Let's start with this so that we can get an overall idea of what's lurking in your computer:
Download the (free) HijackThis utility:
http://www.stevewolfonline.com/Downloads/DMR/Spyware%20Tools/HJT/HijackThis.exe
Once downloaded:
Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.
Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...". Save the log in the folder you created for HiajckThis, open the log in Windows Notepad, and cut-n-paste the entire contents of the log here.
The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
OK- you've got a few things going on there, but there's one thing you need to fix first:
1. C:\DOCUME~1\JOHN&J~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
The log entry above indicates that you are running HJT from within a Temp/Temporary folder. Please do the following:
Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.
One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
2. But everytime I run my Spyware, it finds it again
I'm assuming that you mean AOL's anti-spyware tool, yes? Can you look through the details of the program's scan and tell us exactly where AOL is finding the infection please?
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
1. This entry in your log does indicate that HJT is running from a Temp folder:
Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
Another strange thing about that entry is that it makes reference to hijackthis[1].zip. The version of HJT I gave you the link to isn't a zipped file at all (it's just the regular hijackthis.exe executable); downloading it shouldn't have created a Temp zip folder.
Have you ever downloaded HJT before? The version offered at many sites is in .zip format, which might explain things.
2. A lot of P2P programs create registry entries under the folowing Registry keys; these are probably what AOL is detecting:
HKEY_CLASSES_ROOT\: magnet
HKEY_LOCAL_MACHINE\software\magnet
HKEY_LOCAL_MACHINE\: software\classes\magnet
Please do the following:
- Open the Windows Registry Editor. To do so, click on the "Run..." item in your Start menu, type the following in the resulting "Open:" box, and then click OK:
regedit
- Navigate through the Registry folder structures to the three locations I just listed above and tell us what entries exist under each.
!! DO NOT actually delete or change anything in the Registry at this time!!
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
Hmm- those Reg keys are the ones that others have reported their AOL antispyware to be flagging; if it isn't those I'm not sure where else to look.
Then again, just because an anti-spyware app flags a registry entry doesn't necessarilly mean that the entry is part of an active infection. Reg entries and other settings sometimes get reported just because they might be indicative of an infection, or because they indicate a loophole that an infection could possibly take advantage of. The infamous "DSO Exploit" issue with SpyBot Search & Destroy was one example of that.
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
