Winhound problems

[Guest]

Hello All,

A while back my boss got the dreaded winhound, PSGuard and all that. I have
successfully removed all the malicious files and ran smitrem.exe and have
successfully regained full control to everything except one thing. There is
a registry key under HKLM>Software> named Winhound.com. Smitrem and
smitfraud would not remove it... I have gone in manually changed the
permissions to the key and taken ownership of it. The Darn thing just won't
delete! I always get the error message Key cannot be deleted. If anyone
knows a fix for this or if there is something I am missing then please let me
know all suggestions are welcome... all except reinstalling or formatting
those are not an option. Thank you all in Advance.

Joe

Kemco IT Pro

 

[R. McCarty]

Try RegMon from SysInternals and make sure there isn't something still
on the machine accessing that Key/Value. Monitor RegMon's "Path"
column for activity on your problem key.
http://www.sysinternals.com/Utilities/Regmon.html

 

[PA Bear]

You must use the most recent version smitRem to remove Winhound.
Furthermore, you'll most likely need the assistance of an expert, after
posting a HijackThis log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**