How To Kill Undelete-able Spyware?

**Legio XX Valeria Victrix** · March 24, 2006, 03:06 PM

I've got a big problem right now. I was using a file-sharing program for music and such, but decided to delete it from my computer when it went foul (re-opening itself on its own). Foolish to download it in the first place, I know...

Anyways, apparently this program has now, upon its deletion, triggered an ungodly amount of spyware and even trojans onto my computer, and I have no idea how to completely remove them. Currently, I have Ad-aware Free edition and am running Windows Firewall and Microsoft AntiSpyware. I've run at least five scans to find all the stuff, which it is finding. However, when I try to delete the bastards, a certain few aren't deleted, but are ignored instead. When I go into Windows Explorer and try to delete the folders of these spyware programs myself, it won't let me because it says that the program is in use. Nor does using Add/Remove Programs in the Control Panel get rid of them either.

So, I'm wondering, are there any special methods to killing these types of spyware that won't even be deleted by an anti-spy program, or are there any tougher anti-spy programs that I can use to trash these annoying buggers?

**invictus** · March 24, 2006, 03:14 PM

Well sux for you problem bud. Im not 100% sure this will work, but its a great program, and totally online. I wont post the link, cause not sure if i really can, last time i psoted one i was told something, but its called trendmicro, and its free. Hope it helps. -Leon

**Last Roman** · March 24, 2006, 03:17 PM

something similar happened to me. I suggest a system restore (worked for me anyway)

**Legio XX Valeria Victrix** · March 24, 2006, 03:25 PM

Originally Posted by Last Roman

something similar happened to me. I suggest a system restore (worked for me anyway)

That sounds not good. Don't those delete practically everything from your computer?

**Incinerate_IV** · March 24, 2006, 04:41 PM

Nope, you won't lose any files by using system restore, but it does restore the registry, so it might work. By the way, the best possible spyware scanner right now is Spy Sweeper, its not free, but it does detect EVERYTHING. So you might have a look at this.

http://www.download.com/Webroot-Spy-...7.html?tag=pop

Also download and install Spybot, no anti-spyware program is perfect, they all got different methods of detecting spyware, some are good against one kind and some are good against another kind.

http://www.download.com/Spybot-Searc...ml?tag=lst-0-1

Lastly, update all your anti-spyware program.

**Zuwxiv** · March 24, 2006, 04:56 PM

Check your task manager, google all the processes. It is generally pretty easy to find all the crap that is running in the background.

**Timmius** · March 24, 2006, 05:34 PM

Well I'm geussing you've tried anti-spyware programs like Spybot and Microsoft anti-spyware beta. Maybe you could try ccleaner. You could also google for specific spyware killer. Sometimes there are spyware that just can't be killed by regular programs. Then people fortunately make specific program for it. A good example is the coolwebsearch malware of some time ago. This couldn't be deleted by the regular anti-spyware programs and therefor there was a program especcially written to get rid of coolwebsearch, called wwwshredder.
But one of the most thourough ways is Hijackthis. You can run it and post your log here
Be carefull though. If you're not sure about what you're doing, you could screw up your pc.
And if it still doesn't go away you should find some good tech forum where they can help you.

HF

**invictus** · March 24, 2006, 07:22 PM

Well is there anything aside from a format that will completely remove spyware and viruses? -Leon

**Mímirswell** · March 24, 2006, 07:30 PM

List exactly what's not being deleted. Then Run Hijack This and post the log. I'll talk you through it from there. Do everything Incinerate_IV told you to prior.

System Restore just reverts the registry back to the configuration from the date the waypoint was created.

**Legio XX Valeria Victrix** · March 24, 2006, 07:39 PM

Thanks for the tips, guys, I really appreciate it. I think I nailed most of it, I had particular problems with a trojan whose name I can't remember, and two adware programs: SurfSideKick and NetDotNow. I uninstalled both of them, but am still suffering from a very strange pop-up problem.

I keep getting one pop-up telling me I have some 'blackworm' virus, but no other spyware program or any such program I have run has detected any such worm, and since the thing telling me I have it is after all a pop-up, I ignored it.

Anyways, the strangest part is that I cannot access my Task Manager at all. I hit Ctrl-Alt-Delete repeatedly, and there is no response. Is there any other way to access the Task Manger other than that. By the way, my operating system is Windows XP Home edition. It might be good to know how to do a system restore as well.

So far I have run Ad-aware SE, Spybot, and Microsoft Antispy Beta, and not all of it is gone. I will try the Hijack This program in a little while, at the moment I have to go to a hockey game. Thanks again for the help, guys!

**Spiff** · March 24, 2006, 07:55 PM

Originally Posted by Legio XX Valeria Victrix

Anyways, the strangest part is that I cannot access my Task Manager at all. I hit Ctrl-Alt-Delete repeatedly, and there is no response. Is there any other way to access the Task Manger other than that. By the way, my operating system is Windows XP Home edition. It might be good to know how to do a system restore as well.

start--run--"taskmgr"--ok

if it doesnt pop up then something suspicious is going on

**invictus** · March 24, 2006, 07:46 PM

Hello mimir, and sorry legio for seeking help also

, i tried that hijack program and this is my log. My problem is pop ups if that helps. -Leon
P.S.
I forgot how to put files on here forgive me.

Logfile of HijackThis v1.99.1
Scan saved at 5:44:40 PM, on 3/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\1140445716\ee\AOLSoftware.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Documents and Settings\All Users\Application Data\Stupid warn ooze peak\RegsSlow.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Documents and Settings\Leon\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {22F232D4-7D13-296E-6A1C-9FC99BFCD6C3} - C:\DOCUME~1\Leon\APPLIC~1\GRIMGP~1\Bird Cdrom.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1140445716\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [OozePeakBiasJunk] C:\Documents and Settings\All Users\Application Data\Stupid warn ooze peak\RegsSlow.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Army knob] C:\DOCUME~1\Leon\APPLIC~1\LOVE16~1\BALL MPEG GREY.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

**Mímirswell** · March 24, 2006, 08:01 PM

Remove:
O4 - HKCU\..\Run: [Army knob] C:\DOCUME~1\Leon\APPLIC~1\LOVE16~1\BALL MPEG GREY.exe
O4 - HKLM\..\Run: [OozePeakBiasJunk] C:\Documents and Settings\All Users\Application Data\Stupid warn ooze peak\RegsSlow.exe

Then go to start -> Run -> Type 'Msconfig'
Go to the 'Startup' tab and disapply all, click apply and restart your computer.

Run Adaware, S&D and any other spyware programs you are using and then repost a new 'Hijack this' log.

**dorian_zuleta** · March 24, 2006, 08:11 PM

I just overcame that same problem about a week ago. I tried every virus and adware remover and it just will not remove that one file cuz it is being used by another program. I tried to run the same in safe mode and still being used by another program so I feel your pains. I even tried removing it by using Linux operating system(a non windows o/s for you non geeks outthere) and still no luck.

Luckily I have a registered version of windows (new Laptop hence windows is legal) and I went to their website and downloaded Windows Defender and that ish killed the undeleteable trojan file. This only will work if you have a registered version of windows. It did help me out. Now My comp is runnin completely well.

Some advice: most adware ish is hooked to Internet Explorer, use Mozilla Firefox instead and it reduces a lot of unwanted crap.

**Pent uP Rage** · March 24, 2006, 08:16 PM

Wow, all this useful information. Go figure, theres a sticky spyware removal thread at the top of the Basement section.

**Mímirswell** · March 24, 2006, 08:23 PM

Looks like you probably got it. Play around in IE and see if you get more popups. If you don't get any, I do recommend downloading Firefox anyhow. Also, go to Msconfig again and enable the programs you want to load at start (I keep mine to a minimum).

**invictus** · March 24, 2006, 08:19 PM

Logfile of HijackThis v1.99.1
Scan saved at 6:19:02 PM, on 3/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Documents and Settings\Leon\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {22F232D4-7D13-296E-6A1C-9FC99BFCD6C3} - C:\DOCUME~1\Leon\APPLIC~1\GRIMGP~1\Bird Cdrom.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe