PCTech Forums

Hey i think im having some spyware issues, or at least my computer keeps telling me that. Even after i use Ad-aware the message I recieve keeps poping up. The only tasks i seem unable to perform are changing my desktop background, and from time to time when im using the internet an error message will occur and it closes all the sites im looking at. If theres any programs you could recomend or other ways of helping me out with this issue it would be greatly appreciated. Thankyou for your time.

Hello evan, welcome to the forums.

I can help you find and remove the culprit.
Please download , unzip it to it's own folder.

Start HijackThis and select 'Do a system scan and save a logfile'
Now post the contents of the logfile back into this thread

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Please download
Extract KillBox but do not run it yet.

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
xpupdate.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {574F964D-ABEE-1433-D3A2-1B698D86B337} - C:\WINDOWS\fnude1.dll (file missing)
O2 - BHO: Class - {91D2A5F5-4C37-FBCB-F70B-FF0D23A6A054} - C:\WINDOWS\fnude1.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [DRVBAYSLOT] C:\winupdatedll.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] winssl.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCfox000
O23 - Service: Win32 USB2 Driver (BLA) - Unknown owner - C:\WINDOWS\System32\winssl.exe" -netsvcs (file missing)
O23 - Service: sfxlvcggzlkp (MsUpdate6) - Unknown owner - C:\WINDOWS\System32\msupd6.exe (file missing)

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.

Now start KillBox and paste or type the below into the text box:
C:\Windows\xpupdate.exe
Next put a check next to 'Delete on reboot' click on the red X, click yes to delete file on reboot.
Click no to reboot now. Now do the same for the following file:
C:\winupdatedll.exe

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.