Take a look at this article and post a HJT log. Somebody heere will take a look at it.

http://www.daniweb.com/techtalkforums/thread28196.html

Thanks. :)

Transfered to Spyware forum ;)

Heh sorry for a late reply, but I personally would go with AVG as the resident, and Avast as the manual second.

Thanks.

Awsome. Well I hope we can cure ya :)

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download FixWareout from...

Looks good to me.

Ya still having problems?

Thanks.

Ja, they should.

Let's try this again.
____________

Begin by opening the Add/Remove Programs list and uninstall the following programs:

PartyPoker
PartyGaming

Heh it's alrite, no worries :)

Just be sure to post back (after youre back into it) with the HJT log and the Ewido scan log.

Thanks.

The log looks good to me :)

And yes, be sure to run what T perscribed above.

Thanks.

Ya, what he said :)

And ya, after doing that, a new HJT would be incredible.

Thanks.

Good, that's what I was about to ask for :)

But ya, if it's in the System Volume Information (a.k.a System Restore)...the easiset way to clean it is to flush out the System Restore points.

For...

Alrite, couple more entries to fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
O4 - HKLM\..\Run: [TrustInstaller] "D:\Setup.exe"
O16 - DPF:...

Look! Somebody bright enough to do research themselves!

Heh good job :) And awsome job researching.

Thanks.

Roger that, it's a clean log.


However, I just want to be sure of 1 thing--this was run in Normal Mode (not Safe mode), right?


Lastly, are ya having any problems?

Thanks.

Awsome, looks clean to me :)

Are ya having any more problems?

Thanks.

Heh it's cool.

Try disabeling Panda Antivirus before downloading again.

O ya, and by the way, this isn't abnormal--oftentimes AVs accuse other AVs of being spyware and such.

Thanks.

Hmm, definitely sounds like spyware to me.

I'm going to move your thread into the Viruses/Spyware/Nasties forum.

In the meantime:

Download HijackThis...

Heh, sorry for being vague.

When I say 'Fix' I mean this:

1) Open HJT
2) Click 'Scan'
3) Place checks next to the lines mentioned
4) Close ALL windows (including this one), and hit 'Fix...

Looks all good to me, except for 2 entries. Fix the following:

O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} - C:\WINDOWS\system32\winbrume.dll (file missing)
O4 - HKLM\..\Run:...

Welcome to Daniweb:)

To clean things up somewhat, we're gonna run a combination of Ewido and CCleaner:

Begin by downloading CCleaner (http://www.filehippo.com/download_ccleaner/), and...

Roger that, that's a clean log :)

Are ya having any more problems?

Thanks.

Hmm, disappointingly, I see nothing definitive in your log that points to the problem.

However, I AM suspicious about a couple:

1)ResChanger 2005 - Do you know what this is/use this program?
...

Well, it really all depends on whether ya got it along with MSN.

Oftentimes, MessengerPlus3 is a valid sign of bad viruses etc, mostly becase it's often connected to the virus.

However, if ya...

Awsome.

Begin by uninstalling the following programs via Add/Remove Programs:

MessengerPlus3
Viewpoint Manager

Now, open HJT and place checks next to the following:

O4 - HKLM\..\Run:...

Ok, I see several things.

First, let's fix the LSP.

Download LSP-Fix (http://www.bleepingcomputer.com/files/lspfix.php) and run it, fixing what it tells you to.

Next, continue by downloading...

Good good, last thing, could we see a HJT log?

Thanks.

Ok, that's very good that CCleaner ran.



Er..not exactly. THe only 2 things that expire are Auto updates and a background guard...neither of which is necessary to run.

Just be sure to...

Nope, I have a strong feeling that, since its a *.tmp file, its spyware.

SO, after disabeling it, run CCleaner and Ewido again.

Thanks.

O ya, last thing. Ya might wanna consider switching over to FireFox browser. It's very similar to IE, except, its safer and more secure (and therefore have less spyware and such)

This is because...

Oftentimes, this depends on the sites ya go to.



Although I fix this sometimes, it's not really necessary--it's about inter-router fixings and such.

Ya can fix it if ya want.

Awsome. If ya could mark the thread as solved, it'd be great.

Thanks again :)

Sure thing, that's a clean log.

About the 2 AVs, here's (http://reviews.cnet.com/5208-6130-0.html?forumID=7&threadID=116760&messageID=1327144) a good website about it. I'd recommend reading it....

Exactly. But, the ~ in the name means that the computer doesn't know exactly what letter, per say, it is.

SO, with luck, it'll appear in the Processes as
~e5d141.tmp . However, it's more...

First off, I forgot to look at this, but I see a problem right off: You're running 2 antiviruses. When this is done, it can cause some major problems.

Currently, you're running both AVG and...

That's a clean log.

Are ya still having problems?

Thanks.

Alrite, that log looks clean.

Are ya still having probems?

Thanks.

Hmm, alrite. We'll leave that folder alone for a minute. Open HJT and fix the following:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 -...

Hmm...that IS odd.

Adh, try looking inside the System32 folder for other folders that could be similar (where the ? is any letter)

Possibilities are:

Fants
Funts etc...

Report back on...

Arg, stuipid me. I KNOW THE problem :mad: . Disable SpyBot Teatimer, and then try SmitFraudFix once again.

But other then that....Heh GOOD JOB. I don't see that specific infection in there. ...

Hmm, lets try doing this (the log looks great by the way).

Uninstall the program that keeps holding up Adaware. Fully uninstall it.

Then, try running adaware, and see what happens.

Post...

Looks good to me.

Any more problems?

Thanks.