[mphenterprises]

This is not a HiJackThis site. There are only a small handful of people within this forum who can deciphering a HiJackThis log. I would assume the Trend Micro scan is online, correct?

[ak03]

Thanks a ton! Downloading and running now.

[mphenterprises]

Even though a reinstall would definitely correct this problem, I think it is still too early to consider that option. This computer is basically not protected from anything. A thorough cleaning is in order before anything else. If, after doing several extensive scans, this computer still shows signs of any malicious applications, then it may be a good time to investigate a reinstallation.

[ak03]

Trendo Micro Scan Is done through www.pctipp.ch/downloads/sicherheit/35905/multiavscanning_tool.html

[ak03]

I'll Post here what SuperAntiSpyware is finding:
Adware.Vundo Variant 13 Infections

Adware.AdSponsor/ISM 71 Infections

Trojan.Downloader-Gen/NX 11 Infections

Adware.Vundo-Variant/Small-A 6 Infections

Adware.ClickSpring 8 Infections

Adware.SearchTool 8 Infections



TOTAL: 117 Threats

[mphenterprises]

That really isn't necessary. I would suggest only posting anything if you run into a problem. Like, for example, if one application does not run properly or gives you an error message. Other than that, you should be okay.

[techie4fun]

117 infections eh? Sweet!

[ak03]

I ended up with 470 infections. 230 of them were tracking cookies. The SuperAntiSpyware program is cleaning now. Taking forever I must say.

[techie4fun]

YIKES.

Keep it coming.

[mphenterprises]

Yes, it is one of the most thorough security applications I have seen. I have it in my arsenal as second tier security application.

[ak03]

It didn't work. I am going to run a full system scan on AVG Spyware, and try to remove Mcafee one more time. If this doesn't work then I don't know what to do.

[mphenterprises]

AK, you are giving up too easily. Please follow the steps that were listed and don't try to remove the McAfee application until you have ran all three of those new security applications in both the regular and Safe Modes. This computer is infected beyond one scanning. You are going to have to dig to get this resolved.

Additionally, EvilDave mentioned that there may be a previous backup of this computer through Norton Ghost. If you feel you do not want to do anymore with the scans, check Ghost to see if there is a backup. If there is no backup, it's back to the scanning.

[ak03]

I will try to scan some more. However, I do see a backup dating all the way back to November 6,2006 on his computer. I'll try it a my last resort if the scans don't work

[piyushsingh]

The backup is a bit old . When it comes to viruses and malware - prevention is the only cure . Cleaning a heavily infected system is a tough task , time consuming and more importantly , you wont be able to clean all the infections completely. Even if the executibles are detected and removed, the registry changes remain to interfere with normal operation. That is where cleaning of infections become more important than just deleting/quarantining infected files . And as far as my experience goes mcafee has pretty good cleaning abilities.Were the virus definitons updated regularly before ? Is the mcafee product that ur friend uses antivirus only or is it virus scan plus(antispyware also) ?

You should consider talking out the data on removable disks and do a format , then scan the removable disk with multiple anti-viruses before copying your data again to the pc.

[SpiritWind]

Hi :



Your friend's computer is badly "infected"; having Virtumonde, Vundo & Delf require the use of "speciality"

programs that are used by experienced, trained, certified VOLUNTEER "Malware-Fighters" found on

many Support Forums and since this computer has Spybot, I recommend THEIR "Malware Removal"

Forum at http://forums.spybot.info/] ; be prepared to run and Post logs from HijackThis, ComboFix, and


VundoFix . There is a slim Chance that the Delf "infection" may be eliminated by using
a special program that has been developed to combat SOME "versions"
of this located at [kil.exe

[ak03]

It was an internet security suit

[rgreen4]

Going back through this discussion, I have to second EvilDave's solution. When a drive is so badly infected the only solution is to re-format.

The full reinstall process of XP takes about 60 minutes from start to finish. A restore from a manufacturers image disk may be quicker.

The most difficult part is to back up critical data and gather up the original program discs with authorization codes. Some times these get scattered.

I would do one thing else. If you have a Windows98 start floppy, I would fdisk the HD, then completely format it, then do the re-install. Some may say this is overkill, but this system is so badly infected, I would take every available option to thoroughly scrub it.

[ak03]

The thing that makes me not want to wipe and reinstall is, the computer is running pretty good. I have gone onto the internet with it, and no adware has been popping up. AVG and SUPERAntiSpyware have both said they gotten rid of the remaining spyware. Now I'm going to do another full scan with kaspersky (Through Multi AV). If I still can't get the mcafee off then I don't know what to do.

BTW Norton Ghost has expired

[mphenterprises]

Have you follow the steps laid out previously? Again, this is not an easy process. As Piyush eluded to, this computer is so infested with malicious files that it is conceivable that even the registry is affected. Please make sure you run all three scans while the computer is in normal mode as well as in Safe Mode. If you elect to run online scans, you may have to run those scans multiple times as well.

Since Ghost is not an option, you only have two choices...either press on with the scans or reinstall...there is really nothing else you can do at this point.

[ak03]

I am going to press on for scans until I can get the install cd. Kaspersky did detect that I had trojans and a virus or two that it couldn't delete. Thanks everyone for the help. I'll post back on what happens