cmdService
I've got a nasty batch of spyware on my laptop. I have run Spybot, Ad-Aware, and Spy Catcher repeatedly for days and have kept the laptop offline once I had updated all of my definitions. Currently Spybot is the only App picking up the last two bits of suspect code. However, Spybot is not removing, orHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdServices. I have been fighting this garbage in Safe Mode, and I have been giving Spybot permission to remove this items on boot up (as they are untouchable running in memory) but yet Spybot picks them up on every scan tells me it can't get rid of them except on boot...and they are still here. As soon as I open an internet connection, I immediately get hit with 12-50 different viruses, malware, etc. Spybot makes short work of all that garbage, but it appears these two reg enrties are the last vestiges. HELP!HKEY_LOCAL_MACHINE\SYSTEM\Currentcontrolset\Services\cmdServices
Logfile of HijackThis v1.99.1
Scan saved at 1:24:43 PM, on 8/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\S24EvMon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\RegSrvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINNT\system32\igfxtray.exe
C:\dfndrff_8.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Common Files\{2840D246-05D7-1033-0414-040630200001}\Update.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINNT\system32\cidaemon.exe
C:\WINNT\system32\cidaemon.exe
C:\WINNT\regedit.exe
C:\Program Files\HijackThis\HijackThis.exe
<CONTINUED NEXT POST>
cmdService Part. 2
Working
Update
