Help! Spyware/Malware on my computer

[xSmootx]

Here's the scan results list

Scan results list

Also wanna say thank you for all your help, you're a lifesaver man.

[evilfantasy]

This is a tough one because those files were not fixes by the scanner and there are both legitimate and non-legitimate files with the same names running from the same location.

Scan Suspicious File(s)

Use the VirusTotal.com - Multi engine on-line virus scanner
(If more than one file needs scanned they must be done separately and logs posted for each one)

• Copy the file path in the below Code box:

Code: [Select]

C:\Windows\system32\termsrv.dll

• At the upload site, click once inside the window next to Browse.
  
• Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
  
• Next click Send File
  • Your file will possibly be entered into a queue which normally takes less than a minute to clear.
• This will perform a scan across multiple different virus scanning engines.
• Important: Wait for all of the scanning engines to complete.
  
• Copy and then Paste the link to the results in the next reply.

.
-----

Now do the same with

Code: [Select]

C:\Windows\system32\winlogon.exe

[xSmootx]

termsrv.dll http://www.virustotal.com/analisis/8b221340fba35115dd354137262600e4

winlogon.exe
http://www.virustotal.com/analisis/dfb0e869b9b69bacdec1c27511ca6a0d

[evilfantasy]

With only 2 scanners (and the same ones) hitting on those files I am thinking false positive. They are running from the correct location so I would have to think they are legit.

Download ATF Cleaner by Atribune to your Desktop.

Alternate download link

Note: Vista users must use Run As Administrator

• Under Main: Select Files to Delete choose: Select All.
  
• Click the Empty Selected button.
  
• If you use Firefox browser click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• If you use Opera browser click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
  
• Click Exit on the Main menu to close the program.

Note that your system will run slower for a reboot or two after having used this tool so don't panic.

----------

1. Double click OTMoveIt2.exe to launch it.
If using Vista Right-Click OTMoveIt and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)

• When finished exit out of OTMoveIt2

Important: Restart the computer before continuing.

----------

Next: Set a New Restore Point to prevent possible reinfection from an old one.

Please go to: Start -> All Programs -> Accessories -> System Tools -> System Restore -> System Restore Settings
Click to add a check mark beside Turn off System Restore and click Apply
When you are warned that all existing Restore Points will be deleted, click Yes to continue and wait a few moments to let System Restore clear.
Uncheck "Turn off System Restore"
Click "Apply," and then click "OK".

You can find more detailed instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide

----------

Use the Secunia Software Inspector to check for out of date software.
Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

----------


How is everything now?

[xSmootx]

I was messing around on here doing my daily stuff and all and it seems ok. I may have to reinstall wmp11 so that online videos work in wmp11 instead of mplayer2

The scan caught some out of date stuff but out of personal preferences, I'll keep what I have on here.

Again, thanks a ton man you've been really awesome 

[evilfantasy]

Try installing K-Lite to see if it clears up Media Player - http://filehippo.com/download_klite_codec_pack/

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[xSmootx]

Thanks, I'll keep this thread and site around for any future problems if they come up.

[evilfantasy]

just let us know if anything else comes up.

Safe surfing.....