rookie with virus problem

[evilfantasy]

Yep.

On the right, under Complete Scan, choose Perform Complete Scan.

[rookie47]

It said no infected files, question: when I checked those items in the scanning control, should evrything else be unchecked?

Look at my last post before this one,,, I added stuff there and the HJT Log

[evilfantasy]

Yes, the items that are unchecked are only useful with the paid version of SAS.

What do you think? However, XoftspySE still shows these after a scan:

Drowor D Trojan           c:\WINDOWS\SYSTEM\INTERNAT.EXE
Virus.Win32.Delf.ak      c:\WINDOWS\RUNDLL32.EXE

I don't fully trust XoftspySE.

Read the reviews on This Page to see why.

Looking at the HJT log.........

[evilfantasy]

You need to go and change the HijackThis log to a text (.txt) file and attach it again so I can open it.

[rookie47]

HJT Log

The scan came up with "No infected files" ,,, after over 1 hr of scanning I might add ,,, talk about a long process,,,

I just ran Xoftspy again,,, the same two warnings come up ,,, when I remove this one:

Virus.Win32.Delf.ak   c:\WINDOWS\RUNDLL32.EXE

and then I go to - Start - Control panel - Internet options -

I get this error message: Windows cannot find C\WINDOWS\rundll32.exe

[getting disk space - attachment deleted by admin]

[CBMatt]

I contacted CBMatt and he showed me a link to old post, which had another link to a web page that showed me how to read a log file.

Whoa, whoa, whoa...I think you may have misunderstood me.  In my PM to you, I stated:

If you're truly interested in getting involved with the program, you'll want to try out one of the schools mentioned by oddjob.

It takes a lot more than reading a few tutorials to be able to fully understand logs.  There are many special cases and treatment methods that aren't covered in these tutorials.  Your desire to help is appreciated, but until you can truly comprehend everything in the logs, you won't be able to properly help.  This is why I advise taking a course if you really want to help out.

[evilfantasy]

I don't know what else I can say about XysoftXE except UNINSTALL IT and DO NOT trust it's findings!!!

I linked you to the site advisor report which includes

If you download XsoftSpy trial and take a scan, the app will find "spyware" on your computer. But you have to buy the software to get rid of it. And if you then buy the software, you suddently doesn't have any spyware on your computer. So it trick you to buy the program.

Paretologic's products has aslo been listen as rogue spyware programs at spyware warriors. It's de-listed now though. But so people know.

You are also getting advice from at least one other help forum that I know of. This is risky, not only to your computer but to MY ability to spot the problems.
You are running fixes that I am unaware of. It could easily be seen as something I advise has done damage when it wouldn't be the case. So therefore I am stepping away from this thread.

Good luck.

Safe surfing.

[rookie47]

That's crazy, I was on CNET Forums and only showed them the HJT Log and  did a SuperAtispy Scan, that was all. Look at the posts over there, I opted out of that one a while ago. I was making progress with your ideas and felt comfortable with your help. I have done nothing to my computer other than what you have instructed me to do. I'm sorry if you feel you have been wronged but it's not like that at all. If you don't want to continue to help me because I was trying to correct a problem and you have a false sense of trustworthyness, then that's just lame.

[evilfantasy]

I don't feel wronged, I am just being safe.

Trustworthiness goes both ways.

I have warned twice against trusting the XysoftSE findings.

BitDefender only showed infections in the java cache which you removed. I have complete faith in the BitDefender scanner.

SUPERAntiSpyware showed no threats. I have faith in SAS as well.

XysoftSE on the other hand.......I do not trust at all.

Remove XysoftSE, run CCleaner, reboot, scan with Spybot, SUPERAntiSpyware and your antivirus and see what (if anything) is found.

[rookie47]

OK, thanks ,, glad to have your input back.

I just ran Spybot and it says I have 5979 infected files ,,,

Is this possible?

Do I have to Purchase Spybot to remove these?

Should i buy it, I have the form ready to go ,,, Do you recommend it?

[Broni]

Spybot is free. Where did you go to get it?
Here? http://www.safer-networking.org/en/index.html

[evilfantasy]

As Broni stated, where did you get it from?

Is it Spybot Search & Destroy (spybot s&d)? Or is it another name?

Spybot is and always has been free. Use Bronis link for a safe download of the program.

[Aussie]

Aussie (new member) here.
I have identical symptoms as Rookie47.  I run WinMe with AVG Antivirus, Spybot S&D, AdAware & XoftspySE.  Xoftspy was the only program to pick up a block of four problems which I 'removed' to quarantine. Upon reboot,  Drowor D Trojan comes back.
Decided to close restore function as often this carries and reinstates deleted problem, only to find cannot run C:/windows/rundll32.exe to open from control panel to deactivate restore function.
Both Rookie47 and myself have 'picked up' same problem.  I wonder did quarantine remove the rundll32.exe function? Should I reinstate the 'deleted quarantined' items and try different approach? Where are you now with your problem Rookie47?


 

[Broni]

Welcome aboard, Aussie
You need to post a new topic about your problem.

[rookie47]

Right at this moment I am having problems. I can't access anything from the control panel without getting the error message. I also checked for updates on the Spybot (which will not open everytime) and now I'm having more problems, It's telling me it detected an important registry key that's been changed, asks if I want to allow the change or deny it? I have no clue what to do. I closed all my programs and rebooted, brought up Internet Explorer, clicked on my favorite files and got this message. Now what's going on? I'm a novice at this stuff, I use this computer for my work and if I lose it I'm in deep trouble. The only thing I can think to do is shout a big - HELP!

" Should I reinstate the 'deleted quarantined' items and try different approach?"

I no longer have this option, last night I completely removed Xoftspy from my computer