spyware problem

Breaker

Veteran XV
Hey guys..
I made a post I think earlier last month on here.. about my computer rebooting and crapp`n out on me and such?? Turns out..
I had a nasty worm on my pc...

SO I reformatted bla bla..
and everything started working perfectly again.. but god damnit
last night it fucking started back up again! it's ony been a few weeks!!
it might be a hardware problem, but serously, Im pretty convinced its still this virus/worm/ WHATEVER...

because anytime I do a scan, it locks up
Ill get a shitload of pop up's AND then it will lock up... but hey, you guys know more about this shit then me, I'm really in need of some help..


Spybot fully updated, here's the log...
------------------------------------------------------------
------------------------------------------------------------
------------------------------------------------------------
Command Service: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService

Command Service: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdService


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
------------------------------------------------------------
------------------------------------------------------------
------------------------------------------------------------

When I try to "fix the 2 selected" Registry problems, I receive this message :

"Some problems couldn't be fixed; the reason could be that the associated files are still in use (in memory). This could be fixed after a restart. May Spybot-S&D run on your next system startup?"
which of course I say Yes to. Apon rebooting however, I am faced with the same 2 detections and question... It can't remove them and still suggests I reboot.

I also have ran Adaware fully updated, and it comes back with absolutly NO problems...
so now for the one that really matters : here's my Hijackthis log :

Logfile of HijackThis v1.99.1
Scan saved at 8:07:17 AM, on 12/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\Breaker\MYDOCU~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Documents and Settings\Breaker\My Documents\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Freeprod Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
O9 - Extra 'Tools' menuitem: Freeprod Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

I've tried to remove this in safe mode,
regular mode, every mode... and still I can't get rid of those 2 reggy's
I will admit that I don't have enough knowelge about regedit to try to go in and take anything out...

I also am sure that my hijackthis came back with a LOT of other stuff that needs to be removed, but again I admit my ignorance...

any help would be great! thank you for your time!
-b
 
Hijack This! log seems fine except for the two Freeprod toolbar entries, I'd fiy that if I were you. Not sure what that H2O thing is, is it some app you use?
 
The hijack log has a few more suspect issues.

break your connection from the net(shut off modem or whatever)

boot in safe mode....

Make sure you aren't hiding any files or system files and navigate to..
C:\Documents and Settings\insert whatever login profile here you are using here\Local Settings.

the local settings folder will be hidden if you dont have it enabled. You will know you are in the right profile if both folders have alot of items in them.

delete everything in both the temp folder and the temp internet folder in that location.

once all is deleted run spybot or adaware again as there is most likely a trojan or dialer in that folder that will continue to redownload the bs infecting your system.

post an update back as it seems i have become pretty decent at finding bullshit problems like yours now that my kids are accessing the net.
 
Most "good" spyware these days run as hidden system processes(kernel level). If the anti-spyware programs don't have defs for it, it's usually quicker to reinstall the OS than to dig it out by hand.
 
Back
Top