malware/trojan infection keeps reappearing

[liferasta]

I deleted the registry threat manually & uninstalled AnyVideo Converter & Realplayer since they both have URL download video links that may be causing the problem but I left the two trojans since I was going to restart in safe mode & use Superanti spyware to remove them, I decided to run another Prevx scan & have now discovered more threats besides the two trojans including a high risk worm (Stinkys' MPEG-2 Codec Installer) C:\Windows\System32 among other codecs in the system 32 folder (some belong to Microsoft so im unsure which are legit & which are threats, the K-lite codek pack is the only legit one i have installed) & theres cloaked malware & a registry risk that appeared in the same folder when I manually deleted the previous registry threat, hijack this log also in attachment, Malwarebytes did not detect any threats

[Derek]

lets get copies of these first to double check

Download suspicious file packer from http://www.safer-networking.org/en/tools/index.html  (direct download  http://www.safer-networking.org/files/sfp.zip )

Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

please upload that to http://www.thespykiller.co.uk/index.php?board=1.0 so we can examine the files
 
Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, When the file is  listed in the windows press send to  upload the file



c:\windows\system32\mpeg-2.exe
c:\windows\system32\nwlinact.exe

[liferasta]

Hi, I decided to bite the bullet & buy a licence for 1 years subscription to Prevx 3.0 to clean up the threats since it is able to detect threats that my other freeware malware scanners like Superanti spyware, Malwarebytes & Spybot did not pick up, the threats have been removed & im not sure if I can get the files from Prevx, as mentioned I have removed all Video downloaders like Realplayer,Anyvideo & Videoget to see if they were the cause of reinfection but my guess is it was the Mpeg exe codec that was not detected by Superanti that was the cause, I will have to see if it the Trojans come back so far its clean, I will update to Windowws 7 in October from a clean install after formatting the hardrive as I find Vista rather glitchy & it will not allow me to update to service pack 2 due to error code 80070005 even though security updates work, I think its an administrators rights problem even though i have full admin rights it seems to disable them during SP2 installation, I have posted this issue up on the vista forums to see if theres a fix

[Derek]

if they do return, then the Prevx licence includes specialist help from them and I have found that they are extremely helpful

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser