Please help with infected CPU.

[eaglecarr]

Hi. I have a computer at my office that is infected with spyware, viruse, and probably other things. I wanted to try and clean it if possible so I do not loose some information that would take forever to recover. I heard of Hi jack this and did a little research. I found this site, and have read the sticky of what to do before posting for help. I have followed the guide step by step and below is the information that I have collected.

Computer: Dell
OS: Windows XP (I found out it is not totally up to date once I started investigating.)

1.) I downloaded and installed AvG anti -spyware v7.5

I downloaded and installed windows defender

I downloaded and installed ATF Cleaner.exe

I downloaded HiJackThis v1.99.1 and extracted it to the C:\hijackthis folder
and renamed it to hjtscan.exe (please note before I found this forum I downloaded HiJackThis v2 and ran it I tried post to post the log from that time but the site would not let me)

2.) I started the initial cleaning process:
Under Add/remove programs the following looked suspicious: Insider, OIN, Windows Installer, Words.

I enabled the viewing of hidden files

I ran malicous software removal tool (however this did not find any problems)

I ran Kaspersky online virus scanner

I disconnected and rebooted in safe mode and ran the following:
ATF Cleaner (Successful)
AVG Cleaner.exe (Successful, but it would not let me print a report)
windows defender(Successful)

3.) After the initial cleaning I ran the HJT v 1.99 as directed ( I actually ran this twice after I could not attach the .log file here, I reran HJT and pasted the info into .txt file)
I also ran kaspersky again.

I would appreciate any advise or suggestions on how to clean this computer.

Thank you for your time.

[jholland1964]

AVG Cleaner.exe (Successful, but it would not let me print a report)

Open the AVG program again. Click on Reports. There should be something like my attached open up.
Highlight the Report shown and choose Save As.
Save it as a text file on the desktop or my briefcase...someplace you can find it. Then close the program. Come back here and upload that saved report.

[eaglecarr]

Thanks for your quick response.

I went under reports and there is not a scan for me to click on to save.
should I run the scan again in or out of safe mode? (I looked back and I checked the settings I had the automatically generate report after every scan checked and the only if threats were found box unchecked.)

thanks

[jholland1964]

Your settings are correct. Run the scan again in Safe Mode and have it fix anything found. There should be a button there which will allow you to save a report...this is when the scan is complete I believe. If you can't get a log then at least make note of the items found, if they were fixed and where they were found and then post back here with the results whichever way you can do it.

By the way, you did a GREAT job to begin with, wish everyone would be as precise as you have been!

[eaglecarr]

o.k. sorry I did'nt look hard enough the first time. I went back into safe mode and pulled it up and under reports I found the scan so here it is.

[PhilliePhan]

Are you able to uninstall these through Add/Remove programs?

C:\Program Files\Insider
C:\Program Files\Words

There are a couple other baddies - I suggest a pass with ComboFix. (& post the logfile after)

I imagine Judy will concur.....

Best
PP

[jholland1964]

Tell you what, I would like you to try another anti-malware program that has had pretty good success;
Comodo BOClean

Download, install, update

Then shut down the computer, disconnect the internet cable. Reboot in Safe Mode and run the program above.

As PP asked, were you able to uninstall via Add/Remove the programs he noted? If you didn't try, then do so while in Safe Mode. Run my BOCLEAN suggestion first and check back with that log. Then we will go onto the combofix.

[PhilliePhan]

Hi Judy!

Might be easier to just run Both ComboFix AND VundoFix, but I'll leave this in your able hands.

Cheers
PP

[eaglecarr]

hey, I used add/remove programs on the following.

C:\Program Files\Insider
C:\Program Files\Words

They are gone now but, they did not do a typical uninstall they just disappeared.

Judy, I downloaded and installed the program that you asked me too. I think I updated it, everything seemed to be hidden. when I went in to safe mode and ran the program it starts to scan then safe mode starts acting up. I do not know if it is finishing the scan or not.

I have not downloaded the other two programs yet.

by the way phillie phan, I am a big baseball fan myself. I see where the Rockies are up on your boys.

thanks for the help

[jholland1964]

Run the BOCLEAN in normal mode then. Let me know what happens.