| Answer» Hi,My computer once again is acting like it has a big problem. I have noticed when I start windows, and run just about any programt anytime, the system is slower. Online browsing is delayed, and often has crashes.
 
 
 I.
 I have tried to resolve this problem by
 
 1) Running evilfantasy's guide of
 -CCleaner
 -SAS
 -ESET Online
 -Java
 -HiJack this
 
 2) I tried to as well run
 -Symnatec Anti-Virus
 -Ad-Aware
 -Spybot Search and Destroy
 -eWido
 
 
 II.
 However, there are some problems.
 1) Symnatec shows the same VIRUSES nightly.
 2) Ad aware no longer works, it keeps freezing.
 3) Spybot search and destroy shows no problems in contrast to AVG spware.
 4) eWido says errors.
 5) All of these were run BEFORE evilfantasy's guide
 
 
 III.
 I wanted to know why these problems are occuring.
 1) What is wrong with my computer.
 2) Why symnatec shows the same viruses, why Ad adware is not working, why eWido is not working, and Spybot not deteching.
 3) If I should drop, remove, or redo some programs and simply keep ONLY what evilfantasyguide says to use.
 4) I have posted all logs, they would not attach.
 5) I did delete windows defender, which was on my add/remove programs (is that a bad program?)
 -I also notice PURE NETWORKS PORT MAGIC.
 -Should I delete this?
 6) I also have combo fix and fsbl if anything needs help in those areas.
 
 
 
 Thanks!SAS Log
 SUPERAntiSpyware Scan Log
 http://www.superantispyware.com
 
 Generated 12/21/2007 at 04:29 PM
 
 Application Version : 3.9.1008
 
 Core Rules Database Version : 3365
 Trace Rules Database Version: 1364
 
 Scan type   : Complete Scan
 Total Scan Time : 01:12:04
 
 Memory items scanned   : 395
 Memory threats detected : 0
 Registry items scanned  : 5326
 Registry threats detected : 1
 File items scanned    : 38722
 File threats detected  : 28
 
 Adware.Tracking Cookie
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][2].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][1].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][2].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][1].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][1].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][2].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][1].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][2].txt
 C:\Documents and Settings\All Family\Cookies\all [emailprotected][2].txt
 C:\Documents and Settings\All Family\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\All Family\Cookies\[emailprotected][1].txt
 C:\Documents and Settings\Trent Berger\Cookies\[emailprotected][1].txt
 
 Adware.MyWay
 C:\Program Files\MyWay\SrchAstt\1.bin\PARTNER.DAT
 C:\Program Files\MyWay\SrchAstt\1.bin
 C:\Program Files\MyWay\SrchAstt\Cache\00048C7D
 C:\Program Files\MyWay\SrchAstt\Cache\0006A441
 C:\Program Files\MyWay\SrchAstt\Cache\0074A62E
 C:\Program Files\MyWay\SrchAstt\Cache\files.ini
 C:\Program Files\MyWay\SrchAstt\Cache
 C:\Program Files\MyWay\SrchAstt
 C:\Program Files\MyWay
 
 Trojan.WinAntiSpyware 2007
 HKU\S-1-5-21-484763869-630328440-725345543-1003\Software\WinAntiSpyware 2007
 
 
 
 ESET Log
 # version=4
 # OnlineScanner.ocx=1.0.0.56
 # OnlineScannerDLLA.dll=1, 0, 0, 51
 # OnlineScannerDLLW.dll=1, 0, 0, 51
 # OnlineScannerUninstaller.exe=1, 0, 0, 49
 # vers_standard_module=2741 (20071221)
 # vers_arch_module=1.059 (20071108)
 # vers_adv_heur_module=1.064 (20070717)
 # EOSSerial=6df5535ff4342e45bc0ad7ecdcc9370f
 # end=finished
 # remove_checked=true
 # unwanted_checked=true
 # utc_time=2007-12-21 10:51:40
 # local_time=2007-12-21 05:51:40 (-0500, Eastern Standard Time)
 # country="United States"
 # osver=5.1.2600 NT Service Pack 2
 # scanned=147690
 # found=3
 # scan_time=2449
 C:\AOL Instant Messenger\AIM.exeWin32/Adware.WBug.A application (deleted)00000000000000000000000000000000
 C:\AOL Instant Messenger\AIM.exe »WISE »WxBug.EXEWin32/Adware.WBug.A application (error while deleting - operation unavailable for this type of object - was a part of the deleted object)00000000000000000000000000000000
 C:\AOL Instant Messenger\AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dllWin32/Adware.WBug.A application (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)00000000000000000000000000000000
 Hi Jack This Log
 Logfile of HijackThis v1.99.1
 Scan saved at 5:58:59 PM, on 12/21/2007
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v7.00 (7.00.6000.16574)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
 C:\WINDOWS\System32\wltrysvc.exe
 C:\WINDOWS\System32\bcmwltry.exe
 C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
 C:\WINDOWS\system32\LEXBCES.EXE
 C:\WINDOWS\system32\LEXPPS.EXE
 C:\WINDOWS\Explorer.EXE
 C:\Program Files\Common Files\AOL\1154149194\ee\AOLSoftware.exe
 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
 C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
 C:\Program Files\Symantec AntiVirus\DefWatch.exe
 C:\WINDOWS\system32\nvsvc32.exe
 C:\WINDOWS\system32\svchost.exe
 C:\Program Files\Symantec AntiVirus\Rtvscan.exe
 C:\Program Files\Mozilla Firefox\firefox.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\system32\wuauclt.exe
 C:\WINDOWS\system32\msiexec.exe
 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
 C:\Documents and Settings\Trent Berger\Desktop\HijackThis.exe
 
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://dell.com/
 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
 O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
 O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1154149194\ee\AOLSoftware.exe
 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
 O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
 O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
 O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
 O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
 O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
 O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O11 - Options group: [INTERNATIONAL] International*
 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
 O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
 O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
 O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
 O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
 O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
 O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
 O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
 O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec CORPORATION - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
 O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
 O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
 O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
 O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
 O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
 O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
 O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
 O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
 O23 - Service: Dell Wireless WLAN TRAY Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
 
 Your HJT log is fairly clean...
 
 1. Print this post out, since you won't have an access to it, at some point.
 
 2. Close all windows, except for HijackThis.
 
 3. Put a checkmark next to the following HijackThis entries:
 
 - O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
 
 - O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
 
 - O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
 
 4. Click on "Fix checked" button.
 
 ------------------------------------------------------------------------------------
 
 Quote
 Symnatec shows the same viruses nightly.Can you write the names down, and post them back here? 
 We also need your computer specs...
 - processor speed
 - hard drive size/how much free space
 - how much RAM?1) I ran a scan of symnatec.
 It came up with TWO different viruses this time.
 
 They are:
 
 
 Jvmusafe.jar-6ba32b3f-74e517da.zip
 Status: Still contains one infected item
 Action taken: Quarantined
 
 
 
 Scan type: Manual Scan
 Event: Threat Found!
 Threat: Downloader
 File: C:\Documents and Settings\Trent Berger\.jpi_cache\jar\1.0\jvmusafe.jar-6ba32b3f-74e517da.zip>>vmain.class
 Location: Quarantine
 Computer: TRENT-31A63E0D1
 User: Trent Berger
 Action taken: Quarantine succeeded
 Date found: Friday, December 21, 2007 10:37:42 PM
 
 
 -Are these now taken care of or is there more I have to do?
 
 
 2) How do I find out the computer specs
 -Processor Speed
 -Hardrive/Free Space
 -Ram
 
 3) What should I do about
 -Ad Aware
 -Spybot
 -eWido
 -AVG
 
 -Should I delete and just use SAS, ESET?
 
 Thanks!
 1. Two messages from Symantec are about ONE file: Jvmusafe.jar-6ba32b3f-74e517da.zip
 It was taken care of (Quarantined), so you're done.
 
 2. Get BgInfo: http://technet.microsoft.com/en-us/sysinternals/bb897557.aspx
 
 3. You may have only ONE firewall, and ONE antivirus, and this is exactly what you have: Norton, in both cases.
 As for other antimalware programs (Spybot, Ad-aware, etc.), and on-line antivirus scanners, you may have as many, as you want.I downloaded it.
 Am I fine then?
 Your computer is clean. How is it now? Faster? Crashes?
 |