Help with SysProtect.exe or Win something or other HIjackthi | Thread profile

I am trying to get rid of a perticularly visious peice of malware on a friends machine. said malware is sysprotect.exe winfixer.N , bgates[1].exe aka pissing me off. ive tried such programes as smitfraudfix, and various others and virtually every peice of non-harming and non-spywareinstalling freeware i can find... soon to post hijack this log......thanks if anyone has delt with this foul beast ...

Logfile of HijackThis v1.99.1 Scan saved at 6:13:28 PM, on 28/06/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5346.0005) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost....

i have no specific suggestions, but seeing weatherbug in that list, it wouldn't surprise me if your friend's system has multiple spyware issues.

yes is quiet a pain.Can seem to nuke them all but 2.

WINSUPDATER.EXE and accessweb.exe are crapware as well. Also 8c076d3d.exe is kinda suspicious too. A description of WINSUPDATER.EXE http://www.sophos.com/security/analyses/w32rbotzz. html

backup. format. reinstall. much easier at that point. and lock it down so he cant do it again... he have a modem installed? that O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgCA2405.exe is a dialer... lol checked his phone bill lately?

I have no idea what most of the crap om this machine does ... bloddy compaq retarded bullshitt menues.... anyone got an axe???

for the proggy's that like to protect their registry existence, and come back every time, you have two options: 1. if he is running ntfs instead of FAT partitions, you can go in and set the access rights of the executables you wish to be rid of by setting them to no-execute / no-read. Then delete them on next reboot. If he is running FAT, there are no such access rights and you must use option 2...

can anyone help me indentify these rascals???

If this were my computer I would head over to "Add/Remove programs" and get rid of all the HP "helpfull" utility's. While your there remove Logitechs spyware. Lose all those Toolbars while your at it,Yahoo,etc. O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN What is this? Get rid of Real player.Uninstall in safe mode. Go into IE tools and disable cookies,session ...