HELP WINSPYWAREPROTECT

[Google]

Alright, finnally here:
Logs are too big so I'll upload instead.....


[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Did you save this log before applying the fix in MBAM. They all say No action taken.

Open MBAM and click the Logs tab and post that log please.

[Google]

Ahhh, crap, you didnt tell me to fix. I asked that and you just said reboot!!

[Google]

Ok, well now I am rescanning, since the log was not saved, and here we go again................ *sigh* But thanks anyways.......

[Google]

I'll post when its done and after I "fix". Thanks though, you're really helping.....

[evilfantasy]

 Apologies, please run MBAM again. It will go much quicker this time with  only it running. I will need a new log from that and a new HJT log as all of the entries from MBAM are in it.

# When the scan is complete, click OK, then Show Results to view the results.
# Be sure that everything is checked, and click Remove Selected.
# When completed, a log will open in Notepad. Save it to a convenient location like the Desktop.
# The log is also automatically saved and can be viewed later by clicking the Logs tab in MBAM.
# Copy and Paste the contents of the report in your reply.
# Exit MBAM.

[Google]

Alright Here we go:

Hope I did it correctyl. The virus isnt bothering me anymore; it seems alright.

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Do you know what this is? C:\WINDOWS\system32\fppsys.exe Is it Password Protect?

[Google]

Do you know what this is? C:\WINDOWS\system32\fppsys.exe Is it Password Protect?

I really have no idea. It might be?. I used to have a program called dirlock or something like that, but thats all I think it might be./.??..?1//

[evilfantasy]

Scan Suspicious File(s)

Use the VirusTotal.com - Multi engine on-line virus scanner
(If more than one file needs scanned they must be done separately and logs posted for each one)

• Copy the file path in the below Code box:

Code: [Select]

C:\WINDOWS\system32\fppsys.exe

• At the upload site, click once inside the window next to Browse.
  
• Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
  
• Next click Send File
  • Your file will possibly be entered into a queue which normally takes less than a minute to clear.
• This will perform a scan across multiple different virus scanning engines.
• Important: Wait for all of the scanning engines to complete.
  
• Copy and then Paste the link to the results in the next reply.

.

I also need to know if you have a Keylogger on the PC, there is a KeyLogger.exe in the HJT log.

[Google]

http://www.virustotal.com/analisis/10b5bf5b388cb80435d54b7063a8c80a

Yes, I do have a keylogger installed for personal security.

[evilfantasy]

Were not going to remove it yet. Unless you want to. See HERE.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O3 - Toolbar: (no name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
O9 - Extra button: Voiced Keyboard Homepage - {1ff190e7-38ab-423e-b59c-4d166c2ea5f1} - http://www.yayahoohoo.com (file missing)

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Download ATF Cleaner by Atribune to your Desktop.

Alternate download link

Note: Vista users must use Run As Administrator

• Under Main: Select Files to Delete choose: Select All.
  
• Click the Empty Selected button.
  
• If you use Firefox browser click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• If you use Opera browser click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• Click Exit on the Main menu to close the program.

Note that your system will run slower for a reboot or two after having used this tool so don't panic.

----------

Download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.
Vista users Right click DSS and Run as Administrator.

• Close all applications and windows.
  
• Double-click on dss.exe to run it, and follow the prompts.
  
• When the scan is complete, two text files will open.
• main.txt <- this one will be maximized
  
• extra.txt <- this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply.

.
----------

The Deckards logs will be huge so you will need to attach them. It's a quick scan, less than 5 minutes.

[Google]

Alrighty-O, here you go.......

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Do you know what these are?

C:\ijji
C:\Program Files\MAIET
C:\Documents and Settings\User\.zenmap
C:\Program Files\WinPcap

[Google]

C:\ijji-Gunz online
C:\Program Files\MAIET-Gunz online
C:\Documents and Settings\User\.zenmaphttp://nmap.org/zenmap/
C:\Program Files\WinPcap-Remote Packet Capture Demon