Hey all...newbie here and I'm not sure if I'm in the right place. I recently clicked on something I shouldn't have (a program or download) and now my desktop picture has changed to a black screen with the warning that my computer is infected with spyware. I have run every free spyware and adware program out there and still the same thing. I keep getting an official looking Windows Security Center alert that says my computer is infected. When you click on it...it just sends me to a page trying to sell me anti spyware software. My 'puter is much slower now and I keep getting pop ups stating it's infected. The same pop up everytime. I often have to refresh each page to continue. I'm using Windows XP.

Can anybody tell me how to de-bug this thing and get me back up and running normal??

It is likely Smitfraud or Vundo.
Use Super Antispyware to identify and remove the malware.
Post back with what SAS found and for further instructions.

Install Super Antispyware free. Run it in safe mode. Allow it to quarantine whatever it finds.
http://www.superantispyware.com/

How to Start Windows in Safe Mode:
http://www.bleepingcomputer.com/tutorials/tutorial61.html

buddy215...I downloaded SAS to my desktop. no issues there...but when i get into safe Mode and try to run SAS...I get an alert? that says something about administrator wont allow it.

Help??

How to login as Administrator in Windows XP?
How to Use the "Run As" Command to Start a Program as an Administrator.

SAS must be installed before going into safe mode. Not just downloaded. If you HAVE installed and it still want work in safe mode then run in normal mode.

I got it to work...mistake on my part.

so...I ran it in Safe Mode....found a bunch of issues and deleted them.

Re-start computer and......same thing.... black screen.. with warning about Spyware.

Any suggestions?

I asked in my first post for you to list what SAS found. Without that info it is only a guess as to whether it is Vundo, Smitfraud or something else.

Yes you did...I'm sorry. I just ran it again in normal mode and it only found 2 issues...yet i just cleaned it out too. I will run it again to see if anything else pops up again.

Thank You!!

Run the online scan for Bit Defender in normal mode. Allow it to quarantine whatever it finds.
http://www.bitdefender.com/scan8/ie.html

Post Bit Defender's log here.

buddy215...I ran Bit Defender and came up with nothing. But I did run SAS again AFTER checking for more updates...which there were several. It did find more junk. Here's the log from it:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/04/2007 at 12:56 PM

Application Version : 3.9.1008

Core Rules Database Version : 3354
Trace Rules Database Version: 1353

Scan type : Custom Scan
Total Scan Time : 01:14:35

Memory items scanned : 640
Memory threats detected : 1
Registry items scanned : 5448
Registry threats detected : 1
File items scanned : 49140
File threats detected : 15

Trojan.Unclassified/SLDR
C:\WINDOWS\SYSTEM32\LWINUPDATE.EXE
C:\WINDOWS\SYSTEM32\LWINUPDATE.EXE

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tradedoubler[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@specificclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.adbrite[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@zedo[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adopt.specificclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@e-2dj6wjkocmcpego.stats.esomniture[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adultadworld[1].txt

Trojan.Media-Codec/V4
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#E404Helper [ {6bd36adb-7281-4670-bff3-c029d9d8f2c3} ]

Mostly "tracking cookies" showing. Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups nor do they install malware. As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize this by reading "Blocking & Managing Unwanted Cookies".

Now go to Start > Run and type: regedit
Press "OK" and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the right pane you should see the default entry for Userinit and the "Value data" should read: C:\WINDOWS\system32\userinit.exe,

Let me know what it says but don't make any changes.

Are you still getting the black screen and warnings?

quietman7....Here goes it.

C:WINDOWS\system32\winupdate.exe,c:WINDOWS\system32\userinit.exe

Yup. My 'puter is much quicker now...probably the quickest it's ever been. The annoying Windows Security Center alerts have disappeared along with the alert bubbles that appeared in the lower right hand corner.

Home page is good now too. No more issues there too.

But the black screen w/warning is still over top of my desktop pic.

What I have noticed is that when I start my computer...after my log on screen...it used to put up my desktop pic and icons right away when loading.
Now (since I ph*cked up this thing),my desktop pic comes up a bit later and stays there while everything is loading. No icons yet though.
After a few minutes of loading...it flashes to the black screen w/warning and THEN my icons appear.

It stays like that as long as my 'puter is on.

Please download SDFix by AndyManchesta and save it to your desktop.
alternate download
When using this tool, you must use the Administrator's account or an account with "Administrative rights"

• Double click SDFix.exe and it will extract the files to %systemdrive%
• (this is the drive that contains the Windows Directory, typically C:\SDFix).
• DO NOT use it just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.

• Type Y to begin the cleanup process.
• It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
• Copy and paste the contents of the results file Report.txt in your next reply.

-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe

quietman7

Here's the results:

SDFix: Version 1.116

Run by Administrator on Tue 12/04/2007 at 04:21 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\ADMINI~1\Desktop\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-04 16:30:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------


Files with Hidden Attributes:

Fri 28 Apr 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 25 Sep 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 2 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sun 3 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv03.tmp"

Finished!

Sorry...double post.

One or more of the identified infections is a backdoor Trojan. Backdoor Trojans, IRCBots and Infostealers are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge. Read the Danger: Remote Access Trojans.

Although the backdoor Trojan was identified and removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS - "When should I re-format?".

Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful.

Please print out and follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob".
(scroll down to Removal Instructions; ignore the part showing symptoms in a HijackThis log as they may not apply in your case.)
If you have downloaded SmitfraudFix previously, please delete that version and download it again as the tool is frequently updated!

Thank you quietman7...After I ran the last test....everything is back to normal. No more Windows Security Alert pop ups...no more alert bubbles...the black screen w/warnings is gone too. My computer seems quite a bit faster too. I use Webroot's Spy Sweeper and it only finds 1 or 2 issues after several hours of surfing. Both were spy cookies...lowest threat according to Spy Sweeper.

I tried to run the last test....Smitfraud/Generic Zlob....and I'm not sure I did it correctly. It seemed to work alright ...and I did get a log at the end,but it never gave me the "Red" screen and never rebooted on it's own.

Do you have a different link or at least a step by step tutorial yourself?? Your instructions were very easy for me to understand. I'm a newbie when it comes to getting this deep into this computer.

Thank You greatly!!

After running smitfraudfix, it should have created a text file named rapport.txt. That file is automatically saved to the root of the system drive, usually at C:\rapport.txt.
Please copy/paste the contents of that report into your next reply back here.

quietman7...Here's the rapport:




SmitFraudFix v2.258

Scan done at 12:08:09.18, Wed 12/05/2007
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5390A2B6-57F8-4BEF-B919-FAD70BBA8FA7}: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5390A2B6-57F8-4BEF-B919-FAD70BBA8FA7}: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5390A2B6-57F8-4BEF-B919-FAD70BBA8FA7}: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

It ran ok.

Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then use Disk Cleanup to remove all but the most recently created Restore Point.
• Go to Start > Run and type: Cleanmgr
• Click "OK".
• Click the "More Options" Tab.
• Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Quietman7 ....Done. All seems to be well now. I THANK YOU GREATLY for all your help. I have 2 other issues that I hope you can help me with yet they are not infection related...I think.

1. When I turn on my computor from off...and I log on from the log on screen....when it starts to load,I get a small alert that pops up. It says in the title:

Smart Bridge Alerts: Motive SB.exe-Entry Point Not Found

In the body it says:

The procedure entry point GetProcessImageFileNameW could not be found in the dynamic link library PSAPI.DLL


It's done this for a long time...long before the recent issues. It only pops up once right after the log on screen.

What is it and can I make it go away??


The other is a Defender issue....not loading updates from the Defender program after I prompt it to. It just sits there.

Problems Arising from PSAPI.DLL Dynamic Link Library File

As for Defender, download and install the Windows Installer CleanUp Utility - (it will list all programs that use Windows Installer).

• Double-click on msicuu2.exe and click "Next".
• Accept the license agreement, click "Next", then click "Next" again.
• Click "Finish" when done.
• Go to Start > Programs and click on Windows Install CleanUp to launch the program.
• In the list of Install Products, check to see if "Windows Defender Signatures" are listed.
• If so, highlight that entry, then click on the "Remove" button.
• Reboot when done.
• Then go to Microsoft Update, do an express scan, and see if you can now apply the update.

"Windows Defender Support & Training"
"Troubleshooting Windows Defender in XP"

Until you get the issue resolved you can manually download Windows Defender Definition updates from the Microsoft Malware Protection Center Portal