Spyware still hiding after 3 weeks of searching!

Blizzard596 · 03-21-2007, 10:45 AM

The following 2 lines keep showing up in HJT no matter how many times I "fix" them:

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\mhwwc.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,xddbmyk. exe

I can't find those files anywhere, nor can I find any references to them, aside from what HJT finds. I've run Adaware, Spybot, Panda Activescan, BitDefender Online, and Symantec NAV 2004, all with the latest updates and none of those find ANYTHING. Despite nothing being found, I keep getting pop-up ads so there's obviously some form of spyware here.

Thanks for any help.

Ste · 03-21-2007, 11:40 AM

Have you tried the immunize features of spywareblaster, spybot search and destroy and or spyware docter....

Blizzard596 · 03-21-2007, 11:58 AM

I have used those features in spyware blaster and spybot, but not spyware doctor.

I just found the entries in the registry and deleted them, but they reappeared on reboot. Would it have to be a running process that's adding those entries? Because I don't see a single running process that looks out of line.

Ste · 03-21-2007, 12:25 PM

Doesn't have to be a separate process. There might have been an edit or addition to an exsisting system process, which was placed there by the spyware.

Maybe you could delete the entries in system.ini then make the file read only.

That "may" Prevent the entries from being writtin again. That may be a temp fix as system.ini is changed when programs are installed...

Blizzard596 · 03-21-2007, 01:34 PM

Well, I've already checked the system.ini and the entries aren't there. From the little research I did on it, apparently XP "maps" those entries to the registry instead of writing them to system.ini. So is there any way to make a registry key read-only?

This thing is driving me crazy! It's the fist spyware I've ever had this much trouble with.

Blizzard596 · 03-21-2007, 06:21 PM

I think I finally got it! I had about given up on the usual anti-spyware apps to find it, but in a last ditch effort, I downloaded "SUPERAntiSpyware" and it found 3 trojan droppers that the others missed. So far the symptoms haven't come back so I'm thinking it's all good now.

SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!

Thanks for your input.

Osiris · 03-21-2007, 08:31 PM

goodjob

Member Login