Help! My PC is serious infected by spyware!

last SG · 2006-06-12T22:57:51+00:00

No i don't think you know much about what has transpired. You do not even have the very basic item a computer user have - a backup solution. First - if you...

joeacid SG

Hmm... but i'm afraid my whole PC will crush after i clear those spyware? coz the last time i did going into safe mode and delete actually crushed my PC~ and this time round i dun hav an extra HD to keep all my stuffs Sad

joeacid SG

May i shld wait for ndmmxiaomayi to help me test it out 1st? or... any other recommendation? Sad

lpx88 SG

er...why will ur PC crash when u clear spyware?

StarPuppy SG

hmm...i am looking at your hijack log...there are some files that look like virus...just double chcking on how to remove it

StarPuppy SG

just wondering

Diagonstic(typo) mode is the same with safe mode?

StarPuppy SG

Originally posted by joeacid:

Yup~ Here's my HiJack List:

Logfile of HijackThis v1.99.1
Scan saved at ºß 10:36:49, on 2006/6/12
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\Sm9lbGluZw\command.exe
C:\WINDOWS\System32\Kerne0110.exe
C:\WINDOWS\System32\dcomcfg.exe
C:\defender23a.exe

so far..the 3 of them are viruses but i can't find the one in red...

StarPuppy SG

can't find

C:\WINDOWS\System32\f7c9fd9a.exe
C:\defender23a.exe

anyone else got luck?

joeacid SG

dunno~ i think when i clear off the file~ it gt delete together with my win.sys file i think~ sys/dll file i think

joeacid SG

I got a few pic here for display~ Here's a few of my problem~

The above is what i always see after there's this Trayicon i mentioned earlier~

I scanned my PC using Spysweeper~ hav to buy to delete off the found Hijackers~ so dunno how to delete them~

This is the 2nd part of the Spysweeper~ coz cannot show everything~

SilverPal SG

The free webroot you showed cannot clean. You'll have to get the older versions or a paid version to clean your computer.

Ad aware has a good cleaning function. You can install a lateset copy of it and go into safe mode to scan and clean.

If pop ups, search page and home page are still hijacked, there has been various softwares reccommended in this thread and the sticky to help you suppress it until you can fix the problem.

When all else fails, get hijack this and use it to scan, then find out all the names of the spyware and use the internet to find out how to clean it.

joeacid SG

The following 3 is the extend of the found files in the spysweeper:

R3SsH|n SG

you can take a look at past case...
http://www.sgforums.com/?action=thread_display&thread_id=171458

joeacid SG

hi thanks for the thread link~ i've read it~ it seems similar but different i think~ i'm not too gd in this kinda thing~ dunno how to do it Sad

R3SsH|n SG

ideally you shld be able to delete the trojan by deleting the registry of it...if you are unsure...think your best bet is to backup everything...and then do a reformat...

lpx88 SG

wads yr version of spysweeper?i can..ahem unlock it so you can clear

lpx88 SG

personally i prefer adaware and spyware doctor though Wink

ndmmxiaomayi SG

Right click on the HijackThis link and click Save Target As if you are using IE, or Save link as if you are using Mozilla Firefox. Save to Desktop, extract, and open it. If you are still unable to open, download this removal tool first, and remove one variant of the CoolWebSearch spyware.

After this, try running HijackThis again.

Remove most variants of CoolWebSearch

Remove Look2me

Trend Micro's CoolWebSearch Removal tool

ndmmxiaomayi SG

Nope. Diagnostic will still some necessary services and start up applications to test the computer. Safe mode practically don't load anything unneccessary, unless you use Safe mode with networking option, which allows you to go to the Internet to check for updates.

ndmmxiaomayi SG

C:\WINDOWS\System32\dcomcfg.exe

Please do not remove this. It's part of Windows.

ndmmxiaomayi SG

Close any programs running.

Run HijackThis again. Select None of the above, just start the program.

Click scan. After it finishes scanning, put a tick against these entries and click Fix checked:

C:\WINDOWS\Sm9lbGluZw\command.exe
C:\WINDOWS\System32\Kerne0110.exe
C:\WINDOWS\System32\f7c9fd9a.exe
C:\WINDOWS\System32\conime.exe
O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\System32\hp100.tmp
O4 - HKLM\..\Run: [f7c9fd9a.exe] C:\WINDOWS\System32\f7c9fd9a.exe
O4 - HKCU\..\Run: [f7c9fd9a.exe] C:\Documents and Settings\joeling\Local Settings\Application Data\f7c9fd9a.exe
O16 - DPF: {00000000-0000-0000-0000-100000000003} - http://code.jcash.biz/l/c16d96011938750a7556d6b3b02a7eba_13.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Yahoo 1G mail - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)

Do you use Alexa search engine? If you do, don't remove the entries in blue.

For this entry (F3 - REG:win.ini: load=C:\WINDOWS\System32\Kerne0110.exe), I can't help, because I can't find much info about it, and it's too risky to edit win.ini files.

« Previous Page Next Page »