Virus (?) Killing Spybot Installation

[alex95070]

I've been infected with a virus (?) that, among other things, prevents me from installing SpybotS&D. Well, that's not exactly right -- it installs, but shortly afterwards (a few seconds) the executable and the update.exe file are deleted from the installation directory. . . . So, trying to run the app from the shortcut results in file missing error message!!!

There are other effects as well -- right clicking on a file runs the windows installer for either Symantec AV or Corel Photo 6, but the installer never completes because of a file access problem (I think it is also 'losing' some file). After trying a few times it stops. When I first noticed the problem, I found I had lost all restore points, and Windows Update is not working.

I've run several online AV and SpyWare scans and allowed the problems found to be fixed, but all to no avail. My problem continues.

I started a thread on the spywareinfo forum -- I have not received help yet, but it will explain the problem and all my fix attempts more fully. Here is the link to that thread (but the forum seems to be offline for the last day or so . . . or maybe that's my virus also . . . ):

http://forums.spywareinfo.com/index.php?showtopic=94527

Any help or even knowing that someone else has a similar problem would be appreciated.

Oh . . . Dell PC, lots of RAM and disc, running XP Pro SP2 with all updates until this problem first appeared about a week ago . . . .

Thanks!!! . . .

[spybotsandra]

Hello,

Usually, we would ask you to create a Spybot - Search & Destroy system report to see whether there is some new spyware that especially targets Spybot - Search & Destroy (there has been malware removing anti-spyware products in the past). In this case, we may need to utilize a different tool to find out if there is some pest that did this, and if so where it is exactly. Please download HijackThis: http://www.tomcoyote.org/hjt/
Follow the instructions on that tutorial page to create a log. Please mail that log to our detectives at detections(at)spybot.info. Make sure the subject is clear; we're currently collecting reports on this threat, so we suggest you start the subject with [Spybot Attacked]. Thanks a lot for your help, and we promise to find this one asap!

Best regards
Sandra
Team Spybot

[alex95070]

Hi Sandra

Thanks for your prompt reply.

Actually, the thread I pointed you to has a HJT report (actually a couple) as well as several other reports, but since that site seems to be off-line right now, guess that is not too useful . . .

I'll run another HJT scan tonite when I get home and send it in as per your instructions. I'll also send in the reports from scans with other software, like FSecure Blacklight (rootkit detector).

Thanks again . . .

[alex95070]

The spywareinfo forums are back on line, so you can use the link in my first post now if you like. But I'll send a new scan report tonite as I said above

[tashi]

Hello

Could we see a log in the malware removal forum please.

Follow the procedure in this link: "BEFORE you POST" -Preliminary Steps

Then start your own thread here.

Once you have posted a helper will advise you as soon as available.

Cheers.

[alex95070]

Hello,

Usually, we would ask you to create a Spybot - Search & Destroy system report to see whether there is some new spyware that especially targets Spybot - Search & Destroy (there has been malware removing anti-spyware products in the past). In this case, we may need to utilize a different tool to find out if there is some pest that did this, and if so where it is exactly. Please download HijackThis: http://www.tomcoyote.org/hjt/
Follow the instructions on that tutorial page to create a log. Please mail that log to our detectives at detections(at)spybot.info. Make sure the subject is clear; we're currently collecting reports on this threat, so we suggest you start the subject with [Spybot Attacked]. Thanks a lot for your help, and we promise to find this one asap!

Best regards
Sandra
Team Spybot

Hi Sandra --

Latest HJT report as well as several other logs Emailed a few minutes ago per your instructions above.

Thanks!

Alex

[alex95070]

Hello

Could we see a log in the malware removal forum please.

Follow the procedure in this link: "BEFORE you POST" -Preliminary Steps

Then start your own thread here.

Once you have posted a helper will advise you as soon as available.

Cheers.

Hi --

See post directly above.

spybotsandra seems to be helping me already. Do you still want me to post my HJT log and start another thread in the Malware Removal forum?

Thanks!

Alex

[tashi]

Hi --

See post directly above.

spybotsandra seems to be helping me already. Do you still want me to post my HJT log and start another thread in the Malware Removal forum?

Thanks!

Alex

Hi there.

Yes spybotsandra requested I direct you to our malware removal forum.

[alex95070]

OK Tash -- DONE! . . .



http://forums.spybot.info/showthread.php?p=71387

[tashi]

Thanks, I have asked one of our helpers to take a look once he comes on later.

Cheers.