Why can't I remove this?

[G0AOZ]

Running W2k SP3, hardware firewall, up-to-date AVG, and Microsoft AntiSpyWare. Each morning after a scan, MS AntiSpyWare tells me it has found ShudderLTD/PSGuard, and has deleted it. However, a check in the registry still shows the bones of it, i.e.

HKEY_LOCAL_MACHINE\Software\ShudderLTD\PSGuard\PSGuard\Licence


Values are not set, but I cannot seem to delete these unwanted entries.

Question 1 - Should I expect MS AntiSpyWare to be able to kill this once and for all?

Question 2 - If yes, are there some parameters within MS AntiSpyWare I need to adjust to do this?

Question 3 - If "no" to Q 1 & 2, how do I manually delete these unwanted entries?


ROGER - G0AOZ.

 

[erikhertzel]

1. Antispyware must not be able to deal with deleting it once and for all.

2. No, you have the settings correct in the program.

3. Download the following:

http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Run Ewido --- When you run it for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
From the main ewido screen, click on update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful")
Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.


Also you can run a Hijack This! and post the results here:

http://www.majorgeeks.com/download3155.html

Hope this helps,

Erik

 

[pechenegs]

Psguard is related to smitfraud, spysheriff and antivirusgold, this will fix it for you!


If you have Windows 98 or ME substitute Ewido with adaware.

http://www.lavasoftusa.com/support/download/

* Click here to download smitRem.exe.


for W2k & XP

http://noahdfear.geekstogo.com/click counter/click.php?id=1

* Save the file to your desktop.
* Unzip smitRem.zip to extract the two files it contains.
* Do not do anything with it yet. You will run the RunThis.bat file later in safe mode.



*Download Cleanup from Here

http://www.stevengould.org/software/cleanup/download.html

* A window will open and choose SAVE, then DESKTOP as the destination.
* On your Desktop, click on Cleanup40.exe icon.
* Then, click RUN and place a checkmark beside "I Agree"
* Then click NEXT followed by START and OK.
* A window will appear with many choices, keep all the defaults as set when the Slide Bar to the left is set to Standard Quality.
* Click OK
* DO NOT RUN IT YET



* Download the trial version of Ewido Security Suite.

http://www.ewido.net/en/

* Install ewido.
* During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
* Launch ewido
* It will prompt you to update click the OK button and it will go to the main screen
* On the left side of the main screen click update
* Click on Start and let it update.
* DO NOT run a scan yet. You will do that later in safe mode.



* Click here for info on how to boot to safe mode if you don't already know how.

http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam

* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.


* Restart your computer into safe mode now. Perform the following steps in safe mode:


* Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"



* Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.



* Run Ewido:

* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop




* Run Cleanup:

* Click on the "Cleanup" button and let it run.
* Once its done, close the program.


* Go to Control Panel > Internet Options. Click on the Programs tab then
click the "Reset Web Settings" button. Click Apply then OK.



* Next go to Control Panel > Display. Click on the "Desktop" tab then click
the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" you
should see an entry checked called something like "Security info" or similar.
If it is there, select that entry and click the "Delete" button. Click OK
then Apply and OK.


* Restart back into Windows normally now.


* Run ActiveScan online virus scan here

http://www.pandasoftware.com/products/activescan.htm

When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
- Save the results from the scan!



post another hijack this log, the ewido and active scan logs

 

[G0AOZ]

Thanks for your replies. I've run the software as suggested, and I'm confident that the system is now completely clear. And looking at that key in the registry I no longer see any reference to ShudderLTD or PSGuard.

Many thanks indeed.

ROGER - G0AOZ.

 

[pechenegs]

yuo should post another hijack this log

 

[G0AOZ]

Pechenegs, here's the latest HijackThis log:-


Logfile of HijackThis v1.99.1
Scan saved at 19:36:49, on 20/09/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\devldr32.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\AGWPE\AGW PACK.EXE
C:\WINNT\system32\ntvdm.exe
C:\Program Files\Peak Systems\UI-View32-VHF\Uiview32.exe
C:\Program Files\Microsoft Office2000\Office\1033\msoffice.exe
C:\PROGRAM FILES\UI-PATH32-VHF\UIPATH.EXE
C:\Program Files\Peak Systems\UI-View32-HF30m\Uiview32.exe
C:\PROGRAM FILES\UI-PATH32-HF30M\UIPATH.EXE
C:\Program Files\Peak Systems\UI-View32-HF\Uiview32.exe
C:\PROGRAM FILES\UI-PATH32-HF\UIPATH.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\explorer.exe
C:\Zip-9l\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://uk.yahoo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://uk.yahoo.com/

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - Global Startup: AGWPE v2002.308.lnk = C:\AGWPE\AGW PACK.EXE
O4 - Global Startup: CLOCK.lnk = C:\WINNT\CLOCK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office2000\Office\OSA9.EXE
O4 - Global Startup: UI-View32 VHF.lnk = C:\Program Files\Peak Systems\UI-View32-VHF\Uiview32.exe
O16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) -

http://support.packardbell.com/files/activex/InfosFinder2.CAB

O17 - HKLM\System\CCS\Services\Tcpip\..\{0BE31D09-8FAE-4D29-A0A5-D325A4780DF7}: NameServer = 212.74.112.66,212.74.112.67
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BE31D09-8FAE-4D29-A0A5-D325A4780DF7}: NameServer = 212.74.112.66,212.74.112.67
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BE31D09-8FAE-4D29-A0A5-D325A4780DF7}: NameServer = 212.74.112.66,212.74.112.67
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe


Anything I need be concerned about...?


ROGER - G0AOZ.

 

[erikhertzel]

Roger,

I took a look at it and there is nothing that jumps out at me. I think you are safe, there are some unknown processes, but nothing that looks dangerous.

If you have ran ewido, have AVG installed, I would recommend running like Antispyware from Microsoft:

http://www.sabethacomputing.com/downloads.html

If you don't get any more hits, I would say you are good to go.

Hope this helps,

Erik

 

[G0AOZ]

Thank you Eric. Yes, I've run Ewido, AVG is bang up-to-date, and Microsoft AntiSpyWare is indeed running, as the log shows!

What jumps out at you re "unknown processes"?

ROGER - G0AOZ.

 

[erikhertzel]

Well, like this one:

C:\Program Files\Peak Systems\UI-View32-HF\Uiview32.exe

You may know what these are, which they are probably safe...

Hope that helps,

Erik

 

[G0AOZ]

Oh, ok fine Erik. That's APRS software I'm running for packet (ham) radio - UI-View and UI-Path. Both are fine, legitimate and licenced! Thanks very much.

ROGER - G0AOZ.