Malware sticking around after running recommened programs

RKGeee · 25th April 2005

Good Morning!

I have spent the weekend running each of the spyware/adware programs listed in your tutorial and can't seem to get rid of the pop ups. Each time I rerun spybot, it keeps finding and fixing (and finding again) "bookedspace".

Since infection, I have been unable to use my LAN card (keeps telling me it is unplugged when it is not) and my wireless card is spotty (keeps finding losing and finding again) the connection. Here is mt Hijackthis log. Any help would be GREATLY appreciated!

Logfile of HijackThis v1.99.1
Scan saved at 6:08:26 AM, on 4/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\WatchGuard\Mobile User VPN\IreIKE.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WatchGuard\Mobile User VPN\SafeCfg.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\WatchGuard\Mobile User VPN\IPSecMon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WLTRYSVC.EXE

spotta · 25th April 2005

Hi

Have you run all the removers in safe mode?
remember to turn off system restore before scanning and removal - and reactivate afterwards.

The WinSockFix should fix your network connection problems.
Download here (Major Geeks)

Spotta

noahdfear · 25th April 2005

Welcome to WindowsBBS RKGeee

We need to see the entire HijackThis log please. Please include details of what Spybot is finding and where. Did you also run an online virus scan?