I used AVG to clean the virus infected files. It took about 10 passes
to get the PC clean. the first time I ran it 450 infected files were
found and deleted. the second time i ran it 415 were found then the
next time i ran it 319 etc.
Yes all the tools are latest versions and updated
now on to the current problem.
I have run Ad-Aware, MS Antispyware, and Spybot search and destroy both
MS Antispyware and Spybot find 2 spyware hits.
PSGaurd - HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD\PSGUARD
YourSiteBar - HKEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar
these are registry entries
the spyware removel programs say the removed them but when they are run
again the same 2 reg entries are caught.
I have tried to manually delete the entries but get a can not delete
selected key. Error while deleting key.
Thank you for all your help
From: "frogman" <frogman7@swbell.net>
| I used AVG to clean the virus infected files. It took about 10 passes
| to get the PC clean. the first time I ran it 450 infected files were
| found and deleted. the second time i ran it 415 were found then the
| next time i ran it 319 etc.
|
| Yes all the tools are latest versions and updated
< snip >
Yikes -- If you had THAT many detected by AVG that is not good !
It is possible that AVG may have missed some viruses, Trojans or other malware.
Please use the following tool which provides anti virus scanners from; McAfee, Sophos and
Trend Micro.
None of which have to pre-exist on your PC.
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove viruses, Trojans and various other malware.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.
* * * Please report back your results * * *

Signature
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
frogman - 28 Sep 2005 19:47 GMT
The process you described found many more problems and made the PC stop
having the popup problems but it still did not remove:
PSGaurd - HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD\PSGUARD
YourSiteBar - HKEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar
so the next step it to format and reinstall.
Thanks for all your help
David H. Lipman - 28 Sep 2005 22:26 GMT
From: "frogman" <frogman7@swbell.net>
| The process you described found many more problems and made the PC stop
| having the popup problems but it still did not remove:
[quoted text clipped - 4 lines]
|
| Thanks for all your help
In this case... I agree with your conclusion.
However, you must laern to practice Safe Hex or you will be dealing with future cyclical
re-formatting sessions.
http://www.claymania.com/safe-hex.html

Signature
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm