..\Run: [ofnqulcaap] C:\WINDOWS\System32\bdfufz.exe
O4 - HKLM\..\Run: [DropSpam Lifestyle] "C:\Program Files\dslifestyle\dslifestyle.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
If prompted to reboot Select No and close Hijackthis
Next using Windows Explorer (Rt click Start->> Explore, and using the tree of folders on the left)
Locate and delete the following folders
C:\Program Files\Webroot
C:\Program Files\LimeWire
C:\Program Files\PartyPoker
C:\Program Files\Bodog Poker
C:\WINDOWS\nmnqz.exe
C:\WINDOWS\System32\bdfufz.exe
Reboot Your Pc
Next Go Here and do a Ewido online scan
And post the results of the scan in your reply
Your reply should include
a fresh Hijackthis log
thanks bamajim Graduate of Malware Removal University