Malware: Spyware Guard 2008

TheAlex

aliEnRIK wrote: »

Download HIJACK THIS
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
SCAN and post the log file

Sorry, I forgot to mention I tried to install that but nothing happens when I double-click the exe. I can't seem to install anything as I tried Google Chrome and that results in an error just after the installation seems to start.

aliEnRIK

What security do you currently have on it Alex?

TheAlex

The free version of Avast and Windows Firewall with XP. I tried a thorough scan last night but I ended up having to restart my PC before it finished. I forgot about that; might another scan tonight help?

aliEnRIK

TheAlex wrote: »

The free version of Avast and Windows Firewall with XP. I tried a thorough scan last night but I ended up having to restart my PC before it finished. I forgot about that; might another scan tonight help?

If nothing else is working then its cetainly worth a try dont you think?
Run it in SAFE mode (Ive read its SUPPOSED to allow that)

TheAlex

aliEnRIK wrote: »

If nothing else is working then its cetainly worth a try dont you think?
Run it in SAFE mode (Ive read its SUPPOSED to allow that)

I left a 'thorough' Avast scan running overnight in Safe Mode. It took 9 hours and found 0 infected files.

So after that I did a 'normal' scan with a normal Windows startup. This found 2 infected files:
C:\WINDOWS\Temp\qGSJvgGi.exe
C:\Documents and Settings\All Users\Application Data\svhost.exe

Both were listed as 'Infection: Win32: Trojan-gen (Other)'

I deleted the first one and moved the other to the Chest.

This scan also brought up a bmp, saying 'Unable to scan: The file is a decompression bomb.' - I've looked that up and it seems okay, and I know exactly where the image was downloaded from.

I've found out I've been able to extract ComboFix.exe using WinZip, so I can access the files from it, if that helps? This doesn't work with HijackThis or MalwareBytes.

I almost forgot to say I still have the same problems.

aliEnRIK

Alex
If it didnt find anything in safe mode but did in normal mode than there HAS to be something 'else' on the computer thats causing it
As your struggling to get programs to work im unsure of WHAT to advise except to just try them out (They either work, or dont)
Try THREATFIRE
http://www.threatfire.com/
UPDATE and SCAN

and SUPERANTI SPYWARE
http://www.download.com/SUPERAntiSpyware-Free-Edition/3000-8022_4-10523889.html
UPDATE and SCAN

If they dont install normally, try in safe mode

TheAlex

Threatfire installed but I can't download the other one. Threatfire found a couple of things which I quarantined, but this doesn't seem to have fixed any noticeable problems.

An Avast full scan in normal Windows mode brought up loads of Lavasoft Adaware files, which it said couldn't be scanned due to password protection.

I used Adaware (definitions 551 days old - can't be updated as I can't access Lavasoft site) to scan and this has fixed the 'go.google.com' redirection problem, and sped my Internet up, but Spyware Guard still remains. Perhaps I'll have to try and run my main drive as a slave on another computer and see if HijackThis etc can find the problem, I think it's worth a try even though it might not find certain processes if they're not running?

Thanks for your help, I hope you're enjoying this holiday period, if indeed you are on holiday!

aliEnRIK

Try SPYBOT
http://www.download.com/Spybot-Search-amp-Destroy/3000-8022_4-10122137.html
When installing (IF you can!) tick TEA TIMER (Not something id normally say )
Tea timer will pop up bottom right for you to ALLOW certain things
For now just try getting all the other programs up and trunning and having spybot stop everything else thats trying to run (Unless of course you know its safe)
No harm in updating, immunising and running a scan with it either if you can

TheAlex

Something very strange was happening earlier. I was doing another scan with ThreatFire and the space on my main drive was disappearing, about 3Gb in total. Every time I deleted something the space would gradually fill up again until the drive was full. In the end ThreatFire crashed. I don't know if the space disappearance was due to ThreatFire as some has disappeared since when I wasn't running it. I've done a search for all files added today and nothing significant appears.

I also think that the space on my other drive has increased, I'm not 100% sure about this but I do feel quite sure that I didn't have as much space on it as there is now.

I'll give Spybot a go.

aliEnRIK

Quite possible Alex. My mate had a drive that I cleared 15 gig from then all of a sudden it filled up by 25 gig! I couldnt retrieve it and it was simply FULL of viruses and suchlike. Nothing for that but a complete drive wipe.