Reformatting my computer

[crapkiller]

Well, i have never done this before, and i think its necessary. I have a virus that i cant get rid of, ive tried several different programs and stuff but none of them seem to solve the problem. Now i have random ads and random anti-spyware(yea, sure) programs popping up every 2 minutes. When ever i start my browser, it tells me that i may be infected with spyware and that i cannot safely surf the web. It says i should download an anti-spyware program to fix the problem. Now, i know that this is the viruses doing, trying to get me to pay for some crap program, and its pissing me off. Every 5 minutes windows alerts me of a "zlob" trojan. Im getting pissed off. I think i have to reformat the computer. I also wouldnt mind starting from scratch with a fresh hard drive that doesnt have all the crap i installed over the months.

The only problem is:

I dont think i have the windows CD. So im going to have to like download an illegitimate version? But, dont some programs upon installlation check if the user has a legal version of windows?

Do you think reformatting my computer is necessary?

Thanks



EDIT:

Just did a HiJackThis test and these were my results...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:13:28 PM, on 12/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Belkin\F5D9050\Belkinwcui.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jdk1.6.0_05\bin\javaw.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost.exe
C:\WINDOWS\system32\winscenter.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [_SetRes] c:\hp\bin\cloaker c:\hp\bin\res.bat
O4 - HKLM\..\Run: [regcmdcons] c:\hp\bin\cloaker.exe c:\hp\bin\cmdcons.cmd
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [F5D9050] C:\Program Files\Belkin\F5D9050\Belkinwcui.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [GetModule31] "C:\Program Files\GetModule\GetModule31.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD6767] cmd /c del "C:\WINDOWS\wt\webdriver.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6328] command /c del "C:\WINDOWS\wt\data.wts"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2896] cmd /c del "C:\WINDOWS\wt\data.wts"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8962] command /c del "C:\WINDOWS\system32\sfpnsovs.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1109] cmd /c del "C:\WINDOWS\system32\sfpnsovs.dll_old"
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: avgrsstx.dll WIKI.DLL zzohgr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

--
End of file - 10297 bytes

 

[demonavenger]

Hmm, one of my step-dads mates was having issues with his computer and sounds very similar to your problem...
His computer was loaded with, adware, spyware, viruses, etc...

Lol i used Spy Bot Search and Destroy, which you can find here: http://www.safer-networking.org/en/index.html
It is very effective, i find it alot better then Norton or AVG, etc...

When i fixed up the computer, it found like 336 Problems... i just lol'd!!

Anyhoo, good luck with the computer issue...

 

[crapkiller]

Hmm, one of my step-dads mates was having issues with his computer and sounds very similar to your problem...
His computer was loaded with, adware, spyware, viruses, etc...

Lol i used Spy Bot Search and Destroy, which you can find here: http://www.safer-networking.org/en/index.html
It is very effective, i find it alot better then Norton or AVG, etc...

When i fixed up the computer, it found like 336 Problems... i just lol'd!!

Anyhoo, good luck with the computer issue...

I used the same program, and it even found zlob and other things i believe are linked to the problem, but the problem persisted. :/

 

[SuF]

I would suggest asking a friend to see if they have a copy of Windows if your going to reformat.

If you want to try and solve the problem, download a few different programs that search for specific things such as one program for Spy Ware, one for Viruses, one for a firewall, one for malware, etc.

I had one malware thing on my old computer that popped up porn every few minutes, and my mom was not happy. I tried manually to get rid of it, and that failed and I just kept trying free software until one of them got it.

 

[cX jaxhax Xc]

or maybe you could try System Restore to the last date when you didnt have this happening. try that, then reformat

 

[Jimmy]

Before re-formatting try Malwarebytes
http://www.malwarebytes.com/mbam.php

Also, download SmitFraudFix from here:
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Follow this guide here:
http://www.geekstogo.com/forum/How-to-use-SmitFraudFix-t109268.html

 

[ivirz]

Try using the system restore tool before you reformat. It's much simpler, takes only a few minutes (depending on the size of restore point) and may solve your problem with much less hassle then reformatting would incur. System restore creates 'restore points' on your computer almost every time a program is installed or removed. Reverting back to an older system restore point may solve all your problems. If that doesnt work, maybe then you should think about reformatting.

 

[wowhamba]

Follow this guide : http://www.sythe.org/showthread.php?t=480152

That should get rid of the problem.

 

[Daily]

PM me to remind me and when I get home I'll take a look at the HJT log.

 

[Terry|Haz]

OK , judging from the state of the bad advice given here your going to be in need of some serious tactics.

1. Using torrent , Demonoid is a preferred Tracker as its 99% virus free , grab yourself TuneUP Utilities 2009. Run the '1' Click Maintenance after patching ith the crack / .reg file.

2. Using torrent Once more Find Nod32 Anti virus package. You WONT find a crack for it as there isnt one instead you will find a .url file which will guide you to a Users list hich you can rob an account with. IF Nod32 goes orange and says invalid username and password after a short while , say a week or more , Please go back to the .url file and select a new NON Blacklist User account and free will it back.

3. Torrent Ad-Aware Professional. There is NO better Deep cleanse for your computer in the slightest. This will find your 'adware / malware' and remove it generously. Although Nod32 will sort the worst of the malware.

Ok following these steps will get you everywhere. Heres a brief rundown.

1. Download the necessary items, crack / patch / edit user details.
2. Run Nod32 First , Thinking about it this will be better for maintenance.
3. Run Ad-aware professional.
4. Run '1 Click Maintenance' Nothin else. It will find all problems and i mean ALL , its by far the best program around for Registry , moved files, framgented files. It judges specifications for the OS your running. And what processes usually apply.
5. Use TuneUP to run a defrag OR get PerfectDisc , Which is arguably the best Defragmenting tool around. Next a short restart , and welcome to a computer which i hope runs as well as mine.

Before re-formatting try Malwarebytes
http://www.malwarebytes.com/mbam.php

Also, download SmitFraudFix from here:
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Follow this guide here:
http://www.geekstogo.com/forum/How-to-use-SmitFraudFix-t109268.html

Smitfraud will do crap, malware bytes runs FAR to much process memory. Awful idea imo.

To the OP , your running basic FREE virus control etc like AVG, yes it is GOOD but good in a sense its free and you cant complain at how it performs. Get rid of ad-ware 2007 and get professional remember to remove this install before adding the next.
Spybot search and destroy is the worst program created. It screws registry worse than a nun in a porn studio. It should be ravaged off the download stream. Your going to need to run TuneUp to fix the .reg and also going to have to Change your startup menu using Msconfig in the Alt+R [Run menu for the noobs] IF you want a teamviewer fix PM me on these forums first before asking for my msn , and ill do it via teamviewer. Im a C++ coder And can write a little C# and consider myself VERY well attuned with the working of regedit and the workings of computing. Btw to all people about to flame the post. Im 23 not a child dont consider my knowledge something of a childs.

 

[ivirz]

OK , judging from the state of the bad advice given here your going to be in need of some serious tactics.

Ouch, sorry for giving suggestions that actually respect intellectual property rights and the law. -.-

 

[The Fat Controller]

Try disabling this one:

C:\Program Files\Viewpoint\Common\ViewpointService.exe

I believe it's installed along with AIM, it's foistware. I've heard of it crippling people's computers before, although I have no idea why.

Terry|Haz, can you explain using more technical language... what's so wrong with Spybot S&D?