Spyware Help please

Hi Flyersguy

yep, is a PITA

Try this for "betterinternet"


This is how I finally got it cleaned.

With regedit

Hkey_local_machine\software\microsoft\windows nt\current version\winlogon\notify\guardian

Right click on the guardian folder and select permissions
Advanced button
Uncheck inherit from parent permissions

You should be able to clean in off after that.


You will have to click remove on the first little window that comes up .
Then you will have to click apply, and then ok.

After that you will have to remove the offensive files.

The two files you probably want to delete are :
C:\WINDOWS\SYSTEM32\akmpvcno.cpy.dll
and
C:\WINDOWS\SYSTEM32\akmpvcno.dll

You may be able to delete akmpvcno.cpy.dll once you remove the permissions from 'guardian' I think. However, you will have to restart your machine to remove akmpvcno.dll

So restart, This worked for me, but my 'offensive' files were named afsldpc.cpy.dll and afsldpc.dll adaware only noticed afsldpc.cpy.dll .

I should also note that I am using windows XP home. I knew this worked right away when I restarted because it didn't sit there loading up my personal preferences FOREVER anymore.

good luck and i hope this works for you too.
(p.s. do an adaware scan after you are finished to see if you actually killed it, and to clean out all the gunk it leaves behind)


I removed permissions. I left the guardian 'folder' thinger there. It's turned into an empty folder, and I'm happy with it if it really wants to be there.

then i restarted and removed the 2 dll files in the system32 directory. It's 3 days later, and still no sign of vx2.

Found it here: http://www.lavasoftsupport.com/index.php?showtopic=24265


Have to look around for VIRTUMUNDO though ... will post if I find something\anything

Have a look here:

http://www.kephyr.com/spywarescanner/library/targetsoft.inetadpt/index.phtml

After you are done - run ad aware, spybot and the LSPfix !

Good Luck !

Thanks for help.

Before I did your advice, I ran a virus scan from pandascan free online virus scan. I believe it found a Trojan Horse Virus (didnt give me the name, just called it Tjr or something like that) It disenfected the file and I thought that would completely fix it, however, it didnt.

I did not have that virus on my system this morning, so I am sure its associated in someway with the spyware on my machine.

Either way, after getting rid of the virus I am still getting tracking cookies in my ad-aware scans, firewall alerts asking if I want programs to access the internet, and also everynow and then when I am on IE, a seperate IE windows will popup that just says Microsoft as its name...it wont open or anything...it immediately closes.

I just tried what you told me and am about to reboot. Thanks for help, keep that advice comming if you can.

Brian

Also, when I reboot, I have noticed that Rundll32.exe is running in my backround programs even though I have it disabled in my msconfig...does this mean anything?

thanks

Brian

Yep - have seen it ......

I guess, the easiest way to figure it out is:

Download and run HijackThis - get it here:

http://www.tomcoyote.org/hjt/


Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Click: "Save Log" (generates: "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates: "startuplist.txt")

Next, go to the link below.

http://www.wilderssecurity.com/ > Browser Hijacks and Spyware Problems > Browser Hijacks and Spyware Problems


and post your "hijackthis.log". There are the experts and they will tell you what to do.

This will also be the "fastest" way to remove this stuff.

Pls. as you post your log - you should save HijackThis in its own folder like C:\Hijackthis - so the backups will stay in that folder.
Also pls. tell them what you already have done to get rid of it - this way it will be easier for you and them to help you.

Good Luck!

plz let me know how it goes..for 2 days ive tried most everything asked and i cant get rid of it...exactly the same thing youve described..i am the point this weekend of putting my recovery disk in and starting over