I purchased this computer from someone I know on the cheap, because he said it has a virus.
THIS SYSTEM IS POSSESSED!
1.About every 5 minutes this message pops up,
Windows Security Alert!
Warning! Potential Spyware Operation!
You computer is making unauthorised copies of your System and
Internet files. Run full scan now to prevent any unauthorised access
to your files! Click YES to download Spyware Remover...
Misspelling included.
I've been clicking NO.
2.I cannot Access the Control Panel. If you click on Start the Control Panel is not listed.
If I Click Start>Run>Control.exe I get the message
Restrictions
The operation has been cancelled due to restrictions in effect on this computer. Please
contact your system administrator.
3.Cannot access properties from My Computer. Click Start>My Computer, right mouse click>
Properties. Same message as item 2.
4.My Home Page keeps getting changed to Google.
5. I have to run Spybot, no luck. I can download it and start the installation. The
installation runs to the point where the check boxes Run S&D, Run Teatimer are displayed.
Click on OK and nothing happens
6.Kaspersky Online Scanner,when I click on the link in "Before You Post" using the infected system
it goes no where. No Error, It just stays on the "Before You Post, post. It works fine on
my good system. I tried googling "Kaspersky Online Scanner" Following the Link, but after
repeated tries all I get is "The page cannot be displayed. Works fine on my good sytem.
7. HiJack This, I get the same result from the HiJack this Link. I went to a site and
downloaded HiJack This 2.02 to the desktop. when I double-click on the desktop icon the
System asks if I want to run it. When I click RUN nothing happens. No error, the
program does not execute.
8. The system has an outdated version of PC-cillin (Last update 6/4/2006). It won't update.
The former owner says he ran SmitFruadFix in Safe Mode. It produced a report. I will post
it, might help, it's about all I have.
9. The system says it is booting Windows XP Media Edition. The Dell Support Center says it
is running Windows XP Professional Service Pack 2.
I will Be grateful for any help.
SmitFraudFix Rapport:
SmitFraudFix v2.296
Scan done at 12:33:43.67, Mon 02/25/2008
Run from C:\Documents and Settings\Henry Latour\Desktop\SmitFraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
10.18.250.4 ad.doubleclick.net
10.18.250.4 ad.fastclick.net
10.18.250.4 ads.fastclick.net
10.18.250.4 ar.atwola.com
10.18.250.4 atdmt.com
10.18.250.4 avp.ch
10.18.250.4 avp.com
10.18.250.4 avp.ru
10.18.250.4 awaps.net
10.18.250.4 banner.fastclick.net
10.18.250.4 banners.fastclick.net
10.18.250.4 ca.com
10.18.250.4 click.atdmt.com
10.18.250.4 clicks.atdmt.com
10.18.250.4 customer.symantec.com
10.18.250.4 dispatch.mcafee.com
10.18.250.4 download.mcafee.com
10.18.250.4 downloads-us1.kaspersky-labs.com
10.18.250.4 downloads-us2.kaspersky-labs.com
10.18.250.4 downloads-us3.kaspersky-labs.com
10.18.250.4 downloads1.kaspersky-labs.com
10.18.250.4 downloads2.kaspersky-labs.com
10.18.250.4 downloads3.kaspersky-labs.com
10.18.250.4 downloads4.kaspersky-labs.com
10.18.250.4 engine.awaps.net
10.18.250.4 f-secure.com
10.18.250.4 fastclick.net
10.18.250.4 ftp.avp.ch
10.18.250.4 ftp.downloads1.kaspersky-labs.com
10.18.250.4 ftp.downloads2.kaspersky-labs.com
10.18.250.4 ftp.downloads3.kaspersky-labs.com
10.18.250.4 ftp.f-secure.com
10.18.250.4 ftp.kasperskylab.ru
10.18.250.4 ftp.sophos.com
10.18.250.4 ids.kaspersky-labs.com
10.18.250.4 kaspersky-labs.com
10.18.250.4 kaspersky.com
10.18.250.4 liveupdate.symantec.com
10.18.250.4 liveupdate.symantecliveupdate.com
10.18.250.4 mast.mcafee.com
10.18.250.4 mcafee.com
10.18.250.4 media.fastclick.net
10.18.250.4 my-etrust.com
10.18.250.4 nai.com
10.18.250.4 networkassociates.com
10.18.250.4 norton.com
10.18.250.4 phx.corporate-ir.net
10.18.250.4 rads.mcafee.com
10.18.250.4 secure.nai.com
10.18.250.4 securityresponse.symantec.com
10.18.250.4 service1.symantec.com
10.18.250.4 sophos.com
10.18.250.4 spd.atdmt.com
10.18.250.4 symantec.com
10.18.250.4 trendmicro.com
10.18.250.4 update.symantec.com
10.18.250.4 updates.symantec.com
10.18.250.4 updates1.kaspersky-labs.com
10.18.250.4 updates2.kaspersky-labs.com
10.18.250.4 updates3.kaspersky-labs.com
10.18.250.4 updates4.kaspersky-labs.com
10.18.250.4 updates5.kaspersky-labs.com
10.18.250.4 us.mcafee.com
10.18.250.4 vil.nai.com
10.18.250.4 viruslist.com
10.18.250.4 viruslist.ru
10.18.250.4 virusscan.jotti.org
10.18.250.4 virustotal.com
10.18.250.4 www.avp.ch
10.18.250.4 www.avp.com
10.18.250.4 www.avp.ru
10.18.250.4 www.awaps.net
10.18.250.4 www.ca.com
10.18.250.4 www.f-secure.com
10.18.250.4 www.fastclick.net
10.18.250.4 www.grisoft.com
10.18.250.4 www.kaspersky-labs.com
10.18.250.4 www.kaspersky.com
10.18.250.4 www.kaspersky.ru
10.18.250.4 www.mcafee.com
10.18.250.4 www.my-etrust.com
10.18.250.4 www.nai.com
10.18.250.4 www.networkassociates.com
10.18.250.4 www.sophos.com
10.18.250.4 www.symantec.com
10.18.250.4 www.trendmicro.com
10.18.250.4 www.viruslist.com
10.18.250.4 www.viruslist.ru
10.18.250.4 www.virustotal.com
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\WINDOWS\system32\ctfmona.exe Deleted
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{5449A36A-5B35-4799-9FB6-8AAAA2DF503E}: DhcpNameServer=10.129.1.65
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5449A36A-5B35-4799-9FB6-8AAAA2DF503E}: DhcpNameServer=10.129.1.65
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5449A36A-5B35-4799-9FB6-8AAAA2DF503E}: DhcpNameServer=10.129.1.65
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.129.1.65
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.129.1.65
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.129.1.65
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End