"CalamityKen" <YKnot@home.invalid> wrote in message news:Py_3e.2965$Fy3.177283@news20.bellglobal.com.. .
> Pierre-Normand Houle wrote:
>> I've been trying to eradicate this virus for several days. It was
>> detected
>> by Spybot. I have installed Ad-Aware SE Personal and bought a copy
>> of Spyhunter for 30$. I've also run the FxIsbar.exe utility provided
>> by Symantec.
>
> Read about SpyHunter:
> Rogue/Suspect Anti-Spyware Products & Web Sites
> http://www.spywarewarrior.com/rogue_...re.htm#sh_note
>
>> I start WinXp in safe mode and run all these utilities, scan all my
>> drives, remove all the pest and all seems clean. I reboot and it just
>> reinstalls itself. The suspicious processes that keep coming back are
>> qquwa.exe, qquwm.exe, xpjrvh.exe and, of course, istsvc.exe, plus a
>> load of registry entries referring to XXXToolbar and other crap. I
>> kill and clean everything but it keeps coming back after each reboot.
>> (I've tried most of the manual removal procedures
>> for XXXToolbar and Istbar that I've found on the web or usenet)
>>
>> It there a *free* antivirus out there that would block it from
>> reinstalling itself at reboot or make a better job of detecting and
>> eradicating it than Spybot, AdAware and Spyhunter do? I'd be glad to
>> stop spending money trying to
>> get rid of that nuisance.
>>
>> Thanks for any help!
>
> Download the latest v1.99.1 version of HijackThis to use and post your new
> log in a support forum after you have followed all directions:
> http://tools.radiosplace.com/hijackthis.zip
> or
> http://www.spywareinfo.com/~merijn/files/hijackthis.zip
>
> *Important:* Create a folder on the C: drive called C:\HJT.
> You can do this by going to My Computer (Windows key+e) then double click on
> C: then right click and select New then Folder and name it HJT.
>
> Move HijackThis.exe into this folder as you do not want the HijackThis
> backup logs in the Temp folder that should be cleaned out periodically nor
> all over your Desktop.
>
> When you run HijackThis from C:\HJT folder by double clicking on it and have
> it "Fixed checked" it will create a backup file of modifications to use if
> restore is necessary.
>
> Support forum:
> http://forums.maddoktor2.com/index.php?showforum=17
>
> Install the prevention protection below and *help your friends from being
> infected on the Internet.*
>
> "An ounce of prevention is worth a pound of cure."
>
> Remove the infections and install the prevention protection on *ALL* User
> Account IDs.
>
> Empty the Recycle Bin frequently.
>
> Download and run CCleaner as the Temp folders should be cleaned out
> periodically as installation programs and hijack programs leave a lot of
> junk there.
> http://www.ccleaner.com
> Then reboot to let it clean out what it found.
>
> Download Windows Prefetch Clean and Control then run it and clean the
> Prefetch monthly.
> http://www.majorgeeks.com/download2495.html
>
> Defrag the hard drive regularly especially after CCleaner.
>
> By the way, in order to improve Internet Explorer (IE) performance the
> Temporary(TIF)should be cleaned out periodically.
> Also, it is a good idea to limit the size of the TIF to 10MB for performance
> sake.
> In IE go to Tools then Internet Options then Settings and move the slider
> down to 10MB.
>
> Download and install WinPatrol.
> http://www.winpatrol.com
>
> *Note:* WinPatrol is more comprehensive than TeaTimer.
> Go to Spybot S&D and disable TeaTimer in the Tools Resident area.
>
> Browser settings for increased security:
> http://bshagnasty.home.att.net/browsersettings.htm
>
> Install IE-SPYAD then run the install.bat in the ie-spyad folder and
> SpywareBlaster then *keep them up to date* as today's Internet is full of
> nasty infections.
> https://netfiles.uiuc.edu/ehowes/www...ce.htm#IESPYAD
> http://www.bleepingcomputer.com/forums/tutorial53.html
> http://www.javacoolsoftware.com/spywareblaster.html
> --
> YoKenny
> Keep your Security software up to date at CoU
> http://www.dozleng.com/updates/index.php?&act=calendar
>

Great post. Thanks Kenny. I forwarded it via e-mail to a friend
who's just been victimized.

CN