SPYWARE JUST KEEPS RUNNING 379060 Signatures?

[Paula]

----------------------------------------------------------
----------------------

Hi All

Last Monday I installed Verizon DSL. Right after
downloaded Microsoft Service Pack 2 and problems began. I
tryed to do a System Restore but for some reason I can't.
So, I went to Add/Remove Programs and uninstalled Service
Pack 2. I also uninstalled Verizon because Internet
Explorer kept crashing. I phoned Verizon and they said I
should check for spyware on my PC.

I installed Spybot, it found quite a few problems. I was
told to also use Microsoft Antispyware. I'm running a
deep scan. The program has been running for close to 48
hours. It has found:

FlashTrack Adware
Altnet Browser Plugin
WindUpdates.MediaAccess (3 signatures)
CommonName (379060 Signatures) AND STILL
RUNNING!!!!!!!!!??????
PowerReg Scheduler Spyware

It says it is scanning the Startup Registry programs. Is
it possible to have over 379060 signatures in the
registry? And all linked to CommonName?

I do notice when I run msconfig a file named pwvtwu.exe
is in startup a few hundred times! CPU is constantly
running at 100%.

When I did a search under hidden files I found that this
is connected with CommonName.Files associated with it
that also show up are rvptur, url8, obj, babe, dfs,
uwtvwp, url2, url1, url, url9, ikw.

I don't quite know what to do from here. I've been up for
the past 5 night till 2 or 3 am trying to get this
straight but can't seem to.

Is it normal for Microsoft Spyware to run for 48 hours or
more? Is there light at the end of the tunnel? This is
making me nuts!

Has anyone else run into this problem?

Any help is greatly appreciated.

Thanks In Advance!

Paula
(e-mail address removed)

 

[JohnF.]

You need to clean out all your temp files and temporary internet files, then
try again in safe mode.

 

[Bill Sanderson]

Can you do us all a favor?

If you are in the U.S. or Canada, and are having a problem with Windows
because of virus issues, or a problem with a security-related
patch--Microsoft PSS has free help.

1-866-PCSAFETY.

(this is also true outside the US, but the call may not be free--call your
local Microsoft subsidiary, or the number published for your locality for
paid Microsoft supprt, and ask for the free help with virus issues or
security patches.)

Tell them your story, and then come back and tell us what happened--how was
this resolved?

It's possible that they won't agree to take your call, since this isn't
strictly speaking a virus issue--but I think that they will.

I don't have a clear answer for this one, and I'd like to know what the
experts do!

 

[Guest]

Okay, pretty new at this. How do I go about doing this?
And should I really stop the scan?

Thanks for responding! And, please bear with me.

 

[Guest]

Okay, pretty new at this. How do I go about doing this?
And should I really stop the scan?

Use the Disk Cleanup Wizard.

 

[JohnF.]

START | ALL PROGRAMS | ACCESSORIES | SYSTEM TOOLS | DISK CLEAN UP

See what that willl do, then try the scan again. There is no sense in
scanning a bunch of files you don't need!



--
If you are under attack and MSAS does not seem to help:

*Submit suspected spyware report in the tools menu of MSAS*

PREP YOUR MACHINE FIRST!
- IF you are using Spybot S/D, UN-Immunize your computer
- IF you are using Adaware, turn off AD-Watch
- Disable all other active anti-spy applications
- Dump all temporary file locations and Internet files

1. Download:
lspfix.exe www.cexx.org/lspfix.htm
winsockxpfix.exe www.snapfiles.com/get/winsockxpfix.html
ccleaner.exe www.ccleaner.com
killbox.exe www.bleepingcomputer.com/files/killbox.php

2. Clean out all temp file locations with ccleaner.exe

3. Install and use killbox to delete stubborn files

4. Reboot into safe mode - http://tinyurl.com/pfca
5. Run MSAS at least twice in full/deep mode
6. Run a robust, updated antivirus software scan
7. Reboot into normal mode,see if problem has been corrected

8. If you think something is there but can't see it, download:
- Blacklight by F-Secure
www.europe.f-secure.com/exclude/blacklight/blbeta.exe
- RootKitRevealer by SysInternals
www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

9. If your problem is Virus or Security patch related:
In the United States or Canada, call 1-866-PCSAFETY
MS will provide free support for those issues.

Battle Notes:
- If you have trojans (files that won't go away),
you may have to disable System Restore on XP:
http://tinyurl.com/movy

- If your Internet connectivity quits:
http://support.microsoft.com/kb/892350
http://support.microsoft.com/kb/811259
LSPFix - www.cexx.org/lspfix.htm
Winsockxpfix - www.snapfiles.com/get/winsockxpfix.html

- Install SpywareBlaster to block malware apps from
installing on your machine. Does not actively run
on your machine, you run it, it makes changes that
protect you.
http://www.javacoolsoftware.com/

- This program will not detect or remove viruses
http://www.microsoft.com/athome/security/viruses/default.mspx

*** For assistance in battling infestations***
- Get HijackThis.exe from:
http://tomcoyote.org/hjt/hjt199//HijackThis.exe
- Save it to C:\hjt (new folder)
- Open it and select "Scan and Save Log"
- Send it to Ron Kinner as an attachment
- Ron's email address is (e-mail address removed)
- Put Hijack in the subject so he knows it's not spam

Application Notes:
Registering a VB6 dll seems to fix missing agents:
1) Open up a command prompt (start -> run -> cmd)
2) Type in the following "regsvr32 msvbvm60.dll" (without the quotes).
3) Close and re-open Windows AntiSpyware
4) If that fails, install VB6 runtime files:
http://www.softwarepatch.com/windows/vbrun6download.htm

- To report false positives:
www.microsoft.com/athome/security/spyware/software/isv/fpform.aspx
- To submit disputes or requests:
www.microsoft.com/athome/security/spyware/software/isv/cdform.aspx
- To learn more about how MS analyzes suspected spyware:
www.microsoft.com/athome/security/spyware/software/isv/analysis.mspx
- To Run MSAS in passive mode:
http://support.microsoft.com/kb/892375

Alternative Anti-Spyware Applications:
- Spybot Search and Destroy
http://www.majorgeeks.com/download2471.html
- LavaSoft AdAware
http://www.majorgeeks.com/download506.html
- AdAware VX2 Cleaner Plugin
http://www.majorgeeks.com/download4283.html
- BHODemon
http://www.majorgeeks.com/download3550.html
- CWShredder (CoolWWWSearch)
http://www.majorgeeks.com/download3019.html
- PestPatrol
http://www.majorgeeks.com/download1187.html
- Webroot Spysweeper
http://www.majorgeeks.com/download3263.html
- Ewido Security Suite
http://www.ewido.net/en/
- CounterSpy (Same Giant Company Engine as MSAS)
- http://www.sunbelt-software.com

Recommended Software to help protect you:
- Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/default.mspx
- SpywareBlaster
http://www.javacoolsoftware.com
- Outpost Firewall Pro
http://www.agnitum.com/products/outpost
---------------------------------------------