help with spyware

trigger033 · Aug 13, 2006

hi, i think i have spyware in my computer, i use ewido and panda anti virus
i d/l a program called 'VX2 Finder' not quite sure wat it does but here is a log file of it.

Log for VX2.BetterInternet File Finder (ALL)

Files Found---

Additional Files---

Keys Under Notify---
AtiExtEvent
avldr
crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
termsrv
WgaLogon
winrzf32
wlballoon

Guardian Key--- is called:

Guardian Key--- :

User Agent String---
{8E19385F-D46C-66D5-B1C5-B8FBA257FB70}

can anyone help me with please and do i haVE spyware

Tommy · Aug 13, 2006

This little tool is searching for the trojan 'VX2.BetterInternet '. I think these are responsable for wrong 'system rights'.
Never used that tool but it seam that you have a User-Agent string in your registry, but i don't know what that means.

Edit:
Googled arround a bit an found that:

version 1.0.0.13 Available from
http://www.downloads.subratam.org/VX2Finder.exe

This will only work on Win2K, XP

-Finds all files created by Look2Me (although it is possible an error could occur detecting and listing files, but skilled eyes looking at filenames can decide that fairly quickly.. it hasn't been wrong yet)
Also confirmation needed for every file to delete.(safety)

1.)Delete all files found(VX2Finder will "End Task" on up to 2 instances of Rundll32.exe automatically)
You will get a message about "cannot delete this one" matching the same name in the Guardian Key.

2.)Click "Open regedit" will take you right to the Guardian Key(no need to search for it)
Guide user through procedure of Quote:

Hilite "Guardian", RightClick and choose
Security/permissions, you'll get another
window with 'advanced'..
DE-select (uncheck) the lower box with
"inheritable permissions"
hit 'ok' and 'remove' on the following security prompts.

Restart computer.

3.)On restart use VX2Finder again, select + delete the last file, click "User Agent$" will remove that entry from the registry.

4.)Click "Open regedit" again, this time restoring the checkmark in "inheritable permissions"

5.)Click "Guardian.reg" Deletes the Guardian Key.

6.Use Find again should produce a clean log of blank values.

7.)Click "Restore Policy" to restore the Debug policy altered in the look2Me installation.(requires reboot to apply, but not immediatley neccessary)
Click to expand...

snowbound · Aug 14, 2006

trigger033 said:

do i haVE spyware
Click to expand...

One sure way to find out is to post a HijackThis log over at this site,

http://gladiator-antivirus.com/forum/index.php?showtopic=10517

for analysis by the experts there and guidance on malware removal if infections are present.

snowbound

Log in or Sign up

help with spyware

trigger033 Registered Member

Tommy Registered Member

snowbound Retired Moderator

Log in or Sign up

help with spyware

trigger033 Registered Member

Tommy Registered Member

snowbound Retired Moderator

Useful Searches