UNSOLVED
Help! Very Stubborn Spyware
Here are the symptoms.
1) After few minutes of starting up the computer one to
several pop-ups of advertisement come up (in IE). Pop-ups
come up before I even open any browsers. And then a shortcut
of "PartyPoker" appears on my desktop. It is a shortcut to a
website. Now all of this happen every time I start the
computer. Restarting the computer, however, does not induce
this weird behavior. Neither does cold booting.
Now the spyware has a new twist, instead of
putting "PartyPoker" shortcut on my deskton, they put
"CasinoGames" link, "Get $888 Free!" link, and
"installer_MARKETING35.exe" etc.
Also, in the background ran bargains.exe and nls.exe,
which I of course did not know that it was installed.
And probably those two were only a fraction of what
were running. My task manager showed that 100% of the
memory was being used up and none of the tasks looked
suspicious or was hogging all the memory.
2) Whatever window I'm using (such as a browser window or a
program window) every so often, about 10-50 seconds the
window gets "de-selected" automatically for no reason. What
I mean is that for example, you open a folder and click
somewhere outside the folder window and the folder window
gets "de-selected" and in browsers when the browser window
gets "de-selected" all the typing won't show up. This stops
after about 30 minutes of using the computer.
3) I have Ad-Aware and it monitors spyware activities. I get
lots of "cookies blocked" and many of them come from
atdmt.com. And I haven't even opened up the Internet browser
yet. And once or twice I got many "registry modification
detected" and they're all like this:
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:kyogv
Data:C:\WINDOWS\System32\kyogv.exe
New Data: kyogv.exe
4) I'm suspecting that kyogv.exe is some form of harmful
program to the computer because it is new to the system and
it even has a place in the startup in the registry. I tried
deleting it but access was always denied because it was
either "being in use or protected."
5) On the computer (I use Dell) near the power switch right
next to the cylindrical symbol is the light that displays
"work." When the computer is not used at all or no programs
are running it flashes incessantly. Its flashing behavior
is like beeping; flashing every 2 seconds as if there's
something running in the background. I checked the windows
task manager but no foreign tasks seem to be running.
6) I ran "msconfig" and saw several new suspicious entries
in startup including kyogv.exe. I tried unselecting them and
applying settings but it always revert back to the original
setting.
7) I opened Counter Spy, and through "help" tab, I got on to
Sunbelt Official website. But every time after 30 to 60
seconds the IE window would close by itself. Even multiple
windows would close by themselves. Now I open IE by myself
and nothing happens.
What should I do?
P.S. Sunbelt says that CounterSpy is the complete solution and that it alone is enough for protection. Should I have multiple anti-spyware programs running? I'm worried that there would be some conflicts between the softwares as I read that CounterSpy attacks MS Antispyware etc.
1) After few minutes of starting up the computer one to
several pop-ups of advertisement come up (in IE). Pop-ups
come up before I even open any browsers. And then a shortcut
of "PartyPoker" appears on my desktop. It is a shortcut to a
website. Now all of this happen every time I start the
computer. Restarting the computer, however, does not induce
this weird behavior. Neither does cold booting.
Now the spyware has a new twist, instead of
putting "PartyPoker" shortcut on my deskton, they put
"CasinoGames" link, "Get $888 Free!" link, and
"installer_MARKETING35.exe" etc.
Also, in the background ran bargains.exe and nls.exe,
which I of course did not know that it was installed.
And probably those two were only a fraction of what
were running. My task manager showed that 100% of the
memory was being used up and none of the tasks looked
suspicious or was hogging all the memory.
2) Whatever window I'm using (such as a browser window or a
program window) every so often, about 10-50 seconds the
window gets "de-selected" automatically for no reason. What
I mean is that for example, you open a folder and click
somewhere outside the folder window and the folder window
gets "de-selected" and in browsers when the browser window
gets "de-selected" all the typing won't show up. This stops
after about 30 minutes of using the computer.
3) I have Ad-Aware and it monitors spyware activities. I get
lots of "cookies blocked" and many of them come from
atdmt.com. And I haven't even opened up the Internet browser
yet. And once or twice I got many "registry modification
detected" and they're all like this:
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:kyogv
Data:C:\WINDOWS\System32\kyogv.exe
New Data: kyogv.exe
4) I'm suspecting that kyogv.exe is some form of harmful
program to the computer because it is new to the system and
it even has a place in the startup in the registry. I tried
deleting it but access was always denied because it was
either "being in use or protected."
5) On the computer (I use Dell) near the power switch right
next to the cylindrical symbol is the light that displays
"work." When the computer is not used at all or no programs
are running it flashes incessantly. Its flashing behavior
is like beeping; flashing every 2 seconds as if there's
something running in the background. I checked the windows
task manager but no foreign tasks seem to be running.
6) I ran "msconfig" and saw several new suspicious entries
in startup including kyogv.exe. I tried unselecting them and
applying settings but it always revert back to the original
setting.
7) I opened Counter Spy, and through "help" tab, I got on to
Sunbelt Official website. But every time after 30 to 60
seconds the IE window would close by itself. Even multiple
windows would close by themselves. Now I open IE by myself
and nothing happens.
What should I do?
P.S. Sunbelt says that CounterSpy is the complete solution and that it alone is enough for protection. Should I have multiple anti-spyware programs running? I'm worried that there would be some conflicts between the softwares as I read that CounterSpy attacks MS Antispyware etc.
Message Edited by Iceflakes on 06-12-2005 09:34 PM
- kyogv.exe is what seems to be a regenerating process file. In addition to the above post go to www.sysinternals.com and download processexplorer and autoruns. Use process explorer to find these rogue processess and kill them, and their process trees. Use autoruns similarly to msconfig but here you can actually uncheck and delete the entries.
- I forgot to mention a couple things:
I said that the light near the cylindrical symbol flashes once in a while. Well when it flashes, 2% CPU is used and when not flashing, 0%, so it's alternating during each flashing every 2 seconds. When I restart, the light stays on and doesn't go off until I shut down the computer.
In safe mode, I used Adaware, Spybot, Counterspy, McAfee antivirus to check the system in full sans. I also deleted kyogv.exe and several other suspicious files.
But now problems still persist. It is so annoying. And the spyware makes itself obvious too, that's a lot more annoying than inconspicuous ones and not only does this spyware do weird things but it also dumps other spyware into my computer. I wish somehow I can get rid of this thing completely.
dalem29
2 Intern
•
2198 Posts
214
0
Posted June 13th, 2005 14:00
It does sound like you have some baddies in your system. The best bet would be to go to the HJT board, download, and then run the scan. Somone will interpret the results as soon as possible.
I am not familiar with Counter Spy, but it is best to have multiple products and run them independently. I use AdAware SE, Spybot S&D, Spyware Blaster (which kinda functions as spyware firewall), and the MS beta spyware program. I have no conflicts. There are some other good products which other forum members might recommend. A lot of supposed "spyware" programs actually contain spyware.
If AdAware or other site finds adware, you can go into Internet Options>Privacy>Sites and type in the web site and then hit block.
A few sites to study for more information
http://www.spywarewarrior.com and for an article about rogue sites http://www.dslreports.com/forum/remark,9362019~mode=flat
Message Edited by dalem29 on 06-13-2005 09:37 AM