A virus that just wont go away

I am using Windows XP and mozilla as my browser i connect to the internet by AT&T cable
Here is the problem that I am having
C:\WINDOWS\TEMP~os45.tmp\AppInit.dll
Win32:Adware-gen [Adw]
Adware
090107-0, 01/07/2009

C:\WINDOWS\TEMP~os45.tmp\ossproxy.exe
Win32:Trojan-gen {Other}
Virus/Worm
090107-0, 01/07/2009

i have ran avast numerous times and each time the virus changes the os # i have tried to delete the source files. However, it will not let me due to access restrictions. I am not the most computer savy and i do not know how to turn off system restore. I tried using a link that was in the forum but to no avail it did not work. Any help would be great.

Well given the file name (trying to look like an official file) and its location (not in the correct folder for a system file) the detections look good.

If it keeps coming back, there is likely to be an undetected or hidden element to the infection that restores or downloads the file again. What is your firewall ?

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).

  1. SUPERantispyware On-Demand only in free version.
  2. MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.

Hi ya

my experience of these types of virus is that they are “protected” by root kits. Try downloading and running a rootkit revealer. Once the root kit is detected and deleted then tell avast to scan on boot before windows has fully loaded

www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Sometimes avast will still find the file but be unable to delete it. Use an unlocker program to force a change in the permissions or to just delete it yourself- will require a reboot

http://www.topdrawerdownloads.com/download/104402

The problem with rootkit revealer is it is an analysis tool in the same as hijackthis, so its data needs analysed by someone with experience to determine what is legit and what isn’t.

avast does a rootkit scan 8 minutes after boot, so up to a point that could catch a rootkit hiding/generating malware. MBAM also has some rootkit detection capability.

I did the super antispyware application in safe mode and when it came time to reboot i got the blue screen of death. How can i copy or see what the error message was so that you can direct me further.

I’m not entirely sure which it is that you want help with. The Blue Screen, Stop error code and any file names reported are the most important info.

Or the SAS log of the scan, Open SAS and Click the Preferences, Statistics/Logs tab and select the last .log file, copy and paste the contents or attach a copy of the log (Save As from notepad).

here is the crazy stuff pulled off of my comp
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/08/2009 at 12:00 PM

Application Version : 4.24.1004

Core Rules Database Version : 3700
Trace Rules Database Version: 1676

Scan type : Complete Scan
Total Scan Time : 00:16:40

Memory items scanned : 214
Memory threats detected : 2
Registry items scanned : 6576
Registry threats detected : 24
File items scanned : 18975
File threats detected : 17

Spyware.RelevantKnowledge
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLLS.DLL
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLLS.DLL
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLVKNLG.EXE
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLVKNLG.EXE
[RelevantKnowledge] C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLVKNLG.EXE
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\RelevantKnowledge
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\RELEVANTKNOWLEDGE\UNINSTALL INSTRUCTIONS.LNK
C:\RECYCLER\S-1-5-21-436374069-1482476501-839522115-1004\DC60\UNINSTALL INSTRUCTIONS.LNK
C:\SYSTEM VOLUME INFORMATION_RESTORE{16A8FA86-6977-4B41-A5EF-B10EDC5D0233}\RP904\A0127977.LNK
C:\WINDOWS\Prefetch\RLVKNLG.EXE-2A0A2C3D.pf

Adware.ShopAtHomeSelect
HKLM\Software\Classes\CLSID{E8DAAA30-6CAA-4b58-9603-8E54238219E2}
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}\InprocServer32
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}\InprocServer32#ThreadingModel
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}\ProgID
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}\Programmable
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}\TypeLib
HKCR\CLSID{E8DAAA30-6CAA-4B58-9603-8E54238219E2}\VersionIndependentProgID
HKCR\ToolBand.ShopAtHomeIEHelper.1
HKCR\ToolBand.ShopAtHomeIEHelper.1\CLSID
HKCR\ToolBand.ShopAtHomeIEHelper
HKCR\ToolBand.ShopAtHomeIEHelper\CLSID
HKCR\ToolBand.ShopAtHomeIEHelper\CurVer
HKCR\TypeLib{462E4AEC-DB3B-4e69-AF61-4F300D76255C}
HKCR\TypeLib{462E4AEC-DB3B-4e69-AF61-4F300D76255C}\1.0
HKCR\TypeLib{462E4AEC-DB3B-4e69-AF61-4F300D76255C}\1.0\0
HKCR\TypeLib{462E4AEC-DB3B-4e69-AF61-4F300D76255C}\1.0\0\win32
HKCR\TypeLib{462E4AEC-DB3B-4e69-AF61-4F300D76255C}\1.0\FLAGS
HKCR\TypeLib{462E4AEC-DB3B-4e69-AF61-4F300D76255C}\1.0\HELPDIR
C:\PROGRAM FILES\SELECTREBATES\TOOLBAR\SHOPATHOMETOOLBAR.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{E8DAAA30-6CAA-4b58-9603-8E54238219E2}
HKU\S-1-5-21-436374069-1482476501-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{E8DAAA30-6CAA-4B58-9603-8E54238219E2}

Adware.Tracking Cookie
C:\Documents and Settings\Ryan & Chelsea\Cookies\ryan_&chelsea@myaccount.turbine[1].txt
C:\Documents and Settings\Ryan & Chelsea\Cookies\ryan
&chelsea@www.mynortonaccount[1].txt
C:\Documents and Settings\Ryan & Chelsea\Cookies\ryan
&_chelsea@interclick[1].txt

RelevantKnowledge Spyware Component
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLAI.DLL
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLPH.DLL
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLSERVICE.EXE
C:\PROGRAM FILES\RELEVANTKNOWLEDGE\RLXF.DLL
C:\RECYCLER\S-1-5-21-436374069-1482476501-839522115-1004\DC61.DLL
C:\RECYCLER\S-1-5-21-436374069-1482476501-839522115-1004\DC62.DLL
C:\RECYCLER\S-1-5-21-436374069-1482476501-839522115-1004\DC64.EXE

Hi godssoldier777,

The removal instruction you find here:
http://www.bleepingcomputer.com/uninstall/1054/RelevantKnowledge.html

polonus

The detections look good, though there isn’t anything mega serious (delivery of ads etc.) however it is best that it has been removed by SAS.

Follow up on polonus’s link to make sure all elements are removed. Also see http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453097949.

Then run MBAM also from safe mode and report the findings.

Follow that up with a Spybot S&D check and clean you regs with “Ccleaner” That that you’ll find almost everything