Cannot Delete Adware

O

owfsasha1

New member
I recently acquired adware and downloaded Spybot-S&D to find and delete the file that is causing this. It ran through all the files, destroyed a ton of them and then said:

"Some problems couldn't be fixed; the reason could be that the associated files are still in use (in memory). This could be fixed after a restart. May Spybot-S&D run on your next system startup?"

I said yes, restarted my computer, and it took 30 minutes to search through all of the files again. After this, it had the same exact message. The file is called "Command Service". Please help?
 
owfsasha1:

Please post a log of the actual detection(s) you are getting. To do that:
  • Run another scan.
  • When the scan completes, right click on the results list, select "Copy results to clipboard".
  • Then paste (Ctrl+V) those results to a new post in this thread.
Thanks
 
Command Service: System Service (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService

CoolWWWSearch: [SBI $21C4E0C1] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{17DA0C9E-4A27-4AC5-BB75-5D24B8CDB972}

CoolWWWSearch: [SBI $856E2E0D] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF021F40-3E14-23A5-CBA2-717765721306}

CoolWWWSearch: [SBI $05AABB3F] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}

CoolWWWSearch: [SBI $53B1EFC5] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}

CoolWWWSearch: [SBI $B9E15D79] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}

CoolWWWSearch: [SBI $8A4A2DFC] Settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2D38A51A-23C9-48A1-A33C-48675AA2B494}

CoolWWWSearch: [SBI $7FD71731] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E}

CoolWWWSearch: [SBI $997CFB38] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972}

CoolWWWSearch.008k: [SBI $4BF722AC] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD9BC004-8331-4457-B830-4759FF704C22}

CoolWWWSearch.008k: [SBI $B9F681B7] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{587DBF2D-9145-4c9e-92C2-1F953DA73773}

CoolWWWSearch.008k: [SBI $7935A70E] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD9BC004-8331-4457-B830-4759FF704C22}

CoolWWWSearch.Aff.Iedll: [SBI $450485B1] Executable (File, fixed)
C:\WINDOWS\iedll.exe

CoolWWWSearch.Aff.Iedll: [SBI $8C04C923] Executable (File, fixed)
C:\WINDOWS\loader.exe

CoolWWWSearch.Aff.Winshow: [SBI $21A0F4E7] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2DDF680-9905-4DEE-8C64-0A5DE7FE133C}

CoolWWWSearch.Aff.Winshow: [SBI $EDDBEA88] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2E9CAFF6-30C7-4208-8807-E79D4EC6F806}

CoolWWWSearch.Aff.Winshow: [SBI $049CBFB9] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2E9CAFF6-30C7-4208-8807-E79D4EC6F806}

CoolWWWSearch.Aff.Winshow: [SBI $D5551A55] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E2DDF680-9905-4dee-8C64-0A5DE7FE133C}

CoolWWWSearch.BlowSearch: [SBI $2F81B0E2] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{79369D5C-2903-4B7A-ADE2-D5E0DEE14D24}

CoolWWWSearch.Bootconf: [SBI $805EA7D4] Executable (File, fixed)
C:\WINDOWS\msupdate.exe

CoolWWWSearch.Dreplace: [SBI $07DD1156] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{086AE192-23A6-48D6-96EC-715F53797E85}

CoolWWWSearch.Dreplace: [SBI $EE9A4467] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{086AE192-23A6-48D6-96EC-715F53797E85}

CoolWWWSearch.Gonnasearch: [SBI $503651AA] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{799A370D-5993-4887-9DF7-0A4756A77D00}

CoolWWWSearch.Gonnasearch: [SBI $10F83C44] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A55581DC-2CDB-4089-8878-71A080B22342}

CoolWWWSearch.Gonnasearch: [SBI $640CC338] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E7AFFF2A-1B57-49C7-BF6B-E5123394C970}

CoolWWWSearch.Gonnasearch: [SBI $F8BC1ACA] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{150FA160-130D-451F-B863-B655061432BA}

CoolWWWSearch.Leftovers: [SBI $54B61FCC] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00110011-4B0B-44D5-9718-90C88817369B}

CoolWWWSearch.Leftovers: [SBI $D28FD146] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB2}

CoolWWWSearch.Leftovers: [SBI $D0C96F1F] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1}

CoolWWWSearch.Leftovers: [SBI $3BC88477] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB2}

CoolWWWSearch.Leftovers: [SBI $BDF14AFD] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{00110011-4B0B-44D5-9718-90C88817369B}

CoolWWWSearch.SmartSearch: [SBI $D0FDF930] Executable (File, fixed)
C:\WINDOWS\notepad32.exe

CoolWWWSearch.Svcinit: [SBI $222D2525] Executable (File, fixed)
C:\WINDOWS\mssys.exe

CoolWWWSearch.WCADW: [SBI $EBBDAA3B] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B847676D-72AC-4393-BFFF-43A1EB979352}

CoolWWWSearch.WinRes: [SBI $252DB9D3] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2D38A51A-23C9-48a1-A33C-48675AA2B494}

CoolWWWSearch.WinSearch: [SBI $BAFE8D4B] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}

CoolWWWSearch.Yexe: [SBI $E7391681] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5321E378-FFAD-4999-8C62-03CA8155F0B3}

ToolbarCC: [SBI $E20BEABD] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1}

Command Service: [SBI $C53578BD] Settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdService

Command Service: [SBI $F0D8CEEE] Settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdService

DeepDive: [SBI $633C4225] Interface (Registry key, fixed)
HKEY_CLASSES_ROOT\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}

DeepDive: [SBI $8AF8A653] Interface (Registry key, fixed)
HKEY_CLASSES_ROOT\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}

DeepDive: [SBI $C63F022C] Type library (Registry key, fixed)
HKEY_CLASSES_ROOT\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}

Smitfraud-C.gp: [SBI $7D81C16D] Executable (File, fixed)
C:\WINDOWS\x.exe

Smitfraud-C.gp: [SBI $29222CE9] Web page (File, fixed)
C:\WINDOWS\default.htm

Microsoft.WindowsSecurityCenter.TaskManager: [SBI $FD4267D3] Settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr

Microsoft.WindowsSecurityCenter.TaskManager: [SBI $B2E55F62] Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr

ClientMan: [SBI $7157E101] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}

ClientMan: [SBI $439564A3] Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}

CoolWWWSearch.GonnaSearch: [SBI $11FB4FFB] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{150FA160-130D-451F-B863-B655061432BA}

CoolWWWSearch.GonnaSearch: [SBI $8D4B9609] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7AFFF2A-1B57-49C7-BF6B-E5123394C970}

Smitfraud-C.: [SBI $13E62E68] Executable (File, fixed)
C:\WINDOWS\users32.exe

Smitfraud-C.: [SBI $6CA15C70] Executable (File, fixed)
C:\WINDOWS\winmgnt.exe

Smitfraud-C.: [SBI $B10DB83E] Library (File, fixed)
C:\WINDOWS\avpcc.dll

Smitfraud-C.: [SBI $CDB2E61E] Executable (File, fixed)
C:\WINDOWS\window.exe

Smitfraud-C.: [SBI $2F25FB5A] Executable (File, fixed)
C:\WINDOWS\systemcritical.exe

Smitfraud-C.: [SBI $C1D3236A] Executable (File, fixed)
C:\WINDOWS\clrssn.exe

Smitfraud-C.: [SBI $3814E202] Executable (File, fixed)
C:\WINDOWS\systeem.exe

Smitfraud-C.: [SBI $18599D31] Library (File, fixed)
C:\WINDOWS\xxxvideo.hta

Smitfraud-C.: [SBI $F6F1FE46] Executable (File, fixed)
C:\WINDOWS\waol.exe

Smitfraud-C.: [SBI $4801815D] Executable (File, fixed)
C:\WINDOWS\y.exe

Smitfraud-C.: [SBI $31B4405F] Executable (File, fixed)
C:\WINDOWS\accesss.exe

Smitfraud-C.: [SBI $9D6DEEA6] Executable (File, fixed)
C:\WINDOWS\olehelp.exe

Smitfraud-C.: [SBI $68E08DD7] Executable (File, fixed)
C:\WINDOWS\win32e.exe

Smitfraud-C.: [SBI $D1D74B75] Executable (File, fixed)
C:\WINDOWS\win64.exe

Smitfraud-C.: [SBI $33A479D9] User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-507921405-706699826-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E3EEBBE8-9CAB-4C76-B26A-747E25EBB4C6}

Smitfraud-C.: [SBI $4A940688] Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}

Smitfraud-C.: [SBI $9E628A33] Library (File, fixed)
C:\WINDOWS\cpan.dll

Smitfraud-C.: [SBI $DF8A3C1C] Library (File, fixed)
C:\WINDOWS\mtwirl32.dll

Smitfraud-C.: [SBI $434EE262] Library (File, fixed)
C:\WINDOWS\winajbm.dll

Smitfraud-C.: [SBI $7D9C464E] Library (File, fixed)
C:\WINDOWS\xplugin.dll

Smitfraud-C.CoreService: [SBI $9C656B9A] Data (File, fixed)
C:\WINDOWS\system32\drivers\core.cache.dsk

Win32.Small.ny: [SBI $4746BC1E] Executable (File, fixed)
C:\WINDOWS\iexplorer.exe

Virtumonde.dll: [SBI $4DB0E149] Library (File, fixed)
C:\WINDOWS\system32\qoMeEUKD.dll_old


--- Spybot - Search & Destroy version: 1.5.2 (build: 20080128) ---

2008-01-28 blindman.exe (1.0.0.7)
2008-01-28 SDDelFile.exe (1.0.2.4)
2008-01-28 SDMain.exe (1.0.0.5)
2007-10-07 SDShred.exe (1.0.1.2)
2008-01-28 SDUpdate.exe (1.0.8.8)
2008-01-28 SDWinSec.exe (1.0.0.11)
2008-01-28 SpybotSD.exe (1.5.2.20)
2008-01-28 TeaTimer.exe (1.5.2.16)
2008-06-12 unins000.exe (51.49.0.0)
2008-01-28 Update.exe (1.4.0.6)
2008-01-28 advcheck.dll (1.5.4.5)
2007-04-02 aports.dll (2.1.0.0)
2007-11-17 DelZip179.dll (1.79.7.4)
2008-01-28 SDFiles.dll (1.5.1.19)
2008-01-28 SDHelper.dll (1.5.0.11)
2008-01-28 Tools.dll (2.1.3.3)
2008-06-03 Includes\Adware.sbi (*)
2008-06-10 Includes\AdwareC.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-06-03 Includes\Dialer.sbi (*)
2008-06-10 Includes\DialerC.sbi (*)
2008-06-03 Includes\HeavyDuty.sbi (*)
2008-06-04 Includes\Hijackers.sbi (*)
2008-06-03 Includes\HijackersC.sbi (*)
2008-06-03 Includes\Keyloggers.sbi (*)
2008-06-10 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-06-03 Includes\Malware.sbi (*)
2008-06-11 Includes\MalwareC.sbi (*)
2008-06-03 Includes\PUPS.sbi (*)
2008-06-10 Includes\PUPSC.sbi (*)
2007-11-07 Includes\Revision.sbi (*)
2008-06-10 Includes\Security.sbi (*)
2008-06-10 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-06-03 Includes\Spyware.sbi (*)
2008-06-03 Includes\SpywareC.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-06-11 Includes\Trojans.sbi (*)
2008-06-11 Includes\TrojansC.sbi (*)
2007-12-24 Plugins\TCPIPAddress.dll
 
owfsasha1:

There one thing that you can try to get rid of the "Command Service" detection that Spybot-S&D is having difficulty removing:
  • Try running Spybot in Safe mode.
    • Reboot your system in Safe mode and run Spybot-S&D.
If Spybot still fails to correct the problem consider posting in the Malware Removal forum and having someone take a look at your system.

If you decide to have an experienced malware removal specialist assist you, please follow the procedure in this link to run scans and produce a HijackThis log:After you have completed the required scans and produced the requested logs, start your own thread in the Malware Removal forum, making sure to post the logs produced from the above instructions.
 
You must log in or register to reply here.
Back
Top