Question

Locked

Spyware on computer changed admin account to restricted account, need help

By amy571 ·
I allowed a friend visiting from out of town to use my computer, he proceeded to download some files which ended up containing spyware. My computer only has ONE user, my account which is the admin account. The spyware has apparently changed the admin user to a restricted user account, and I can no longer access control panel or other parts of my computer on it, as it says it is restricted and I do not have admin access. My user account is passworded and I have not forgotten the password. It is treating my admin account as if it is a normal user account, Is there any way I can fix this? I have ran 3 different spyware/ virus scanning programs and removed or quarantined everything it has found. Any help would be greatly appreciated.

This conversation is currently closed to new comments.

16 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Answers

Collapse -

out of luck

by CG IT In reply to Spyware on computer chang ...

if the only account on the computer was yours and it was the admin account and it somehow got changed to a restricted users account, there's nothing you can do.

you might try logging in using the user name administrator and use a blank password but I don't think that will work

Collapse -

Have you tried....

by CaptBilly1Eye In reply to Spyware on computer chang ...

... to boot to Safe Mode and perform an XP System Restore using the built-in utility?

If you are using XP, performing a System Restore to a date prior to when your 'friend' downloaded the garbage may be the best fix.

Boot to Safe Mode by tapping F8 while booting, then go to Start-All Programs-Accessories-System Tools-System Restore.


If that doesn't work, there is a tool from Microsoft called 'SubInACL' that is a command line tool that can restore administrator privileges to all keys in the Registry. That may correct the issue. I can supply you with a Batch file that will run the job after SubInACL is installed (I just have to dig it up).

http://tinyurl.com/6x22x

Collapse -

Here's the batch file...

by CaptBilly1Eye In reply to Have you tried....

This will restore administrator and system rights to all keys in the Registry.
You need to download and install SubInACL FIRST! http://tinyurl.com/6x22x

[Disclaimer - use at your own risk. I have tested this on Win2000 and WinXP machines. I offer this as a helper and do not assume liability for it's use or misuse]

Note: When making changes to the system registry, it is always a good idea to make a valid backup of the registry first!

OK... that being said, here you go...


Copy the text below the line into a .TXT file (use Notepad). Save, close and rename the .TXT file to 'Reset.BAT'. Then double-click it.

-----------------------------------

@echo off
cd C:\Program Files\Windows Resource Kits\Tools\
Echo This will start the Microsoft SubInACL command line utility
Echo.
Echo Please see Microsoft's Knowledgebase article 265360 for more information on the SubInACL command line utility
Echo http://support.microsoft.com/kb/265360
Echo.
echo If you do not want to continue, press Ctrl+C to exit.
pause

Echo.
Echo =========================
Echo Start
Echo =========================
Echo.

Echo Processing Registry Permission. Please wait...
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

REM Echo =========================
REM Echo Processing Folder Permission. Please wait...
REM Echo =========================
REM subinacl /subdirectories %SystemDrive% /grant=administrators=f
REM subinacl /subdirectories %SystemDrive% /grant=system=f

Echo =========================
Echo Finished.
Echo =========================
Echo.
Echo Please see Microsoft's Knowledgebase article 265360 for more information on the SubInACL command line utility
Echo http://support.microsoft.com/kb/265360
Echo.
pause
exit

Collapse -

I appreciate that.

by OnTheRopes In reply to Here's the batch file...

I've saved your reply to an OO.o file for possible future use. Thank you.

Collapse -

Didn't change admin account to restricted account

by Guan In reply to Spyware on computer chang ...

Hi,

On my experience, the problem doesn't cause by spyware/virus changed admin account to restricted account, but only restricted some potential admin tools (like control panel, regedit, etc)

Maybe this link can help you (http://www.dougknox.com/security/scripts_desc/nosetfolders.htm)

Collapse -

It is Malware

by willcomp In reply to Spyware on computer chang ...

Try running these 3 removal tools in order:
http://forums.majorgeeks.com/showthread.php?t=134965 ComboFix
http://www.atribune.org/content/view/24/2/ VundoFix
http://siri.geekstogo.com/SmitfraudFix.php

Follow instructions on linked pages.

Then download, install, update, and run:
http://www.superantispyware.com/download.html

Collapse -

It was useful! Sincere thanks!

by omanakuttanvn In reply to It is Malware

Fix report - Combofix
ComboFix 07-12-21.4 - OMANAKUTTAN 2007-12-29 21:51:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.506 [GMT 5.5:30]
Running from: C:\Documents and Settings\OMANAKUTTAN\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Start Menu\Programs.\PrivacyProtector Free
C:\Documents and Settings\All Users\Start Menu\Programs.\PrivacyProtector Free\PrivacyProtector HomePage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs.\PrivacyProtector Free\PrivacyProtector Online Manual.lnk
C:\Documents and Settings\All Users\Start Menu\Programs.\PrivacyProtector Free\PrivacyProtector Online Support.lnk
C:\Documents and Settings\All Users\Start Menu\Programs.\PrivacyProtector Free\PrivacyProtector.lnk
C:\Documents and Settings\All Users\Start Menu\Programs.\PrivacyProtector Free\Uninstall PrivacyProtector.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PrivacyProtector Free\PrivacyProtector HomePage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PrivacyProtector Free\PrivacyProtector Online Manual.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PrivacyProtector Free\PrivacyProtector Online Support.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PrivacyProtector Free\PrivacyProtector.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PrivacyProtector Free\Uninstall PrivacyProtector.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
C:\Documents and Settings\BABUKUTTAN\Start Menu\Programs\Startup\system.exe
C:\Documents and Settings\OMANAKUTTAN\Desktop\PrivacyProtector Free.lnk
C:\Documents and Settings\OMANAKUTTAN\Start Menu\Programs\Startup\system.exe
C:\Program Files\Common Files\PrivacyProtector Free
C:\Program Files\Common Files\PrivacyProtector Free\dcsm.exe
C:\Program Files\Common Files\PrivacyProtector Free\dnse.exe
C:\Program Files\PrivacyProtector Free
C:\Program Files\PrivacyProtector Free\Activate.dat
C:\Program Files\PrivacyProtector Free\Appbase\AE_CD_Cr.dat
C:\Program Files\PrivacyProtector Free\Appbase\AReadr4.dat
C:\Program Files\PrivacyProtector Free\Appbase\AReadr5.dat
C:\Program Files\PrivacyProtector Free\Appbase\ASDSEEpv.dat
C:\Program Files\PrivacyProtector Free\Appbase\ASPack.dat
C:\Program Files\PrivacyProtector Free\Appbase\Babylon.dat
C:\Program Files\PrivacyProtector Free\Appbase\BDelphi5.dat
C:\Program Files\PrivacyProtector Free\Appbase\CatchUp.dat
C:\Program Files\PrivacyProtector Free\Appbase\CBuildr5.dat
C:\Program Files\PrivacyProtector Free\Appbase\CCGA.dat
C:\Program Files\PrivacyProtector Free\Appbase\CManager.dat
C:\Program Files\PrivacyProtector Free\Appbase\CuteFTP4.dat
C:\Program Files\PrivacyProtector Free\Appbase\CuteHTML.dat
C:\Program Files\PrivacyProtector Free\Appbase\DAcceler.dat
C:\Program Files\PrivacyProtector Free\Appbase\DiscJug.dat
C:\Program Files\PrivacyProtector Free\Appbase\ECDCreat4.dat
C:\Program Files\PrivacyProtector Free\Appbase\Far.dat
C:\Program Files\PrivacyProtector Free\Appbase\FFTsks.dat
C:\Program Files\PrivacyProtector Free\Appbase\FlashFXP.dat
C:\Program Files\PrivacyProtector Free\Appbase\FrntPage.dat
C:\Program Files\PrivacyProtector Free\Appbase\FrontPEx.dat
C:\Program Files\PrivacyProtector Free\Appbase\FtpEXP.dat
C:\Program Files\PrivacyProtector Free\Appbase\FtpVoya.dat
C:\Program Files\PrivacyProtector Free\Appbase\GetRight.dat
C:\Program Files\PrivacyProtector Free\Appbase\GoZilla.dat
C:\Program Files\PrivacyProtector Free\Appbase\GravMRU.dat
C:\Program Files\PrivacyProtector Free\Appbase\H_TxtPad.dat
C:\Program Files\PrivacyProtector Free\Appbase\HomeSite.dat
C:\Program Files\PrivacyProtector Free\Appbase\HotDogPr.dat
C:\Program Files\PrivacyProtector Free\Appbase\IconExtr.dat
C:\Program Files\PrivacyProtector Free\Appbase\iMesh.dat
C:\Program Files\PrivacyProtector Free\Appbase\ImgReady3.dat
C:\Program Files\PrivacyProtector Free\Appbase\InsShExp.dat
C:\Program Files\PrivacyProtector Free\Appbase\JASC_P_P.dat
C:\Program Files\PrivacyProtector Free\Appbase\KaZaA.dat
C:\Program Files\PrivacyProtector Free\Appbase\LView.dat
C:\Program Files\PrivacyProtector Free\Appbase\MacDir.dat
C:\Program Files\PrivacyProtector Free\Appbase\MacDrWea.dat
C:\Program Files\PrivacyProtector Free\Appbase\MicAng.dat
C:\Program Files\PrivacyProtector Free\Appbase\MicDes.dat
C:\Program Files\PrivacyProtector Free\Appbase\MM_CON.dat
C:\Program Files\PrivacyProtector Free\Appbase\MMUnDisk.dat
C:\Program Files\PrivacyProtector Free\Appbase\Morpheus.dat
C:\Program Files\PrivacyProtector Free\Appbase\MPaint.dat
C:\Program Files\PrivacyProtector Free\Appbase\MPicPub.dat
C:\Program Files\PrivacyProtector Free\Appbase\MPImaGal.dat
C:\Program Files\PrivacyProtector Free\Appbase\MSExplorer.dat
C:\Program Files\PrivacyProtector Free\Appbase\MSoffice.dat
C:\Program Files\PrivacyProtector Free\Appbase\MSRegEdit.dat
C:\Program Files\PrivacyProtector Free\Appbase\MSWMP.dat
C:\Program Files\PrivacyProtector Free\Appbase\MSWordPad.dat
C:\Program Files\PrivacyProtector Free\Appbase\Nero.dat
C:\Program Files\PrivacyProtector Free\Appbase\NetShow.dat
C:\Program Files\PrivacyProtector Free\Appbase\NTBackup.dat
C:\Program Files\PrivacyProtector Free\Appbase\pfilelst.xda
C:\Program Files\PrivacyProtector Free\Appbase\PhotShel.dat
C:\Program Files\PrivacyProtector Free\Appbase\PHPCoder.dat
C:\Program Files\PrivacyProtector Free\Appbase\PowerZIP.dat
C:\Program Files\PrivacyProtector Free\Appbase\RapidBr.dat
C:\Program Files\PrivacyProtector Free\Appbase\RealAuPl.dat
C:\Program Files\PrivacyProtector Free\Appbase\RealDown.dat
C:\Program Files\PrivacyProtector Free\Appbase\SecurCRT.dat
C:\Program Files\PrivacyProtector Free\Appbase\SL_BlWin.dat
C:\Program Files\PrivacyProtector Free\Appbase\SmartClr.dat
C:\Program Files\PrivacyProtector Free\Appbase\Sonique.dat
C:\Program Files\PrivacyProtector Free\Appbase\StuffIt.dat
C:\Program Files\PrivacyProtector Free\Appbase\TelepPro.dat
C:\Program Files\PrivacyProtector Free\Appbase\UGifAnim.dat
C:\Program Files\PrivacyProtector Free\Appbase\UltraEd.dat
C:\Program Files\PrivacyProtector Free\Appbase\UMedStud.dat
C:\Program Files\PrivacyProtector Free\Appbase\UPhImpV.dat
C:\Program Files\PrivacyProtector Free\Appbase\UPhotoEx.dat
C:\Program Files\PrivacyProtector Free\Appbase\UVidStud.dat
C:\Program Files\PrivacyProtector Free\Appbase\VNC.dat
C:\Program Files\PrivacyProtector Free\Appbase\WebFeret.dat
C:\Program Files\PrivacyProtector Free\Appbase\WebReap.dat
C:\Program Files\PrivacyProtector Free\Appbase\WinACE.dat
C:\Program Files\PrivacyProtector Free\Appbase\WinGate.dat
C:\Program Files\PrivacyProtector Free\Appbase\WinRAR.dat
C:\Program Files\PrivacyProtector Free\Appbase\WinZIP.dat
C:\Program Files\PrivacyProtector Free\Appbase\WiseInst.dat
C:\Program Files\PrivacyProtector Free\Appbase\wordslst.xda
C:\Program Files\PrivacyProtector Free\Appbase\YahooPl.dat
C:\Program Files\PrivacyProtector Free\Appbase\ZipMagic.dat
C:\Program Files\PrivacyProtector Free\atl71.dll
C:\Program Files\PrivacyProtector Free\bnlink.dat
C:\Program Files\PrivacyProtector Free\err.log
C:\Program Files\PrivacyProtector Free\img\button.gif
C:\Program Files\PrivacyProtector Free\img\button2.gif
C:\Program Files\PrivacyProtector Free\img\header.gif
C:\Program Files\PrivacyProtector Free\img\logo.gif
C:\Program Files\PrivacyProtector Free\img\spacer.gif
C:\Program Files\PrivacyProtector Free\img\top_line.gif
C:\Program Files\PrivacyProtector Free\img\top1.jpg
C:\Program Files\PrivacyProtector Free\img\top2.jpg
C:\Program Files\PrivacyProtector Free\InstHelp.exe
C:\Program Files\PrivacyProtector Free\lapv.dat
C:\Program Files\PrivacyProtector Free\license.rtf
C:\Program Files\PrivacyProtector Free\manual.url
C:\Program Files\PrivacyProtector Free\mfc71.dll
C:\Program Files\PrivacyProtector Free\msvcp71.dll
C:\Program Files\PrivacyProtector Free\msvcr71.dll
C:\Program Files\PrivacyProtector Free\pv.dat
C:\Program Files\PrivacyProtector Free\readme.rtf
C:\Program Files\PrivacyProtector Free\ScanReport.dat
C:\Program Files\PrivacyProtector Free\Schedule.dat
C:\Program Files\PrivacyProtector Free\sr.log
C:\Program Files\PrivacyProtector Free\support.url
C:\Program Files\PrivacyProtector Free\unins000.dat
C:\Program Files\PrivacyProtector Free\unins000.exe
C:\Program Files\PrivacyProtector Free\uninstall.ico
C:\Program Files\PrivacyProtector Free\UninstallPage.html
C:\Program Files\PrivacyProtector Free\up.dat
C:\Program Files\PrivacyProtector Free\updater.dat
C:\Program Files\PrivacyProtector Free\UPRP.exe
C:\Program Files\PrivacyProtector Free\UPRP.url
C:\Program Files\PrivacyProtector Free\UPRP.xml
C:\Program Files\PrivacyProtector Free\uprpcw.exe
C:\Program Files\PrivacyProtector Free\UPRPPChk.dll
C:\Program Files\PrivacyProtector Free\vbpv.dat
C:\WINDOWS\setup.exe
C:\WINDOWS\system32\ipv6mons.dll
C:\WINDOWS\system32\oledb32.dll
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\vtr.dll
C:\WINDOWS\system32\WinAvXX.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-29 21:39 . 2007-12-29 21:39 <DIR> d-------- C:\Program Files\Windows Resource Kits
2007-12-28 00:11 . 2007-12-28 00:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-28 00:11 . 2007-12-28 00:11 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-16 22:46 . 2007-12-16 22:46 <DIR> d-------- C:\Documents and Settings\OMANAKUTTAN\Application Data\skypePM
2007-12-16 22:46 . 2007-12-16 22:46 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-12-16 22:44 . 2007-12-29 09:17 <DIR> d-------- C:\Documents and Settings\OMANAKUTTAN\Application Data\Skype
2007-12-16 12:26 . 2007-12-16 12:26 36,728 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-12-16 12:23 . 2007-12-29 09:17 <DIR> d-------- C:\Program Files\Safari
2007-12-16 12:23 . 2007-12-29 09:21 <DIR> d-------- C:\Program Files\Bonjour
2007-12-16 12:23 . 2007-12-29 09:18 <DIR> d-------- C:\Program Files\Apple Software Update
2007-12-13 09:35 . 2007-12-29 09:18 <DIR> d-------- C:\Program Files\Skype
2007-12-13 09:35 . 2007-12-29 09:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2094-03-16 15:23 19,456 ----a-w C:\Program Files\html tutor 2.0.doc
2094-02-21 16:37 192 ----a-w C:\Program Files\Thanx To.txt
2094-02-21 16:33 5,632 ----a-w C:\Program Files\Order Sheet.doc
2094-02-21 16:25 336 ----a-w C:\Program Files\Read Me.txt
2094-02-21 06:51 209,408 ----a-w C:\Program Files\html tutor 1.0.doc
2007-12-29 12:58 --------- d-----w C:\Program Files\PROPHET3
2007-12-16 06:54 --------- d-----w C:\Documents and Settings\OMANAKUTTAN\Application Data\Apple Computer
2007-08-22 20:26 41,672 ----a-w C:\Documents and Settings\OMANAKUTTAN\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 21:54]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" []
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-03-01 18:11]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-04-05 23:51]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-04-05 23:51]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-04-05 23:51]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-11-18 09:17]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 02:26]
"SkyTel"="SkyTel.EXE" [2006-05-17 06:34 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-26 02:51]
"VAIO Recovery"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 09:38]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 01:33]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-21 02:42]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 10:06]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2006-08-28 03:16]
"VAIOSurvey"="c:\program files\sony\vaio survey\surveysa.exe" [2005-06-14 04:12]
"Switcher.exe"="C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-15 00:41]
"HostManager"="C:\Program Files\Common Files\AOL\1158265598\ee\AOLSoftware.exe" [2006-04-14 02:06]
"DISCover"="C:\Program Files\DISC\DISCover.exe" [2006-06-02 06:25]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-23 00:24]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"WinAVX"="C:\WINDOWS\system32\WinAvXX.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-12 22:19:25]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 11:35:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Trend Micro Anti-Spyware.lnk - C:\Program Files\Trend Micro\Tmas\Tmas.exe [2006-09-15 01:49:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"= 1 (0x1)
"NoWindowsUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= C:\Program Files\Trend Micro\Tmas\sshook.dll [2006-09-15 01:49 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2006-06-21 04:41 73728 C:\WINDOWS\system32\VESWinlogon.dll

R3 ti21sony;ti21sony;C:\WINDOWS\system32\drivers\ti21sony.sys [2006-02-22 08:02]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-15 07:40]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9fd8d1f0-b9ce-11db-bd00-0018de78301c}]
\Shell\AutoRun\command - F:\wd_windows_tools\setup.exe

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 22:01:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-29 22:02:56 - machine was rebooted

Collapse -

Nothing like.....

by ThumbsUp2 In reply to It was useful! Sincere th ...

giving the entire world access to your personal details in a forum post! Geez! No wonder you caught the nasty bug. Do you not have any idea how to hide your private details to prevent more trouble?

I would suggest you edit your post and remove ALL personally identifiable details.

Collapse -

You're Welcome --- BUT

by willcomp In reply to It was useful! Sincere th ...

I should have told you not to post the ComboFix log. Realize you were just following instructions on web page.

Collapse -

Restored admin access.

by amy571 In reply to Spyware on computer chang ...

Thanks for everyones help. I was able to restore admin access, and created a restricted guest account, and a 2nd passworded account with admin access.

I am following willcomp's advice now to make sure all malware is removed.

The only thing there that doesn't seem to be working is VundoFix. One of the things that was detected on my computer was a Vundo trojan, found by my anti virus and spyware programs, but not being detected by VundoFix, and those can't seem to remove it. I am trying SUPERanti spyware now so hopefully it can get rid of it.

Back to Malware Forum
16 total posts (Page 1 of 2)   01 | 02   Next

Security Forums