AntiSpyware Soft keeps coming back

[Stop]

nope, please i don't want to reinstall windows

[Maniac]

Last known good configuration is not mean that you should re-install your Windows.

Did you see link that I gave you?

[Stop]

i did that and it didn't work

[Maniac]

Let's try to clean your computer with rescue cd.

Please try downloading and burning the following from another computer.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

• Download the
  Avira AntiVir Rescue System
  from
  here
  
  
• Place a blank CD in your burner and double-click on the downloaded file named
  rescue_system-common-en.exe
  
  
• The program will automatically burn the CD for you.
  
  
• Place the burned CD into the affected computer and start the computer from this CD.
  
  
• On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
  
  
• Click on the
  Configuration
  button.
  
  
  • Select
    Scan all files
    
    
  • Select
    Try to repair infected files
    and
    Rename files, if they cannot be removed
    
    
  • Select
    Scan for dialers
    
    
  • Select
    Scan for joke programs (Jokes)
    
    
  • Select
    Scan for games
    
    
  • Select
    Scan for spyware (SPR)
    
    
  [*]
  Click on
  Virus scanner
  [*]
  Click on
  Start scanner
  at the bottom of the screen
  [*]
  Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Possible solutions to Screen Resolution and other issues

1. Please see the post
   here
   if you're unable to view the entire screen of Avira.
   
   
2. You can also review this one
   Fixed Rescue CD Resolution Probs with Dell Video
   
   
3. Currently only the German keyboard is supported.
   Command Line not working
   English keyboards require work arounds.
   
   
4. Some computers attempt to mount the floppy even though they don't have one. You may need to go in to the BIOS and disable the floppy drive in order to mount your hard drive for scanning.
   
   

[Stop]

um i'm using this old sony vaio atm and a blank cd. I've put the cd in both slots and the program can't pick it up

[Maniac]

Here is information on how to boot from disc:

http://pcsupport.about.com/od/tipstricks/ht/bootcddvd.htm

[Stop]

i meant to burn the cd. I'll try another computer next

[Stop]

i burned the cd, it's scanning right now

[Maniac]

Relax, don't rush, I'm here.

[Stop]

ok it scanned and it still won't boot, same problem as before

[Maniac]

Any error or something else?

[Stop]

I believe this is what it officially says:

STOP: C00000139 {ENTRY POINT NOT FOUND} the procedure entry point createsolidbrush could not be located in the dynamic 1 link library GDI32.dll

I believe it says this on the blue screen right before it gets to the log in screen

[Maniac]

I need more details about this BSOD.

[Stop]

accutually i believe it says this instead:

stop: c0000139 {Entry point not found}

The procedure entry point GdiGetBitmapBitsSize could not be located in the dinamic link library

GDI32.dll."

Sorry ignore the post above, this is what it says on the blue screen

[Maniac]

Please see here:

http://social.technet.microsoft.com/Forums...a-1f78897c1023/

[Stop]

hey, i tryed to use the boot CD, i didn't know what i was doing and ended up starting a system restore. I turned off the comp in middle of it but it still did it's system restore when i rebooted. So ya i ended up reinstalling windows xp. I lost all my files pretty pissed at myself. My computer is in 03 model and had like ie7 lol. So i have alot of upgrading to do. Thanks for your help though. I wish combofix didn't screw up on me. Anyways you and your fellow helpers on this forum should keep up the good work, you guys are lifesaver, even if this situation didn't work out.

[Maniac]

I'm so sorry about that!

Your system was seriously infected. A lot of important system files was modified ([-]):

[-] 2004-08-10 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll

[-] 2004-08-10 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll

[-] 2005-07-26 . CE94A2BD25E3E9F4D46A7373FF455C6D . 397824 . . [5.1.2600.2726] . . c:\windows\system32\rpcss.dll

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe

[-] 2004-08-10 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-10 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll

[-] 2004-08-10 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll

[-] 2004-08-10 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll

[-] 2004-08-10 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll

[-] 2004-08-10 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2004-08-10 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2004-08-10 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2004-08-10 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll

[-] 2007-03-08 . B409909F6E2E8A7067076ED748ABF1E7 . 577536 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll

[-] 2004-08-10 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\explorer.exe

[-] 2004-08-10 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll

[-] 2004-08-10 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2004-08-10 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe

[-] 2006-12-19 . 6815DEF9B810AEFAC107EEAF72DA6F82 . 134656 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll

[-] 2004-08-10 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll

[-] 2004-08-10 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll

[-] 2005-03-10 . C29A5286E64D97385178452D5F307B98 . 295424 . . [5.1.2600.2627] . . c:\windows\system32\termsrv.dll

[-] 2004-08-10 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll

So I used ComboFix script to change this, to replace every single modified file with a clean copy ([7]).

Also, your system was infected with TDSS rootkit. ComboFix tried to remove it, but with no success.

Infected copy of c:\windows\system32\DRIVERS\aic78xx.sys was found and disinfected

Restored copy from - Kitty had a snack

GMER still detected it:

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8539AEC5]<< 
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7714f28
\Driver\ACPI -> ACPI.sys @ 0xf7527cb8
\Driver\atapi -> atapi.sys @ 0xf73ad852
\Driver\iaStor -> IASTOR.SYS @ 0xf73d1b58
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c04
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c04
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7274bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7281a21
SendHandler -> NDIS.sys @ 0xf725f87b
user & kernel MBR OK

So I use TDSSRootkit to clean it and with success, but there are other type of malware and that was pain in our case.

I'm sorry!