Help - detected WinSpyKiller trojan last night - referred to this forum

[Derek]

.DAT files can be absolutely anything and can be good/bad /needed/not needed

That depends on each individual one & where they are

Normally in windows use .dat files are a sort of database of visited sites etc if in temporary internet files folder or cookies folder  BUT lots of programs use .dat files to keep vital information about the  program

if you did a windows search & 777 .dat files turned up that is quite normal & if you try to delete them you will almost certainly end up with a broken computer  ( I have about 2000 + .dat files on mine with all the programs etc I run )

Some people think the index.dat files in temp internet files & cookies folder are privacy risk but that only happens when the computer is shared and another user can see where you have visited


Dell support is probably a waste of time BUT will alert you to DELL specific updates to Dell programs & drivers or security risks

I generally don't advise the dell support tool at all UNLESS the computer is still under warranty when it is essential as they won't do anything without it being active and installed and giving the reports they want 

The start up black screen with options for safe mode & recovery console is normal & that is because we have installed recovery console in case it is needed

run OTmoveit & do the clean up with it

[cjinca]

Thanks for the information on .DAT files. I will leave this alone.

Gaijin's uninstall denied removing spywarebot from list.
1.  Can I try using HJT uninstall to remove spywarebot from list? Apparently it no longer poses a threat - but I'd really like to not have it in list.

2.  Do AVG anti-spyware and MBAM offer a bit different coverage? Should I run both? I ask because you suggested MBAM so I now have it in addition to the rest and not sure if its overkill or not.

Dell support is probably a waste of time BUT will alert you to DELL specific updates to Dell programs & drivers or security risks

I don't have warranty. 
3.  But if running support would notify me of needed driver updates, etc., that would be useful info, correct?

I generally don't advise the dell support tool at all UNLESS the computer is still under warranty when it is essential as they won't do anything without it being active and installed and giving the reports they want 

4.  Derek, can you tell me why you advise against the dell support tool?  What is the 'hole' in my above rationale about driver update info, etc.?

I just started a Dell checkup to see exactly what takes place - First, a small box pops up and seems to run a scan. Then, a message that offers, 'Try Dell's PC Checkup on the Web'.  more comprehensive, etc.
Since going to firefox, changing security setttings, I needed to enable browser to accept this site and then accept active x control.  After running, 'no problems were found'. I have an option to send info to Dell or not, I opt to not send.

5.  While googling I read about 'automatic driver detection' option on computer.  Seems for a dummie that would be a good thing, yes?

6.  Can I run spywareguard and AVG antispyware with guard together? I noticed that the guard was disabled on the AVG as yesterday after installing spywareblaster and spywareguard. Not sure if it was a coincidence?  But I left it alone till asking you. 
 
7.  When I download a program and end up with program shortcut AND setup shortcut, I can put setup shortcut in trash, correct?

I ran OTMoveit. 

[Derek]

Thanks for the information on .DAT files. I will leave this alone.

Gaijin's uninstall denied removing spywarebot from list.
1.  Can I try using HJT uninstall to remove spywarebot from list? Apparently it no longer poses a threat - but I'd really like to not have it in list.

try it & see what happens but normally go to add/remove programs & try to uninstall & if gone windows will automagically remove the entry

2.  Do AVG anti-spyware and MBAM offer a bit different coverage? Should I run both? I ask because you suggested MBAM so I now have it in addition to the rest and not sure if its overkill or not.

MBAM is only a scanner  & remover , unless you buy teh protection & there is no problem with running multiple scanners on a  computer  from time to time

AVG AS has some protection capabilities so I NEVER recommend using 2 tools taht provide active protection

I don't have warranty. 
3.  But if running support would notify me of needed driver updates, etc., that would be useful info, correct? 4.  Derek, can you tell me why you advise against the dell support tool?  What is the 'hole' in my above rationale about driver update info, etc.?

I just started a Dell checkup to see exactly what takes place - First, a small box pops up and seems to run a scan. Then, a message that offers, 'Try Dell's PC Checkup on the Web'.  more comprehensive, etc.
Since going to firefox, changing security setttings, I needed to enable browser to accept this site and then accept active x control.  After running, 'no problems were found'. I have an option to send info to Dell or not, I opt to not send.

5.  While googling I read about 'automatic driver detection' option on computer.  Seems for a dummie that would be a good thing, yes?

that is your choice , You will get a lot of DELL advertising from it but if you are happy with that OK

6.  Can I run spywareguard and AVG antispyware with guard together? I noticed that the guard was disabled on the AVG as yesterday after installing spywareblaster and spywareguard. Not sure if it was a coincidence?  But I left it alone till asking you. 
 

there shouldn't be any clash with those, but spyware guard isn't as good as some newer protections

7.  When I download a program and end up with program shortcut AND setup shortcut, I can put setup shortcut in trash, correct?

yes, but there shouldn't be a set up shortcut. only the set up file itself

I ran OTMoveit. 

[cjinca]

yes, i first went through add/remove programs.  and it was no longer in that list but still showing up on HJT, etc.  not sure what that means, but... HJT uninstall did remove it.  I hope it is truly gone. 

AVG AS has some protection capabilities so I NEVER recommend using 2 tools taht provide active protection

clarification please.  Ruby made it very clear not to run two AV's.  But I thought the combination of Avira and AVG AS was good, with both having active guard. 
1.  when you say, 'NEVER', are you referring to the same TYPES (ex: 2 anti-malware, 2 antispyware, 2 browser protection, etc)  of programs  with active guard? 
3/4  as for dell support, it has been running and i dont' get adds - maybe because i wasn't hitting 'details' and running web based full scan.  anyway, thanks. 
2.  While googling I read about 'automatic driver detection' option on computer.  Seems for a dummie that would be a good thing, yes? EDIT - three choices, 1- if my device needs a driver, go to wu without asking me. 2. ask me to search wu every time i connect.  3. never search wu for drivers.  mine is  defaulted to #2 this is in Systems Properties>Drivers>Windows Update. 

3.  what is better protection than spyware guard?

as for setup icons, i trashed a few yesterday.  and i think it was spyware guard. but it left the little picture type icon on desktop for both exe and setup... maybe i'm doing something wrong with firefox download.

anyway, thanks so much for answering these questions.  going through this process has upped my computer awareness megafold yet i still know very little.  hard place to be.   

[Derek]

set firefox to download to specific folder called downloads rather than desktop

open FF/tools/options/main & half way down it is set as desktop by default & that is where you might be getting confused

either set it to a downloads folder in my documents or select the next option of ask me where to save each time & you can decide then on each download

AVGAS has about the same protection as spywareguard but is more frequently updated

however neither are as good as one of the paid for ones like spyware doctor, super antispyware pro  or counterspy BUT any realtime on guard protection does slow down the computer quite bit


Never have 2 antiviruses or 2 antispywares with active protection as they can & will clash

The problems come when an antivirus starts to have antispyware protection inbuilt & blocks browser changes etc & then the AS does the same & when you want to change something yourself , you can't as each one blocks & allowing it in one causes an alert or automatic block in the other

[cjinca]

i changed the firefox download settings. thanks.

and thanks for MORE explanation on the av/as services. 

Avira is new to me.  Seems that Ruby said at least one of these had something to do with combofix?  I chose ignore rather than delete.
What are these? Can I delete them?

Begin scan in 'C:\'
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\A0004397.exe
 

• Archive type: RAR SFX (self extracting)

  --> 327882R2FWJFW\nircmd.com
      [DETECTION] Contains detection pattern of the application APPL/NirCmd.3
  --> 327882R2FWJFW\nircmd.cfexe
      [DETECTION] Contains detection pattern of the application APPL/NirCmd.3
  --> 327882R2FWJFW\psexec.cfexe
      [DETECTION] Contains detection pattern of the application APPL/Rmadmin.131072
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!

i believe there is some type of security leak still existing on my computer.
last week when i downloaded the extra ms files, i wrote ms customer service.  On 2/22, I received a standard response, 'we received your message and will respond in 24 hours.  Then on the same day, I received a second, similar response from different address.  It included the message, 'if you are using a spam blocker, make sure to set it to recieve messages from *.microsoft.com'.  The next day, I received an email saying that ms was mailing me windows xp.  And they listed an address in michigan. I don't live in Michigan and didn't request windows xp. I didn't reply. 
Then on the 28th, I received an email from David Xu, ms employee? saying he hadn't heard from me in a while, was wanting to archive case and that i could reactivate it at any time.  he then moved into asking about what files it was that I wanted to delete, etc. he goes into some directions and 'if i receive error codes... and gives directions on how to create screenshot of my desktop and send it to him.  I didn't think much of email as I wasn't following any instructions, etc.
I did respond that i'd deleted files but that i'd also received email about having windows xp mailed to me in michigan. he replied in poor english that i could delete that email, it wasn't from microsoft. now i'm thinking he isn't with microsoft either. 
So...did someone intercept my correspondence to microsoft?  i know something is wrong.  how can i tell which correspondence is official?  and where my vulnerablility is?

[Derek]

Microsoft customer support is outsourced a lot of the time  & "mistakes" happen

If the problem can be dealt with from a standard answer & tick all the right boxes then it goes OK . At other times it can & often does go wrong

Nobody has intercepted the correspondence with Microsoft it sounds like a typical Microsoft "support" mess

There are always lots of files that an antivirus can't open to examine, if they are locked by the operating system and all those listed ones are like that

ignore the nircmd etc as they are part of combofix or one of the other programs we have used

Have you uninstalled combofix and all the others or do you still have the downloads on desktop soemwhere

[cjinca]

as for the ms correspondence, i REALLY want to accept your reply that nothing has been intercepted, etc. but still have a bad feeling.   the one guy asking me for a screenshot of my desktop, and the other email saying they were sending me windows xp for free, but listing wrong address.  sounds like a great way to get me verify my real address.  and i didn't go into all the details of what he asked me to perform, and it IS most likely harmless.   i tried to compare full headers but don't know enough to know what i'm looking for. 

combofix has been removed from computer. 
if i am understanding your response, i can't delete the files, but only ignore them? problem is, not having computer knowledge, as these continue to come up, i don't know what is combofix related and what's not.  Today is the first time i've seen the radmin extension.  i had asked ruby about the nircmd before. 

[Derek]

forward me the emails from them so I can check headers

send to submit@thespykiller.co.uk

[Derek]

the antivirus can't delete them because they are inside a self extracting zip file and the AV is trying to delete individual files from the zip file which it can't do

It definitely shows combofix so there must be a copy of CF somewhere it is detecting but I don't know where

can you attach the full av report or at least a part that shows the exact files detected

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser