Expert: Lorry - 7/6/2007

Question
QUESTION: Hi Lorry, I'm having the exact same problem described in:
http://en.allexperts.com/q/Computer-Security-Viruses-1737/Computer-sends-random-

I've tried different Spyware scans and Antivirus and I can't solve the problem. Could you please help me?

I also found the next files in the folder C:\Windows\system32 that I researched as bad:
rundll32.exe
pmnlmlj.dll
instcat.dll
xpdx.sys

ANSWER: Hi John,

No matter what anti-virus program you have installed or tried, using Internet Explorer, go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

Symantec has the up to date information on viruses/Trojans. So, even if a virus stopped your antivirus program from updating, this one will work.

Not knowing which anti-spyware programs you have used, try downloading the free version of Ad-aware 2007 from:

http://www.download.com/Ad-Aware-2007/3000-8022_4-10695895.html

Disable System Restore before removing this threat - or any other, as if you do not, it will just come back when you reboot the computer.

I would also suggest downloading Spybot - Search & Destroy 1.4, a program that removes spyware, available from:

http://www.pcworld.com/downloads/file_description/0,fid,22262,00.asp

Check for updates before running. If you have trouble getting the updates, near the top of the Update Window, click the little arrow next See-Cure  #1(Europe), highlight the next one on the list, See-Cure #2 and try to download the updates. If that doesn't work, try the next one the list. until you get one you can download from. Being a free program, if too many people are using the same site to download the updates, some people will not get them.

What Ad-aware 2007 misses, Spybot will get.

Hope this helps!
Lorry

---------- FOLLOW-UP ----------

QUESTION: Thanks Lorry for your help. Before I wrote you I checked my system with Symantec Antivirus and with Ad-Aware, both updated and nothing found, I was still having the problem. What I did was I cleaned the system with those tools and with a Registry cleaner, then after I restarted the computer in Safe Mode and run the antivirus and a Trojan Fix Vundo cleaner, and the Spyware. Those steps cleaned the system and then I restarted the computer and re run those utilities i Normal Mode, and at the end I ran the Registry Cleaner. Now my computer is working very good, with no problems so far. Please tell me if what I did is alright, or maybe my steps could help someone else.

Answer
Hi John,

The main thing to remember when removing a virus from XP is to disable System Restore first, remove the threat, then enable System Restore.

Just a suggestion, in the future if you have a virus, it is better to let us know the name of the virus, not where it is located. Being a firm Symantec user, I usually suggest people to run the free scan from the Symantec site, no matter which AV program they are using - including NAV. The reason being is that many of the viruses out there will stop the installed AV program, Symantec has up to date protection, so it makes sense.

You mentioned Ad-aware, do you have the latest free version Ad-aware 2007? If not, it can be downloaded from:

http://www.download.com/Ad-Aware-2007-Free/3000-8022_4-10045910.html

Do you have a firewall installed? If you are using the one that came with XP, I would suggest downloading the free version of Zone Alarm, available from:

http://www.download.com/3000-2092-10039884.html

You did a GREAT job, keep up the good work.

Have a great weekend!
Lorry