Antivirus XP 2008

[Dmitry]

Have any of you heard of this? I got back from being out of the house all weekend and when I start up my computer I have this shit on there. Whenever I try to run the uninstall it always "encounters a problem", and trying to do it through add/remove programs doesn't work. There's no option to close it either, just brings up the stupid interface when I right click it, and it has the same options in both places.

I'm 100% positive it's some form of spy-ware but I can't think of how to get rid of it right now. Halp plz.

[Guyverarmor]

I had those put on my computer after my fiance' used my computer one night for trying to play games on Pogo, or what have you. I used AVG in safe modem, ran it a couple of times.Also used Spybot as well. Got rid of it eventually.

I googled this spyware, and apperently to byass all of the scans, you can go into the registry and program files, and delete it as well.

[Dmitry]

Thanks for the tips. I was thinking about looking in the registry just didn't want to get into that right away tbh. It's so annoying to have on.

[Gippo]

the dual force of combofix & spybot will cure you , young padawan

[Sho]

Oh fuck that thing. Download "Malwarebytes' Anti-Malware" (Type that in google), clean ya comp right up.

[LD]

I got this a few weeks ago when my mother was using it. Took me all night to get it back to normal. I did a lot of regist cleaning, but Malwarebytes cleaned up the worst of it. The Blue Screen of death screensaver was particularly evil. -_-

[Roranora]

My desktop has had this for about 5 weeks now. >.>; I tried to delete everything through the registry, but I can't delete one directory. ._. I've tried Kaspersky, but I can't finish a scan as my computer blue screens after about 5-10min every time. The blue screen message varies with what it says, but sometimes the message is BOGUS_DRIVER, which led me to find this page. I did everything those posts say, and it still blue screens regularly. At this point, I've given up; it looks like I'll have to reformat.

[Sho]

My desktop has had this for about 5 weeks now. >.>; I tried to delete everything through the registry, but I can't delete one directory. ._. I've tried Kaspersky, but I can't finish a scan as my computer blue screens after about 5-10min every time. The blue screen message varies with what it says, but sometimes the message is BOGUS_DRIVER, which led me to find this page. I did everything those posts say, and it still blue screens regularly. At this point, I've given up; it looks like I'll have to reformat.

Did you seek out Malwarebytes' Anti-Malware? It usually gets rid of this specific Malware.

[Roranora]

Not yet, no. If you think I'd be able to get it downloaded and complete a scan before my PC inevitably freezes again, I'll give it a shot later today. Either way, I appreciate the advice.

[LD]

are you sure it's really the BSoD? the fucking thing is set as a screen saver and it went away when I hit F8.

[Dmitry]

I had to delete it from the registry twice, deleted all the files on my hard drive, and deleted my start menu shortcuts just to be thorough. lol

Since I got this I've been getting BSoD's at startup with random error messages like "panic_swich_(something" don't remember the third word, and "paged_file_in_unpaged_area" or something similar to that.

I'll try the other things you guys suggest, but this malware is a bitch. lol

[Roranora]

Did you seek out Malwarebytes' Anti-Malware? It usually gets rid of this specific Malware.

I just finished scanning, and it didn't pick up anything. I'm in safe mode now and I was able to delete the suspicious directory from the registry this time. And then in my system32 directory, I found the BSoD screensaver (blphc3ekj0ec67), phc3ekj0ec67.bmp (the background to which the malware would change yours) and a pphc3kj0ec67.exe file. The exact file names will vary, but it's always jibberish like lphc35dj0e1an.exe. I deleted all 3 of those files manually. Also, a separate directory (of a similar name) lies in Program Files, although I deleted this several weeks ago back in my previous troubleshooting attempt.

Now, somehow this shit still has my XP display properties window fucked up. All of my tabs besides theme, appearance, and settings are gone. Halp

[Roranora]

I went to.. [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies] in the registry and deleted the following bolded lines in Notepad then merged the new .reg file.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System]
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000


...and still no more tabs.

[Roranora]

Upon more searching, some people have fixed this display tab issue by copying the 900 KB comctl32.dll from the C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0
.0.0_x-ww_1382d70a\ directory and putting it in the WINDOWS\system32 directory in place of the 603 KB comctl32.dll file already there. However, the one in the system32 directory is always going to be in use; how can I replace that file? It won't let me delete it or paste-replace it. ._.

[Gippo]

Now, somehow this shit still has my XP display properties window fucked up. All of my tabs besides theme, appearance, and settings are gone. Halp

what you're seeing is the residual effects of the virus. hopefully the virus is gone for you after what you've done, but you still have software restrictive policies present.

at my work, we use a program called Dial-a-fix after we use combofix

Download it here
http://djlizard.net.nyud.net:8080/so...v0.60.0.24.zip

and run the app, theres a hammer icon near the bottom. click it, and select to scan for restrictive policies, and remove them. This should fix your issue as we see this godforsaken virus several times a week.

Oh, and yeah, the random bsod's is a funny add on to the virus. omgwtf bogus_driver!

[Roranora]

I downloaded and ran your app. It needs a Windows XP CD, and it's not liking what I have.

[Pikarya]

Any of you infected install Objectdock recently? It seems that alot of the infection sources are within dirty torrents/download sites like this one "http://www.mininova.org/com/1702658".

[Zigma]

Oh fuck that thing. Download "Malwarebytes' Anti-Malware" (Type that in google), clean ya comp right up.

FUCK YES! I LOVE THIS PROGRAM!!

[Sho]

Sorry couldn't be of more help, Roranora, the malware is new to me as well, and a friend is still teaching me how to delete it from the reg successfully without programs and HijackThis. Apart from that, what the two ppl said above me, I'd recommend for the time being.

And np Zigma :D Something I just found surfing the net to fix my bro's comp of it lol.

[Roranora]

You were of plenty help, Sho.. and thanks for it. I had given up even trying to troubleshoot my desktop until this thread. And because of it, I have my computer working again. Even without my tabs back, I can do things with that PC now that I haven't been able to for awhile. As for my next step, I'm just trying to get those tabs back. You guys have any ideas on how I could replace that comctl32.dll file in the system32 folder?

Edit: And if it helps any of you computer gurus out there, I have all of my tabs while in Safe Mode. So technically I can get by as long as I restart in Safe Mode before making any display changes, but.. that's kinda something I'd like to try to fix.