Infected every time I connect to the internet

Viruses and worms
1

Sorry I posted in the wrong place :frowning:

I am really desperate for help so I would appreciate anyone’s help very much.

Every time I log on to the net AVAST keeps finding these viruses:

File name: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp

Malware name: Win32:LocalAdv-H [Trj]

Malware type: Trojan Horse

VPS version: 000766-1, 17/08/2007

AND:

File name: C:\WINDOWS\TEMP\VRRB.tmp[UPX]

Malware name: Win32:LoadAdv-H [Trj]

Malware type: Trojan Horse

VPS version: 000766-1, 17/08/2007

I put them in the virus chest and I delete them but they just keep occuring!

Can anyone please help me? :frowning:

2

Here are the messages I keep receiving:

http://img01.picoodle.com/img/img01/9/8/17/t_untitledm_5bf07d2.png

http://img27.picoodle.com/img/img27/9/8/17/t_untitled2m_4674e81.png

3

Hi BlackCat,

Have you tried a boot time scan with avast!? Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested.

Try the usual free adware/spyware scanners.

AVG Anti-Spyware Free (Requires Win2k/XP)
Ad-Aware Free
Spybot Search & Destroy
SUPERAntiSpyware Free
a-Squared Free

Download, install and update the programs. Disconnect from the internet (pull the plug) before running scans in Safe Mode if possible.

Always select the option to quarantine any malware found rather than delete it, then you will be able to restore files or registry entries wrongly identified as malware- a rare but not unknown event for any malware scanner.

If still having problems, post a HijackThis! log.

When you have finished, scan for out-of-date and insecure software using Secunia Software Inspector and update any vulnerable software: this will help to prevent future infections.

4

If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:

  1. Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.

  2. Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.

  3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

  4. It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
    If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

  5. If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG, Panda and/or F-Secure BlackLight.

  6. Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

  7. After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

  8. Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.

5

If this happens everytime you connect to the internet, it could be that the page you have set as a homepage has this virus and is passing it to you. You didn’t clarify if this happens when you actually make an internet connection OR when your browser loads. If it when you load your browser and homepage, try setting it to a different homepage like Google and see if it still happens.

6

Thanks for the replies everyone.

I’ve tried XoftspySE, Ad-Aware, Spybot search & destroy & they removed eveything but the Malware I’ve shown.

This virus kicks in when I make an internet connection its not the browser.

I’ll try the other adware/spyware programmes that Frank suggested.

& I’m gonna follow Tech’s step by step.

7

Many users report it as being a rogue program.

It would be good, specially step 6.

8

And can be difficult to remove. Nothing short of dynamite(format and restore) removed it from my daughter’s old me machine. She was not alone.

9

Hi

Hey before you try, but, download or install ANY Anti-Spyware program it’s a real good idea to research it here first → http://www.spywarewarrior.com/rogue_anti-spyware.htm

Those guys will let you know what’s up with just about everything that’s on the market.

Good luck.

Wendy

10

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.

When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix’s window while its running. That may cause it to stall.

Click here to download HJTsetup.exe

[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.