spyware.perfect removal?

[krafty88]

Greetings. Hope I'm in the right place to ask this type of question. The computer I'm working on is infected with spyware.perfect or in Mcfee's terms, keylogger-perfect. There are 9 instances and I can't seem to get rid of them. I believe the reason is that the infected files are still on the system - only problem is I don't know where they are. I did the McAfee online scan and it came up with something like this:
c:\..\..\inst_something runescape_something.exe

I could not find the full path. I have norton antivirus running and have attempted their posted clean up routine numerous time, but it doesn't work because none of the files they say to delete exist, nore do the registry settings they say to delete.

I know the spyware and virus stuff was coming from the game runescape because the rules were not followed, so I did a search on "rune" and deleted all files found.

Any help would be most appreciated.

 

[electronicsfreak]

First off I reccomend downloading and running ewido from the link below.

http://www.ewido.net/en/

Second off I reccomend this online system scan. Do a full system scan.

http://housecall.trendmicro.com/

3rd when done, download hijackthis from the link below. Extract to desktop or prefered folder. Open it up, choose do a system scan and save a logfile. Post the logfile on here and unless your sure of what your doing dont attempt to fix anything as most items are legit.

http://www.majorgeeks.com/download3155.html

 

[pechenegs]

http://securityresponse.symantec.com/avcenter/venc/data/spyware.perfect.html

Download the pocket killbox

http://www.bleepingcomputer.com/files/killbox.php

Double-click on Killbox.exe to run it. Now put a tick by Delete on
Reboot. In the "Full Path of File to Delete" box, copy and paste each
of the following lines one at a time then click on the button that has
the red circle with the X in the middle after you enter each file.
It will ask for confimation to delete the file on next reboot. Click
Yes. It will then ask if you want to reboot now. Click No. Continue
with that same procedure until you have copied and pasted all of
these in the "Paste Full Path of File to Delete" box.Then click yes
to reboot after you entered the last one.


Note: It is possible that Killbox will tell you that one or more files do not
exist. If that happens, just continue on with all the files. Be sure you
don't miss any.


If there are any other files showing up in a hijack this log out of the ones listed in the symantec site put them through the killbox as well, or wait for advice!



C:\Program Files\BPK



Run ActiveScan online virus scan here

http://www.pandasoftware.com/products/activescan.htm

When the scan is finished, anything that it cannot clean have it delete it.
Make a note of the file location of anything that cannot be deleted so you
can delete it yourself.
- Save the results from the scan!



post another hijack this log, the ewido and active scan logs


Member of ASAP Alliance of Security Analysis Professionals

under the name khazars