utilidadesf-htm

quad_red

Hey folks,
This file is in the program menu of the start menu on my computer (in work).

utilidadesf-htm

It also shows up in the add/remove programs menu. Attempting to uninstall it leads to the following error:

Error loading NrsgroupUD.dll
The specified module could not be found

Now, this computer has been getting noticeably slower and more unstable over the last few weeks. I've scanned it with AVG, CWshredder, Ad-aware, Spybot etc to no avail.

Could this be virus related?

Cheers,
Quad

8T8

That NrsgroupUD.dll & utilidadesf come up on a lot of spyware threads on various security sites so I'd wager it's something along those lines.

Hijack This is the common method for removal it will shows the entries that are loading it on startup and allow you to remove them. I'd also install Windows Defender and do a full system scan with it if you can.

If you are not sure of what to remove post the log as an attachment here and we can take a look.

quad_red

Uh oh

I installed Windows Defender and ran it. It detected a number of threats but when I click remove it does nothing. The status bar is moving and a 'Taking actions' message appears beside it, but it will continue like this indefinitely.

I have to restart the computer to get the program running again.

Now the computer is even more unsteady and the desktop is now all screwed up (resembling a folder with a folder bar with 'folder tasks' and 'other places' options menus etc.)

I've attached the hijack this log below.

Cheers 8T8

quad_red

Three hours later

Windows Defender is still a stalling piece of crap (it detects 2 threats but can't remove them).

Ad-aware is clear.
Spybot is clear.

Downloaded a program called Spyhunter that scans for free and it detected dozens of mainly 'Gator' infected files.
But to remove them you've got to buy it. No way work will pay for that.

Anyone know anything that's as good as Spyhunter and is free?

Cheers
Quad

8T8

Hmmm the Hijack This log looks okay I don't see anything that jumps out at me compared to some of the other Hijack This logs from the Google search yours seems clean.

Edit: This entry is suspicious O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file) Google search says it was part of the MyWebSearch malware package but your scans with anti spyware programs may have crippled it still I'd delete the entry anyway.

Obviously their is still something in the system, did you do a full system scan with Ad Aware not just the default smart scan.

Also set Spybot to do a boot scan basically it starts a scan of the system before the desktop loads to catch any spyware.

As to why Windows Defender isn't working there could be something interfering with it I've come across spyware that intentionally targets certain applications.

Seeing as utilidadesf isn't loading from the registry at startup you should be able to remove the utilidadesf-htm from the start menu by just right clicking it and deleting it, to remove it from the add/remove in the control panel you will need to use the Windows Installer Clean-up tool.

Also try and boot into safe mode and run spybot or ad-aware from there and see if they catch anything.

I'll say it anyway just in case but have you updated the anti-spyware programs so they are using the latest definitions ? Also have you done a full system scan with AVG scanning compressed files as well ?

[I wouldn't pay for any anti-spyware program often some of them are spyware themselves]

You may want to try CCleaner as well to purge anything hiding in the temp folders of the system.

Some good tips on mal/spyware removal can be found at the Castle Cops Wiki.