My Anti Spyware

VirusHeat rogue antispyware – How To Remove

VirusHeat is the fake anti-spyware, or rogue antispyware program. This program uses deceptive means for installation and purpose, may display fake scan results. This program usually installed itself onto your PC without your permission, through Zlob Trojan, Virus, fake audio/video codecs.

Symptoms:
Add/Remove Programs control panel entry: VirusHeat 3.9, VirusHeat 4.3
The hijackthis shows:

O4 – HKLM\..\Run: [VirusHeat 3.9] “C:\Program Files\VirusHeat 3.9\VirusHeat 3.9.exe” /h
O4 – HKLM\..\Run: [VirusHeat 4.3] “C:\Program Files\VirusHeat 4.3\VirusHeat 4.3.exe” /h

For fix your problems, make follow steps:

Download CCleaner. Double click on the file for install.
Download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop.

Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found: VirusHeat 3.9, VirusHeat 4.3

Download virusheat_fix.reg and save file to your Desktop.

Right clicking on the link and selecting Save Link As or Save File as, depending on your browser.

Double-click on the virusheat_fix.reg. When it asks if you would like to merge the information, press the Yes button and then the OK button when it is done.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd.

Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
You will be prompted : “Registry cleaning – Do you want to clean the registry ?“; answer “Yes” by typing Y and press “Enter” in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer “Yes” by typing Y and press “Enter”.

The tool may need to restart your computer to finish the cleaning process; if it doesn’t, please restart it into Normal Windows.

Run CCleaner.

Click Analyze button. After scan your system, click Run Cleaner.

Reboot your PC.

If you are still having problems with spyware after completing these instructions, it`s possible, then please follow the steps: How to use Spyware Removal Forum – MUST READ

Fresh updates to Ad-Aware and SpyBot-search & Destroy

0052.0000 is now available, new definition file for Ad-Aware 2007.

New definitions:
====================
Adware.E404 +2
Win32.Trojan.Srizbi

Updated definitions:
====================
AdvancedCleaner
Adware.Agent +4
Adware.VapSup
Adware.Websearch +3
AdwareAlert +4
AntiSpyKit
AntivirusPCSuite
AntiVirusPro
BraveSentry +2
Densmail
ErrClean +3
FakeAlert +2
IROffer
Lop
MalwareAlarm +2
MalwareCore +3
PCPrivacyTool +2
PerfectCleaner +2
PerformanceOptimizer
SpyAway +3
SpyShredder +4
SystemDefender
Toolbar.Softo
Ultimate Defender +5
Win32.Backdoor.Agent +3
Win32.Backdoor.Agobot
Win32.Backdoor.Bifrose
Win32.Backdoor.Delf +22
Win32.Backdoor.EggDrop
Win32.Backdoor.Hupigon
Win32.Backdoor.IRCBot +3
Win32.Backdoor.IRCZapchast +2
Win32.Backdoor.Kbot
Win32.Backdoor.Padodor
Win32.Backdoor.RBot +18
Win32.Backdoor.SDBot +2
Win32.Backdoor.Shark +3
Win32.Backdoor.VanBot +5
Win32.Backdoor.WootBot
Win32.Dialer.Trojan +10
Win32.Generic.PWS +3
Win32.Generic.Worm
Win32.Hoax.Renos +8
Win32.Rootkit.Agent +3
Win32.SpamTool.Agent
Win32.Trojan.Agent +35
Win32.Trojan.BAT
Win32.Trojan.BHO +2
Win32.Trojan.Buzus +5
Win32.Trojan.Delf +8
win32.Trojan.Dnschanger
Win32.Trojan.Inject +2
Win32.Trojan.Obfuscated
Win32.Trojan.Pakes +14
Win32.Trojan.Qhost +7
Win32.Trojan.SDBot
Win32.Trojan.Small +3
Win32.Trojan.Spy
Win32.Trojan.Tibs +30
Win32.Trojan.Vaklik +3
Win32.Trojan.VB +3
Win32.Trojan.Wublu
Win32.TrojanClicker +5
Win32.TrojanClicker.Costrat
Win32.TrojanClicker.Delf
Win32.TrojanClicker.VB +2
Win32.TrojanDownloader.Adload +7
Win32.TrojanDownloader.Agent +51
Win32.TrojanDownloader.Banload +13
Win32.TrojanDownloader.BHO +9
Win32.TrojanDownloader.ConHook +2
Win32.TrojanDownloader.Dadobra +2
Win32.TrojanDownloader.Delf
Win32.TrojanDownloader.Diehard +8
Win32.TrojanDownloader.Dirat
Win32.TrojanDownloader.Hmir +2
Win32.TrojanDownloader.IEDefender +2
Win32.TrojanDownloader.Murlo
Win32.TrojanDownloader.NewMedia +21
Win32.TrojanDownloader.Obfuscated
Win32.TrojanDownloader.Small +11
Win32.TrojanDownloader.Tibs +3
Win32.TrojanDownloader.Tiny +5
Win32.TrojanDownloader.VB +8
Win32.Trojandownloader.Zlob +12
Win32.TrojanDropper +6
Win32.Trojan-Dropper.MuDrop
Win32.TrojanDropper.Small
Win32.TrojanDropper.VB
Win32.TrojanProxy.Agent.dl +6
Win32.TrojanProxy.Jaber
Win32.TrojanProxy.Saturn +2
Win32.TrojanProxy.Small
Win32.TrojanProxy.Xorpix
Win32.Trojan-PSW.Delf +4
Win32.Trojan-PSW.Nilage +2
Win32.Trojan-PSW.Sinowal +2
Win32.TrojanPWS.LdPinch +4
Win32.TrojanPWS.OnlineGames +120
Win32.TrojanPWS.QQPass +2
Win32.TrojanPWS.WOW +3
Win32.TrojanSpy.Banker +43
Win32.TrojanSpy.BZub
Win32.TrojanSpy.Delf +5
Win32.TrojanSpy.Goldun
Win32.TrojanSpy.VB +3
Win32.TrojanSpy.Zbot +8
Win32.Virus.Delf
Win32.Virus.Parite
Win32.Virus.Trats +2
Win32.Virus.VB
Win32.Virus.Virut +8
Win32.Worm.Allaple +4
Win32.Worm.Autorun +6
Win32.Worm.Delf +2
Win32.Worm.Doomber
Win32.Worm.Downloader +2
Win32.Worm.Kolab +5
Win32.Worm.Warezov +4
Win32.Worm.Zhelatin +35
WinSpyKiller +2
WinZix +5
Virtumonde +11
VirusProtect
XPAntivirus +2
XPDefender +2

Download Ad-aware

Updates to SpyBot-search & Destroy
Dialer
+ Maxadult
Keylogger
+ HellzLittleSpy + Ardamax + SpyLantern
Malware
+ Win32.Alphabet.ap + Clickspring.Outerinfo + ErrorSweeper
Spyware
+ SpyMail
Trojan
+ Zlob.Downloader.se + Smitfraud-C.MSVPS + Win32.Delf.aoa + Win32.Expiro + Tibiabot.pk + Win32.Sohanad.t + Hupigon + Win32.Bifrose.LA + Win32.RJump.c + QQ-Pass + Win32.Delf.dch + Win32.Small.azl

Download SpyBot-search & Destroy

How to remove core.cache.dsk and parportt.sys

If your computer was infected, you got popups everywhere, the popups were appearing in Internet Explorer as well as Firefox and all popup blockers were not stopping the invasion.
The popups had several ad networks:

url.cpvfeed.com
upspiral.com
searchlocal.ws
xads.zedo.com
aavalue.com

Spybot found Smitfraud-c.core and and cant remove it, file core.cache.dsk. comes back every time when you reboot.

Download HijackThis and save the file to your desktop. Double click on the file for install.
Download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your desktop.
Download Combofix by sUBs and save to your desktop.
Download CCleaner. Double click on the file for install.

Reboot your computer in Safe Mode by doing the following:

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.

Start HijackThis. Click “Do a system scan only.” and put a checkmark next to the following items:

O20 – Winlogon Notify: ****** -******.dll (file missing)

Where ****** is random chars, agggdbc for example (google this dll for confirm)

Close all browser and other windows except for HijackThis. Click “Fix Checked”.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd.

Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
You will be prompted : “Registry cleaning – Do you want to clean the registry ?“; answer “Yes” by typing Y and press “Enter” in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer “Yes” by typing Y and press “Enter”.

The tool may need to restart your computer to finish the cleaning process; if it doesn’t, please restart it into Normal Windows.

Run Combofix.

Close any open browsers. Double click on combofix.exe and follow the prompts.

Run CCleaner.

Click Analyze button. After scan your system, click Run Cleaner.

Download and install SuperAntiSpyware Home Edition Free Version.

Now Start SuperAntiSpyware. On the main screen click on ‘Scan your computer’. Check: ‘Perform Complete Scan’. Click ‘Next’ to start the scan.

Superantispyware will now scan your computer,when it’s finished it will list all/any infections found. Make sure everything found has a checkmark next to it,then press ‘Next’. Click on ‘Finish’ when you’ve done.

If you are still having problems with spyware after completing these instructions, it`s possible, then please follow the steps: How to use Spyware Removal Forum
Include into your post follow logs:

smitfraudfix log (can be found at the root of the system drive, usually at C:\rapport.txt)
combofix log
superantispyware log