Hey I posted my problem on the Windows XP section but i've moved my report to here.

I downloaded the spyware programs, but the first one, Spybot or something I think would always freeze when I tried to download the updates. And the second one, Adaware I think, would always reboot my system when I ran a scan. I used all the customized settings that were listed in the "read this first' sticky about how to config Adaware, but it wouldn't let me "snap windows to desktop borders," it would just appear as a grey X that I couldn't change to a green check. After it rebooted itself its been running really sluggish, and when things like msn messenger pop up usually its instant but in this case it won't start up at all. So I turned my computer off for awhile and i'll try and reboot it again soon.

Any suggestions as to why its restarting itself? I haven't turned system restore back on, should I do that?

Post a hijackthis log from this link:

http://www.d-a-l.com/help/showthread.php?t=32403


Back here, thnaks.

Hey, got a hijack this log for you.

Welcome,


When you come back please post your hijackthis log directly into this thread instead of as an attachment, it just makes it a little easier on me to read it. Thanks for that.


It looks like you have the vundo Trojan.


Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.


And a new hijackthis log please. Thanks.


Also...



Open Hijackthis.

Click the "Open the Misc Tools" section Button.

Click the "Open Uninstall Manager" Button.

Click the "Save list..." Button.

Save it to your desktop. Copy and paste the contents into your reply.

I just finished running a Vundoscan and it said no files infected? I donno if I can still post a log or not?

Do this then,



* Double-click VundoFix.exe to run it.
* Put a check next to "Run VundoFix as a task."
* You will receive a message saying vundofix will close and re-open in a minute or less. Click "OK".
* When VundoFix re-opens, click the "Scan for Vundo" button.
* Once it's done scanning, click the "Remove Vundo" button.
* If it says "No infected files were found", right-click the blank listbox (white box) in the main VundoFix window.
* Select "Add More Files?" from the menu that comes up. This will open a new VundoFix window that says "Paste files into the boxes below:"



* In the top/first field, copy and paste the path to the dll:

C:\WINDOWS\system32\iph863.dll

* In the next/second field, copy and paste the path to the reversed file:

C:\WINDOWS\system32\368hpi.*



* Click the "Add Files" button.
* Click the "Close Window" button.
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click "YES".
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click "OK".
* Turn your computer back on.
* Please post the contents of C:\vundofix.txt and a new HiJackThis log.


Good luck.

Hey, I tried to scan again and it didn't show up, so I put in the links you gave me and it found the trojan, but when I clicked to remove it, I got a window popping up that said Error: 57. I/0 Error reported, or something very similar. So my comptuer rebooted itself through VundoFix, and it asked if I wanted to remove it and the same thing happened, then when it rebooted itself for the third time the pathways didn't show up but I still have it. So we're getting closer, just haven't hit the nail on the head just yet.

P.S - How do I create a vundofix log?

Hi,


Infection is trying it's best not to die for sure.

* Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Go to my computer icon and double click it then click on C drive and see if you can see the vundofix.txt.


Also...



INSTRUCTIONS FOR USING AVG ANTI-SPYWARE in "NORMAL MODE"

Download and scan with AVG Anti-Spyware
1. After download, double click on the file to launch the install process.
2. Choose a language, click "OK" and then click "Next".
3. Read the "License Agreement" and click "I Agree".
4. Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".
5. After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.
6. The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.
7. Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".
8. Go to Start > Run and type: services.msc

* Press "OK".
* Click the "Extended tab" and scroll down the list to find AVG Anti-Spyware guard.
* When you find the guard service, double-click on it.
* In the Properties Window > General Tab that opens, click the "Stop" button.
* From the drop-down menu next to "Startup Type", click on "Manual".
* Now click "Apply", then "OK" and close the Services window.

9. Select the "Update" button and click "Start update". Wait until you see the "Update succesfull message". If you are having problems with the updater, manually update with the AVG Anti-Spyware Full database installer from HERE .

Once the updates are installed do the following:
1. Click on the "Scanner" button and choose the "Settings" tab.

* Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
* Under "How to Scan?" check all (default).
* Under "Possibly unwanted software" check all (default).
* Under "What to Scan?" make sure "Scan every file" is selected (default).
* Under "Reports" select "Automatically generate report after every scan" and UNcheck "Only if threats were found".

2. Click the "Scan" tab to return to scanning options.
3. Click "Complete System Scan" to start.
4. When the scan has finished you will be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the "Apply all actions button". If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

5. Click on "Save Report" to view all completed scans. Click on the most recent scan you just performed and select "Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
6. Exit AVG Anti-Spyware when done and submit the log report in your next response.

Close all open windows, programs, and DO NOT USE the computer while AVG Anti-Spyware is scanning. If Explorer or other programs are open during the scan that means certain files will also be in use. Some malware will insert itself and hide in areas that are "protected" by Windows when the files are being used. This can hamper AVG Anti-Spyware's ability to clean properly and may result in reinfection.

Hey, I didnt know if you wanted me to post or attach the avg log, so i just attachend (sorry if you wanted me to just post it), but ill post the vundofix log and run a new hijackthis and post those in text


VundoFix V6.2.1

Checking Java version...

Java version is 1.5.0.2

Scan started at 4:02:55 PM 12/10/2006

Listing files found while scanning....

No infected files were found.


VundoFix V6.2.1

Checking Java version...

Java version is 1.5.0.2

Scan started at 3:39:52 PM 13/10/2006

Listing files found while scanning....

No infected files were found.


Beginning removal...

Attempting to delete C:\WINDOWS\system32\iph863.dll
C:\WINDOWS\system32\iph863.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\iph863.dll
C:\WINDOWS\system32\iph863.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\iph863.dll
C:\WINDOWS\system32\iph863.dll Could not be deleted.

Performing Repairs to the registry.
Done!