|
Answer» I got the "win 7 Internet security" virus on my vaio laptop and after doing some research online I used malwarebytes anti-virus to remove it and I think it's gone because I don't get the annoying pop ups anymore anyways after removing the virus, I can't open anything anymore because it wil either have an error or the "open with" box wil appear. the only way I can open something is if I run it as administrator. Please help me with how to fix thisFirst things first - let's make sure that you are virus free. Go HERE, follow the directions EXACTLY and post the requested LOGS in a new thread of that FORUM.i did all the six steps and this is what i came up with. the log for superantispyware is
SUPERAntiSpyware Scan Log http://www.superantispyware.com
Generated 11/23/2010 at 08:22 PM
Application Version : 4.46.1000
Core Rules Database Version : 5907 Trace Rules Database Version: 3719
Scan type : Complete Scan Total Scan Time : 01:53:06
Memory items scanned : 761 Memory threats detected : 0 Registry items scanned : 13566 Registry threats detected : 19 FILE items scanned : 199074 File threats detected : 34
Adware.Gamevance (x86) HKLM\Software\Classes\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32 (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\InprocServer32#ThreadingModel (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\ProgID (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\Programmable (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\TypeLib (x86) HKCR\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883}\VersionIndependentProgID (x86) HKCR\GamevanceText.Linker.1 (x86) HKCR\GamevanceText.Linker.1\CLSID (x86) HKCR\GamevanceText.Linker (x86) HKCR\GamevanceText.Linker\CLSID (x86) HKCR\GamevanceText.Linker\CurVer (x86) HKCR\TypeLib\{014C4232-6904-47B9-9144-7E0FB7277444} C:\PROGRAM FILES (X86)\GAMEVANCE\GVTL.DLL (x86) HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HELPER Objects\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (x86) HKU\S-1-5-21-2175598002-276824424-936044750-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (x86) HKCR\AppId\GamevanceText.DLL (x86) HKCR\AppId\GamevanceText.DLL#AppID
Adware.Tracking Cookie .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .atdmt.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .doubleclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] ad.yieldmanager.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .atdmt.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .imrworldwide.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .imrworldwide.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .247realmedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .oasn04.247realmedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] www.googleadservices.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .serving-sys.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .serving-sys.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] ad.yieldmanager.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .steelhousemedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .steelhousemedia.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .advertising.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] www.stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] www.googleadservices.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .stopzilla.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .tribalfusion.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .specificclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .specificclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .interclick.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .interclick.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .interclick.com [ C:\Users\Owner\AppData\Local\Google\Chrome\Application\7.0.517.44\Default\Cookies ] .doubleclick.net [ C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
And the one for Malwarebytes is
Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org
Database version: 5178
Windows 6.1.7600 Internet Explorer 8.0.7600.16385
11/23/2010 8:55:21 PM mbam-log-2010-11-23 (20-55-21).txt
Scan type: Quick scan Objects scanned: 142464 Time elapsed: 5 minute(s), 56 second(s)
Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 2 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 1
Memory Processes Infected: (No malicious items detected)
Memory Modules Infected: (No malicious items detected)
Registry Keys Infected: (No malicious items detected)
Registry Values Infected: HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\sezfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.
Registry Data Items Infected: HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (sezfile) Good: (exefile) -> Quarantined and deleted successfully.
Folders Infected: (No malicious items detected)
Files Infected: C:\Users\Owner\Local Settings\Application Data\opRSK (Malware.Trace) -> Quarantined and deleted successfully.
The log for hijackthis is
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 9:27:30 PM, on 11/23/2010 Platform: Windows 7 (WinNT 6.00.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16671) Boot mode: Normal
Running processes: C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Trend Micro\sniper.exe\sniper.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: 74.208.10.249 gs.apple.com O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
Quote from: Quantos on November 23, 2010, 11:03:55 AM and post the requested logs in a new thread of that forum.
Nobody ever listens to me.oh yea after i did all this stuff my computer seems to be working normally again! please let me know what else i need to do and if i need to delete all the stuff that i installed. A greatly appreciate your help thanks
|