Tech Support Forum - View Single Post - Spyware remover fakes: Dr. Antivirus and Spylocked

sUBs · 06-30-2007, 06:29 PM

Before fixing anything, open notepad and Copy/Paste the text in the box below into it:

Code:

@echo off
rem http://www.techsupportforum.com/security-center/hijackthis-log-help/164851-spyware-remover-fakes-dr-antivirus-spylocked.html
For %%g in (
C:\WINDOWS\system32\pjgerka.dll
) do catchme -l nul -k %%g >nul
nircmd execmd move /y "~$folder.desktop$\catchme.zip" "Submit [%date:/=-% %time::=.%].zip"
echo.Please submit the file - Submit [%date:/=-% %time::=.%].zip
nircmd wait 7000
del %0

Save this as Submit.bat Choose to "Save type as - All Files". It should look like this:

Double click on Submit.bat & allow it to generate a zipped file called Submit [Date Time].zip
Please submit this file to → http://www.bleepingcomputer.com/subm....php?channel=4

The file must be uploaded before proceeding to the next step.

-----------

You have several programs that are rogueware and we highly recommend that you uninstall them. Rogue or Suspect means that these products are of unknown, questionable, or dubious value as anti-spyware protection. Please refer to this webpage --> http://www.spywarewarrior.com/rogue_anti-spyware.htm

Go to Start → Control Panel → Add or Remove Programs and uninstall the following programs:

ViewPoint
RegCure
Easy SpyRemover
SpyHunter

Please note any other programs that you dont recognize in that list in your next response

---------------

Do a HijackThis scan & place a check next to these items and select "Fix checked":

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file)
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O15 - Trusted Zone: *.moove.com
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

---------------

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
C:\WINDOWS\system32\pjgerka.dll
Folder::
C:\Program Files\Enigma Software Group
C:\Program Files\RegCure
C:\Program Files\Easy SpyRemover
C:\Program Files\Viewpoint
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
@=-
"PCDrProfiler"=-
"SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 16:04]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{596e4935-4d3b-4a3c-842d-2efd1b3de598}"=-

Save this as ComboFix-Do.txt

Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe
Then post the resultant log

---------------

Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. We only require a report from it.
It does not provide an option to clean/disinfect.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------

In your next post, please include fresh logs from:

Fresh Hijackthis log taken just before replying

Online scan

ComboFix's log

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

06-30-2007, 06:29 PM	#4 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,333 OS: N/A	Re: Spyware remover fakes: Dr. Antivirus and Spylocked Before fixing anything, open notepad and Copy/Paste the text in the box below into it: Code: @echo off rem http://www.techsupportforum.com/security-center/hijackthis-log-help/164851-spyware-remover-fakes-dr-antivirus-spylocked.html For %%g in ( C:\WINDOWS\system32\pjgerka.dll ) do catchme -l nul -k %%g >nul nircmd execmd move /y "~$folder.desktop$\catchme.zip" "Submit [%date:/=-% %time::=.%].zip" echo.Please submit the file - Submit [%date:/=-% %time::=.%].zip nircmd wait 7000 del %0 Save this as Submit.bat Choose to "Save type as - All Files". It should look like this: Double click on Submit.bat & allow it to generate a zipped file called Submit [Date Time].zip Please submit this file to → http://www.bleepingcomputer.com/subm....php?channel=4 The file must be uploaded before proceeding to the next step. ----------- You have several programs that are rogueware and we highly recommend that you uninstall them. Rogue or Suspect means that these products are of unknown, questionable, or dubious value as anti-spyware protection. Please refer to this webpage --> http://www.spywarewarrior.com/rogue_anti-spyware.htm Go to Start → Control Panel → Add or Remove Programs and uninstall the following programs: ViewPoint RegCure Easy SpyRemover SpyHunter Please note any other programs that you dont recognize in that list in your next response --------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file) O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe O15 - Trusted Zone: .moove.com O15 - Trusted Zone: http://.trymedia.com (HKLM) O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe --------------- Open notepad and copy/paste the text in the quotebox below into it: Code: File:: C:\WINDOWS\system32\pjgerka.dll Folder:: C:\Program Files\Enigma Software Group C:\Program Files\RegCure C:\Program Files\Easy SpyRemover C:\Program Files\Viewpoint Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] @=- "PCDrProfiler"=- "SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 16:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{596e4935-4d3b-4a3c-842d-2efd1b3de598}"=- Save this as ComboFix-Do.txt Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe Then post the resultant log --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. We only require a report from it. It does not provide an option to clean/disinfect. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from: Fresh Hijackthis log taken just before replying Online scan ComboFix's log Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Question - what have you done for the community today?