[inactive]Does Anyone Know Of Spyware That Does This?

Unknown
edited January 2007 in Spyware & Virus Removal
I wanting to know if anyone has come into a case like mine. I can use my mouse, I can click on icons to open , but I cant click and drag. This might have also been caused by me going into the resistry and deleating things. I turned of system restore, and did not make a back up of the resistry, I know stupid right, anyways,


Is there spyware that will do this , make it so you cant click and drag?

Comments

  • chess1234
    edited December 2006
    chess1234 wrote:
    I wanting to know if anyone has come into a case like mine. I can use my mouse, I can click on icons to open , but I cant click and drag. This might have also been caused by me going into the resistry and deleating things. I turned of system restore, and did not make a back up of the resistry, I know stupid right, anyways,


    Is there spyware that will do this , make it so you cant click and drag?

    Logfile of HijackThis v1.99.1
    Scan Saved at 11:08:27 PM, on 12/12/2006
    Platform : Windows XPSP2 (WinNT 5.01.2600)
    MSIE : Internet Explorer v6.00 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\System32\winlogon.exe
    C:\WINDOWS\System32\services.exe
    C:\WINDOWS\System32\lsass.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\TorjanHunter 4.6\THGuard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\augas.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    C:\Program Files\BigFix\BigFix.exe


    O4 - HKLM\..\Run: [LVCOMSX];C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [RealTray];C:\Program Files\Real\RealPlayer\Real Player.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [RegistryMechanic];C:\Program Files\Registry Mechanic\RegMech.exe/QS
    O4 - HKLM\..\Run: [SunJavaUpdateSched];C:\Program Files\Java\jrel.5.007\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent];"C:\ProgramFiles\Winamp\Winampa.exe"
    O4 - HKLM\..\Run: [WindowsRegKey update];Winupdate.exe
    O4 - HKLM\..\Run: [THGuard]"C:\Program Files\TrojanHunter 4.6\THGuard.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware]"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe"/minimized
    O4 - HKLM\..\Run: [LogitechVideoTray];C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair];C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKCU\..\Run: [Uniblue Registry Booster]C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe/S
    O4 - HKCU\..\Run: [ATI Launchpad];"C:\Program Files\ATI Multimedia\main\launchpd.exe"
    O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor];"C:\Program Files\McAfee\McAfee Shared Componets\Instant Updater\RuLaunch.exe"/Startmonitor
    O4 - HKCU\..\Run: [MSMSGS];"C:\Program Files\Messenger\msmsgs.exe"/background
    O4 - HKCU\..\Run: [msnmsgr];"C:\PROGRA~1\MSNMES~1\msnmsgr.exe"/background
    O4 - HKCU\..\Run: [Spyware Cleaner];"C:\Program Files\Spyware Cleaner\SpywareCleaner.exe"/boot
    O4 - HKCU\..\Run: [tbon];C:\Program Files\TBONBin\tbon.exe/r
    O4 - HKCU\..\Run: [Yahoo!Pager];C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe-quiet
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate];"C:\Prgram Files\Logitech\Video\ManifestEngine.exe"/boot
    O4 - Global Startup:BigFix.Ink=C:\Program Files\BigFix.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\ProgramFiles\Grisoft\Avg Anti-Spyware 7.5\guard.exe
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2006
    [STEP 1] Fix HijackThis Entries:
    Fix the following entries with HijackThis by placing checkmarks in the boxes next to them and clicking "Fix Checked".

    O4 - HKLM\..\Run: [WindowsRegKey update];Winupdate.exe
    O4 - HKCU\..\Run: [tbon];C:\Program Files\TBONBin\tbon.exe/r

    [STEP 2] Remove Malicious Files:
    Locate the following files using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.

    Winupdate.exe

    [STEP 3] Remove Malicious Folders:
    Locate the following folders using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.

    C:\Program Files\TBONBin\

    [STEP 4]Report Back to us:
    Once you have followed all of the steps above please reboot your computer and post a new HijackThis log.
  • chess1234
    edited December 2006
    Thankyou SpywareShooter
    Ok so I did everything You wanted me to do,
    here is my hijackthis log
    I still have the click and drag issue,


    Logfile of HijackThis v1.99.1
    Scan Saved at 8:47:06 PM, on 13/12/2006
    Platform: Windows XPSP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\System32\winlogon.exe
    C:\WINDOWS\System32\services.exe
    C:\WINDOWS\System32\lsass.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\augas.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    O4 - HKLM\..\Run: [LVCOMSX];C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [RealTray];C:\Program Files\Real\RealPlayer\Real Player.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [RegistryMechanic];C:\Program Files\Registry Mechanic\RegMech.exe/QS
    O4 - HKLM\..\Run: [SunJavaUpdateSched];C:\Program Files\Java\jrel.5.007\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent];"C:\ProgramFiles\Winamp\Winampa.exe"
    O4 - HKLM\..\Run: [THGuard]"C:\Program Files\TrojanHunter 4.6\THGuard.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware]"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe"/minimized
    O4 - HKLM\..\Run: [LogitechVideoTray];C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair];C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKCU\..\Run: [Uniblue Registry Booster]C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe/S
    O4 - HKCU\..\Run: [ATI Launchpad];"C:\Program Files\ATI Multimedia\main\launchpd.exe"
    O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor];"C:\Program Files\McAfee\McAfee Shared Componets\Instant Updater\RuLaunch.exe"/Startmonitor
    O4 - HKCU\..\Run: [MSMSGS];"C:\Program Files\Messenger\msmsgs.exe"/background
    O4 - HKCU\..\Run: [msnmsgr];"C:\PROGRA~1\MSNMES~1\msnmsgr.exe"/background
    O4 - HKCU\..\Run: [Spyware Cleaner];"C:\Program Files\Spyware Cleaner\SpywareCleaner.exe"/boot
    O4 - HKCU\..\Run: [Yahoo!Pager];C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe-quiet
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate];"C:\Program Files\Logitech\Video\ManifestEngine.exe"/boot
    O4 - Global Startup:BigFix.Ink=C:\Program Files\BigFix.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\ProgramFiles\Grisoft\Avg Anti-Spyware 7.5\guard.exe
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2006
    [STEP 1]Run Additional Tools:
    Your HijackThis log shows no more signs of executable malware. However, this does not mean that your system is completely clean. In order to make sure that all remaining pieces of this malware have been removed, it is reccomended that you download and scan with Ewido Anti-Malware. Please do an Ewido scan and post the log here.:

    Download Ewido

    [STEP 2]Report Back to us:
    Once you have followed all of the steps above please reboot your computer and post a new HijackThis log.
  • chess1234
    edited December 2006
    When I clicked on that hyper link for Download Ewido it just shows me a download for AVG Anti-Spyware 7.5 which you can tell in my Hijackthis log that I already have it , so I will post the log here tommorow. and a new Hijack log as well.


    I found Ewido Anti-Malware 4.0.0.172c from

    http://www.majorgeeks.com/Ewido_security_suite_d4677.html

    I dont know if this is the version you wanted but I will also download that and post that log as well, so 3 more logs tommorow.


    Thanks for all help
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2006
    Use AVG Antispyware. The name got changed and I still haven't updated my post. Sorry about the confusion.
  • chess1234
    edited December 2006
    Hi Iam sorry I forgot to get the avg log, I did run it , just forgot to bring it to work today, I did do a hijackThis log again last night,it too looks the same as yesterday. I dont work again untill Monday, I will post it the avg log then. I dont have internet access at home, dont want it either, for that computer anyways. After I get rid of all the Malware or virus, Will my Mouse click and drag work again? what Ideas do you have on that problem, or the Cd drive problem?
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2006
    Unfortunately, no, it won't fix the click/drag or CD drive problem. Those are not symptoms of spyware. Your system will be cleaner though. Your mouse and CD drive problems are most likely due to editing the registry, as you stated you did above.
  • chess1234
    edited December 2006
    Is there a site or forum, that you might be able to direct me too. so I can get a fix for the click/drag or CD drive problem?

    Thanks for all your help so far in this matter it is much appreciated
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2006
    You can try posting this in the Windows OS forum, but chances are that you will have to reinstall Windows.
  • jmoney3457jmoney3457 Maine
    edited January 2007
    Whilst we appreciate that you may be busy, it has been 7 days or more since we heard from you.

    Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Spyware & Virus Removal Forum

    If you wish this topic reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

    Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.
    If you are not the user who started this thread, you must start a new Thread instead :)
This discussion has been closed.