Help! My PC is serious infected by spyware!

• joeacid

  12 Jun 06, 16:47

  Hi guys! Help please! My whole Pc is suddenly infected by a spyware akways making me bonouce back to its website http://www.topsecuritysite.net/ and has a program in my PC always prompting and warning me that i have virus!
  
  All these are untrue! Please pls~ Even my Homepage has got eaten up and no matter how many times i change it back to yahoo, it will stil go back to the spyware! Help pls!!!
• monoslayer

  12 Jun 06, 16:49

  use ad-aware to remove ur spyware
• lpx88

  12 Jun 06, 16:52

  http://www.sgforums.com/?action=thread_display&thread_id=177927
• FireIce

  12 Jun 06, 16:52

  did u see the sticky up there in this forum?
• ndmmxiaomayi

  12 Jun 06, 19:27

  Download any/all of the anti-spywares listed in the sticky thread, update the definitions, scan and remove.
  
  Next, download HijackThis. Extract it, run and paste the log here.
• casino_king

  12 Jun 06, 19:33

  From Microsoft
  http://www.microsoft.com/athome/security/spyware/software/default.mspx
  
  Online scanning from TrendMicro
  http://housecall.trendmicro.com/
  
  
• casino_king

  12 Jun 06, 19:44

  Maybe it has finally killed off his PC that is why he cannot respond to our suggestions anymore
• ndmmxiaomayi

  12 Jun 06, 19:50

  Originally posted by casino_king:

  Maybe it has finally killed off his PC that is why he cannot respond to our suggestions anymore

  Unlikely. I got a copy of it on my PC now, for testing purposes. My PC is not down yet.
• joeacid

  12 Jun 06, 22:08

  Originally posted by ndmmxiaomayi:

  Unlikely. I got a copy of it on my PC now, for testing purposes. My PC is not down yet.

  Ahh~ i'm not completely dead yet but all my browers are laggy and almost can't load. I've tried a number of recommended software such as TrendMicro and Spybot - Search & Destroy but it doesn't seems to help~ even when its said to be cleaned up, the program is still ard.... Any idea what i can do?
  
  You said u hav a copy in ur PC, hav u found the solution yet?
• StarPuppy

  12 Jun 06, 22:10

  Originally posted by joeacid:

  Ahh~ i'm not completely dead yet but all my browers are laggy and almost can't load. I've tried a number of recommended software such as TrendMicro and Spybot - Search & Destroy but it doesn't seems to help~ even when its said to be cleaned up, the program is still ard.... Any idea what i can do?
  
  You said u hav a copy in ur PC, hav u found the solution yet?

  do you have a copy of your Hijack log?
  
  
• kaobeikaobu

  12 Jun 06, 22:12

  nao hia, install IE7 cannot revert back to IE6.
• Gordonator

  12 Jun 06, 22:21

  see lah, who ask u to go to those xxx websites.
• joeacid

  12 Jun 06, 22:22

  Originally posted by StarPuppy:

  do you have a copy of your Hijack log?
  
  

  i'm not able to use the Hijack-log u gave me... after it dled~ there's this prompting saying: "Cannot open C:/Documents and Settings\joeling\Local Settings\Temporary Internet Files\Contents.IE5\8RSVUNCB\hijackthis[1].zip
• joeacid

  12 Jun 06, 22:24

  Originally posted by Gordonator:

  see lah, who ask u to go to those xxx websites.

  no arh~ i was looking for some torrent to be truth~ Coz my friend bgt a Photoshop and has CD-key but he lazy to pass me his software, so asked me to go dl and give me the CD-key, and i got this bloodly thing from some torrent webpage
• StarPuppy

  12 Jun 06, 22:26

  Originally posted by joeacid:

  i'm not able to use the Hijack-log u gave me... after it dled~ there's this prompting saying: "Cannot open C:/Documents and Settings\joeling\Local Settings\Temporary Internet Files\Contents.IE5\8RSVUNCB\hijackthis[1].zip

  ok..unzip the hijackthis program into your C: and then use the program to write a log file and the log file will be in your root directory
  
  can?
  
  
• lpx88

  12 Jun 06, 22:33

  btw when u got the applications to remove the malicious stuff try to remove them in safe mode
• joeacid

  12 Jun 06, 22:35

  Originally posted by StarPuppy:

  ok..unzip the hijackthis program into your C: and then use the program to write a log file and the log file will be in your root directory
  
  can?
  
  

  Yup~ Here's my HiJack List:
  
  Logfile of HijackThis v1.99.1
  Scan saved at ‰ºŒß 10:36:49, on 2006/6/12
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\System32\devldr32.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  C:\WINDOWS\Sm9lbGluZw\command.exe
  C:\WINDOWS\System32\CTSvcCDA.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\Kerne0110.exe
  C:\WINDOWS\System32\dcomcfg.exe
  C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\WINDOWS\System32\LVCOMSX.EXE
  C:\Program Files\Logitech\Video\LogiTray.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
  C:\WINDOWS\System32\f7c9fd9a.exe
  C:\defender23a.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  C:\Program Files\Logitech\Video\FxSvr2.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Nevo\NevoMedia Player\NevoMediaPlayer.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\conime.exe
  C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Documents and Settings\joeling\Desktop\HijackThis.exe
  
  F3 - REG:win.ini: load=C:\WINDOWS\System32\Kerne0110.exe
  O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\System32\hp100.tmp
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
  O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
  O4 - HKLM\..\Run: [f7c9fd9a.exe] C:\WINDOWS\System32\f7c9fd9a.exe
  O4 - HKLM\..\Run: [defender] C:\\defender23a.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [f7c9fd9a.exe] C:\Documents and Settings\joeling\Local Settings\Application Data\f7c9fd9a.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: NevoMedia Server.lnk = C:\Program Files\Nevo\NevoMedia Server\NevoMediaServer.exe
  O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: Yahoo 1G mail - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
  O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
  O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O16 - DPF: WebControlDeploy - https://grouper.com/v1/GrouperSetup.cab
  O16 - DPF: {00000000-0000-0000-0000-100000000003} - http://code.jcash.biz/l/c16d96011938750a7556d6b3b02a7eba_13.exe
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\dqser.dll
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
• joeacid

  12 Jun 06, 22:36

  There's my Hijacklist on the above post
• joeacid

  12 Jun 06, 22:42

  I even hav this thing on my Tasktray always prompting "Virus Alert!" and then saying i got infected~
• lpx88

  12 Jun 06, 22:44

  u noe how to go to safe mode?u go to safe mode then scan..hopefully the spyware are not loaded in safemode
• joeacid

  12 Jun 06, 22:47

  Originally posted by lpx88:

  u noe how to go to safe mode?u go to safe mode then scan..hopefully the spyware are not loaded in safemode

  Hmm... but i'm afraid my whole PC will crush after i clear those spyware? coz the last time i did going into safe mode and delete actually crushed my PC~ and this time round i dun hav an extra HD to keep all my stuffs
  
  
• joeacid

  12 Jun 06, 22:48

  May i shld wait for ndmmxiaomayi to help me test it out 1st? or... any other recommendation?
• lpx88

  12 Jun 06, 22:54

  Originally posted by joeacid:

  Hmm... but i'm afraid my whole PC will crush after i clear those spyware? coz the last time i did going into safe mode and delete actually crushed my PC~ and this time round i dun hav an extra HD to keep all my stuffs
  
  

  er...why will ur PC crash when u clear spyware?
• StarPuppy

  12 Jun 06, 22:55

  Originally posted by joeacid:

  May i shld wait for ndmmxiaomayi to help me test it out 1st? or... any other recommendation?

  hmm...i am looking at your hijack log...there are some files that look like virus...just double chcking on how to remove it
  
  
• StarPuppy

  12 Jun 06, 22:57

  Originally posted by lpx88:

  u noe how to go to safe mode?u go to safe mode then scan..hopefully the spyware are not loaded in safemode

  just wondering
  
  Diagonstic(typo) mode is the same with safe mode?