4832 + Interview Questions in Computer viruses and spyware in Software Page 50 InterviewSolution

2451.	Solve : avg 8.0 help?
Answer» when i run avg it comes back nothing found , but with 135 warnings , i have tried to get into avg to find out what they are but i can't get in to it135 warnings. Most likely that's just TRACKING cookies are ad related stuff that are just low threat to your SYSTEM. I would .... Clean your system with your ccleaner (remove cookies option enabled) and retry AVG scan BUT removing cookies may remove saved website settings so have ccleaner save all cookies you want to keep. ok , but you cannot get into avg8.0 the way you could with 7.5 and it is very slowYou can configure AVG 8.0 from Tools -> Advanced. thank you is there no way to make it faster or should i ask that on the avg forumSlow? What are your computer specs? (RAM, Processor Speed, Free Hard Drive Space, Hard Drive Capacity, Operating System)Quote from: harry 48 on December 20, 2008, 11:18:08 AM thank you is there no way to make it faster or should i ask that on the avg forum You can set scanning to 'slow', 'automatic' (Recommended) and 'fast' If you set it to fast, you won't be able to do much else on your computer. processor speed , x86 family 15 MODEL 3 stepping 3 genuine , 2412 mhz windows XP home total physical memory 1,280.00 mb avaiable "" "" 852.32 mb total virtual memory 2.oo gb avaiable "" "" 1.96 gb page file space 1.41 gb i have a feeling this is wrong above there is a file below as well Quote from: Carbon Dudeoxide on December 20, 2008, 07:58:40 PM Slow? What are your computer specs? (RAM, Processor Speed, Free Hard Drive Space, Hard Drive Capacity, Operating System) Well, a virus scanner demands a lot of hard drive access so your system will slow down. Only the slow-, automatic- and fast slider will allow you to either slow things or down or speed htem up. have a look at this file it might give you more imforationQuote from: Carbon Dudeoxide on December 20, 2008, 07:58:40 PM Slow? What are your computer specs? (RAM, Processor Speed, Free Hard Drive Space, Hard Drive Capacity, Operating System) [attachment deleted by admin]Sorry, I'm not exactly sure what you're asking of us anymore.. carbon asked for my pc specs this is all i can find i am going to leave avg speed as it is as your said the faster it GOES it will slow the work on the pc downYeah, I'd just leave it at 'automatic'. I think it keeps track of what you're doing and tries to adjust to that. ok thank you

2451.

Solve : avg 8.0 help?

Answer»

when i run avg it comes back nothing found , but with 135 warnings , i have tried to get into avg to find out what they are but i can't get in to it135 warnings. Most likely that's just TRACKING cookies are ad related stuff that are just low threat to your SYSTEM.

I would .... Clean your system with your ccleaner (remove cookies option enabled) and retry AVG scan BUT removing cookies may remove saved website settings so have ccleaner save all cookies you want to keep.

ok , but you cannot get into avg8.0 the way you could with 7.5 and it is very slowYou can configure AVG 8.0 from Tools -> Advanced.

thank you is there no way to make it faster or should i ask that on the avg forumSlow?

What are your computer specs?
(RAM, Processor Speed, Free Hard Drive Space, Hard Drive Capacity, Operating System)Quote from: harry 48 on December 20, 2008, 11:18:08 AM

thank you is there no way to make it faster or should i ask that on the avg forum

You can set scanning to 'slow', 'automatic' (Recommended) and 'fast'

If you set it to fast, you won't be able to do much else on your computer. processor speed , x86 family 15 MODEL 3 stepping 3 genuine , 2412 mhz
windows XP home
total physical memory 1,280.00 mb
avaiable "" "" 852.32 mb
total virtual memory 2.oo gb
avaiable "" "" 1.96 gb
page file space 1.41 gb

i have a feeling this is wrong above

there is a file below as well Quote from: Carbon Dudeoxide on December 20, 2008, 07:58:40 PM

Slow?

What are your computer specs?
(RAM, Processor Speed, Free Hard Drive Space, Hard Drive Capacity, Operating System)

Well, a virus scanner demands a lot of hard drive access so your system will slow down. Only the slow-, automatic- and fast slider will allow you to either slow things or down or speed htem up. have a look at this file it might give you more imforationQuote from: Carbon Dudeoxide on December 20, 2008, 07:58:40 PM

Slow?

What are your computer specs?
(RAM, Processor Speed, Free Hard Drive Space, Hard Drive Capacity, Operating System)

[attachment deleted by admin]Sorry, I'm not exactly sure what you're asking of us anymore.. carbon asked for my pc specs this is all i can find

i am going to leave avg speed as it is as your said the faster it GOES it will slow the work on the pc downYeah, I'd just leave it at 'automatic'. I think it keeps track of what you're doing and tries to adjust to that.

ok thank you

2452.	Solve : start up to windows message occurred...?
Answer» EVERYTIME i open my computer when starts window a message was display... Message: Windows Script Host Can not find script file "C:\WINDOWS\auto.vbs". said of my friend it is a VIRUS, a new virus, that only AVG can detect that kind of virus... OS: Windows XP Professional PROCESSOR: INTEL R pentium R dual CPU E2140 @ 1.60 GHz MEMORY: 1024 RAM

2457.	Solve : My computer is sick and needs CPR! Windows XP?
Answer» Windows XP home SP2 (had SP3 but installed because of problems) on a home wireless network Well, Its infected with spyware etc, spybot S&D and adaware couldnt remove it, I tried restarting in safe mode and manually deleting some of the files to no avail. Only get popups when I am surfing the web. The thing that got me is that I think it is preventing me from PERFORMING windows update, updating windows defender, and preventing me from TURNING the windows firewall on. It says its controlled by group policy and I havent set up a group policy. Tried to find solutions and went run/services.msc and there wasnt anything there about the group policy. Tried turning updates, firewall and security center on from services and WOULD automatically stop them after I started them. After running the steps, I havent had a pop up.... yet, but am still not able to run windowns firewall [attachment deleted by admin]Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop. http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://subs.geekstogo.com/ComboFix.exe Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix. Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this LINK to see a list of security programs that should be disabled and how to disable them. Double-click combofix.exe and follow the prompts. When finished, ComboFix will produce a log for you. Post the ComboFix log and a new HijackThis log in your next reply. NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall. Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.here are the new logs, btw thanks for ur help! [attachment deleted by admin]Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system Delete these files/folders, as follows: 1. Go to Start > Run > type Notepad.exe and click OK to open Notepad. It must be Notepad, not Wordpad. 2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C Code: [Select]KillAll:: File:: c:\windows\system32\g35.exe c:\windows\system32\nigoyeje.exe c:\windows\system32\kxrpviwu.ini c:\windows\system32\sfhayogk.ini 3. Go to the Notepad window and click Edit > Paste 4. Then click File > Save 5. NAME the file CFScript.txt - Save the file to your Desktop 6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully! ComboFix will begin to execute, just follow the prompts. After reboot (in case it asks to reboot), it will produce a log for you. Post that log (Combofix.txt) in your next reply. Note: Do not click ComboFix's window while it is running. That may cause your system to freezethe newest logs [attachment deleted by admin]Well, I don't see a firewall, which needs to be corrected. Unless you have a suite package of Avast (not just anti-virus), then you need to get a good firewall on your computer. I suggest Comodo, ZoneAlarm, or Kerio Sunbelt. Download one, disconnect from the internet, disable Windows Firewall, install your new one, and restart. Other than that, things appear to be okay. How is everything running now? Are you still experiencing problems?Things are running much much smoother now.... thanks for you help man, and Ill get that firewall downloadedGreat, and while you're at it, go ahead and uninstall ComboFix. To this, simply go to Start > Run and type in combofix /u (note the space) and click OK. You should also clear out your System Restore points by turning it off and then turning it back on... http://support.microsoft.com/kb/310405

2458.	Solve : Got something, logs included...?
Answer» I have something because I keep GETTING those stupid Antivirus popups. I have included the logs in the attachments. Thanks!!!! [attachment deleted by admin]Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop. http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://subs.geekstogo.com/ComboFix.exe Close any open WEB browsers (Firefox, Internet EXPLORER, etc) before starting ComboFix. Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a SCAN. Click this link to see a list of security programs that should be disabled and how to disable them. Double-click combofix.exe and follow the prompts. When finished, ComboFix will produce a log for you. Post the ComboFix log and a new HijackThis log in your next reply. NOTE: Do not mouseclick ComboFix's WINDOW while it is running. That may cause it to stall. Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

2459.	Solve : Spyware guard 2008 keep coming up.?
Answer» My computer got virus. (That's keep coming up with spyware guard 2008.) I am using windows XP. I followed to the "Topic: Read this before requesting malware removal help". I went to add or remove program and I am not sure about these programs that I should remove or not :- - Ad-Aware - Apple Mobile Device Support - Apple software update - Bluetooth Stack for Windows by Toshiba - Bonjour - Capicom - Security Update for CAPICOM (KB931906) - CD/DVD Drive Acoustic Silencer - DVD-RAM Drive - High Definition Audio Driver Package - KB888111 - Hotfix for Windows Media Format 11 SDK (KB929399) - J2SE Runtime Environment 5.0 Update 4 - Intel(R) Proset/Wireless Software - Intel (R) PRO Network Connections Drivers - MICROSOFT .NET Framework 1.1 - Microsoft COMPRESSION Client Pack 1.0 for Windows XP - Microsoft Learning _ SOFT ware Updates - Security Update for Step by Step Interactive Training (KB898458) - Security Update for Step by Step Interactive Training (KB923723) - Microsoft Office 2003 WEB Components - Office 2003 Service Pack 3 (SP3) : OWC11SP3 - Microsoft Office OneNote 2003 - OneNote 2003 Service Pack 3 (SP3): ONENOTESP3 - Security Update for Office 2003 (KB921598): GPFILT - Security Update for Office 2003 (KB953404): MSO - Security Update for Office 2003 (KB954478): GDIPLUS - Security Update for office 2003 (KB951535): MSXML5 - Microsoft Office Professional Edition 2003 and hole bunch of update and security update for office. (Please tell me later if you think you have to know.) - Microsoft SQL Server 2005 Compact Edition [ENU] - Microsoft User-Mode Driver Framework Feature Pack 1.0 - Microsoft Visual C++ 2005 Redistributable - NVIDIA Drivers - Realtek High Definition Audio Driver - SD Secure Module - Security Update for Windows Media Player 11 (KB936782) - Signature995 - Synaptics Pointing Device Driver - Texas Instruments PCIxx21/x515/xx12 drivers. - WinSCP 4.1 beta - Windows Media Format 11 runtime. - Windows XP - Software Updates - hole bunch of security update and hotfix for windows Media player 11 (KB939683) I attached all of the logs that need with this since my message exceeds the maximum allowed length (20000 characters). Until now spyware guard 2008 stopped coming up. I don't know it's all done or still have some virus hiding. Please give me advise what should I do after this. Thank you very much. [attachment deleted by admin]

2460.	Solve : Having ctxfihlp mfc error probs might be from malware?
Answer» I have been having a ctxfihlp mfc error popping up. Since the ctxfihlp error I have had no sound; when checking the sounds tab in the control panel, no audio device or mixer is detected even after all the drivers have been reinstalled. I have ran antivirus with antispyware and Malwarebytes and haven't found anything. I have enclosed my hijackthis log hoping it might help. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:31:25 PM, on 1/8/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\Shared Files\CTAudSvc.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Documents and Settings\Joan\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\LxrSII1s.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Engine\16.2.0.7\ccSvcHst.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Norton Internet Security\Engine\16.2.0.7\ccSvcHst.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Joan\Desktop\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link HELPER - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.2.0.7\coIEPlg.dll O2 - BHO: Symantec INTRUSION Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.2.0.7\IPSBHO.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.2.0.7\coIEPlg.dll O4 - HKLM\..\RUN: [ehTray] "C:\WINDOWS\ehome\ehtray.exe" O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe" O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [DLA] "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" O4 - HKLM\..\Run: [NeroFilterCheck] "C:\WINDOWS\system32\NeroCheck.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" O4 - HKLM\..\Run: [BlackBerryAutoUpdate] "C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" /background O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Volume Panel\VolPanlu.exe" /r O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Joan\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy' (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy' (User 'Default user') O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi CLASS) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1162602577793 O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15106/CTPID.cab O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.2.0.7\coIEPlg.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.2.0.7\ccSvcHst.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- End of file - 10652 bytes

2461.	Solve : I would REALLY love someones help :)! (A Trojan problem)?
Answer» Reset Settings in Internet Explorer 7 Follow these steps to use the Reset Internet Explorer Settings feature from Internet Explorer 7: 1. In Internet Explorer 7, click the Tools menu, and then click Internet Options. 2. On the Advanced tab, click Reset. 3. In the Reset Internet Explorer Settings dialog box, click Reset. 4. When Internet Explorer 7 finishes restoring the default settings, click Close, and then click OK two times. 5. Close Internet Explorer 7. The changes take effect the next time that you open Internet Explorer 7. How is it now?yep that worked! cheers! Everything else seems fine! Thanks for your help. If i have anymore problems i will come back to you! thanks for all your hard work!Glad it worked. A few more tips to look at. Use the Secunia Software Inspector to check for out of date software. Click Start Now Check the box next to Enable thorough system inspection. Click Start Allow the scan to finish and scroll down to see if any updates are needed. Update anything listed. . ---------- Go to Microsoft Windows Update and get all critical updates. ---------- Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC. Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with ADBLOCK Plus and NoScript To prevent unknown applications from being installed on your computer install WinPatrol 2008 * Using Winpatrol to protect your computer from MALICIOUS software I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free. SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox. * Using SpywareBlaster to protect your computer from Spyware and MALWARE * If you don't know what ActiveX controls are, see here Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future. Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

2462.	Solve : Unable to view videos longer than ~1 minute on internet?
Answer» Using the following browsers I am unable to view videos (news or YouTube, etc.) longer than 1 minute. The buffering starts and the video plays until the play mode catches up to the buffer and the program stops. Internet Explorer 7.1.6001.1800 AOL 9.1 Rev 4334.5000 Firefox version 3.0.5 Below is my HighJackThis log. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:22:01 PM, on 12/23/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\aol\1225590462\ee\aolsoftware.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\AOL 9.1\waol.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\System32\mobsync.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exe C:\Program Files\AOL 9.1\shellmon.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe O4 - HKLM\..\Run: [Bluetooth HCI Monitor] RunDll32 HCIMNTR.DLL,RunCheckHCIMode O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1225590462\ee\AOLSoftware.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (USER 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Bluetooth.lnk = ? O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O16 - DPF: {050A3800-6C03-48A5-A6D7-14CCF18A700D} - https://cottageconnect.sbch.org/v4ica.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: AOL CONNECTIVITY Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe O23 - Service: SessionLauncher - Unknown owner - C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe (file missing) O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro PROXY Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- End of file - 9999 bytes Sorry for the long wait. We are VERY backed-up right now! This doesn't appear to be a virus issue. Have you tried updating your Flash and Java?Yes I did and it didn't seem to help. What I did do was to RESET the Belkin Wireless G Router and for a WEEK now the internet has been great. Thanks for reviewing and responding. Great, I'm glad to hear it.

2465.	Solve : BOOT UP from other forum?
Answer» Ok I posted this topic under software a couple of days ago and was reruted to this forum by broni. Broni had me do somwthings and post a Hijack this log and then found out my laptop was infected. Now I went throught the steps to REMOVE malware and have just finished with the superantispyware and here is the log, also my pc info is below. Thanks for the help in advance. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 01/01/2009 at 02:58 PM Application Version : 4.24.1004 Core Rules Database Version : 3693 Trace Rules Database Version: 1669 Scan type : Custom Scan Total Scan Time : 01:00:32 Memory items scanned : 431 Memory threats detected : 0 Registry items scanned : 6734 Registry threats detected : 34 File items scanned : 54102 File threats detected : 2 Unclassified.Unknown Origin HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\InprocServer32 HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\InprocServer32#InprocServer32 HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\InprocServer32#ThreadingModel HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\ProgID HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\Programmable HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\TypeLib HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\VersionIndependentProgID HKCR\SearchSettings.BHO.1 HKCR\SearchSettings.BHO.1\CLSID HKCR\SearchSettings.BHO HKCR\SearchSettings.BHO\CLSID HKCR\SearchSettings.BHO\CurVer HKCR\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC} HKCR\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}\1.0 HKCR\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}\1.0\0 HKCR\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}\1.0\0\win32 HKCR\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}\1.0\FLAGS HKCR\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}\1.0\HELPDIR C:\PROGRAM FILES\SEARCH SETTINGS\KB127\SEARCHSETTINGS.DLL HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKU\S-1-5-21-1454471165-1647877149-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKU\S-1-5-21-1454471165-1647877149-839522115-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKU\S-1-5-21-1454471165-1647877149-839522115-1003\Software\Microsoft\Internet Explorer\URLSearchHooks#{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKU\S-1-5-21-1454471165-1647877149-839522115-1006\Software\Microsoft\Internet Explorer\URLSearchHooks#{E312764E-7706-43F1-8DAB-FCDD2B1E416D} HKCR\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288} HKCR\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}\ProxyStubClsid HKCR\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}\ProxyStubClsid32 HKCR\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}\TypeLib HKCR\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}\TypeLib#Version Trojan.Media-Codec/V4 C:\Program Files\Video Add-on HKU\S-1-5-21-1454471165-1647877149-839522115-1003\Software\Online Add-on HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center#DisplayName Field Value Computer Operating System Microsoft Windows XP Professional OS Service Pack Service Pack 3 DirectX 4.09.00.0904 (DirectX 9.0c) Motherboard CPU Type Mobile AMD Turion 64 ML-34, 1800 MHz (9 x 200) Motherboard Name Hewlett-Packard Presario V2000 (EP379UA#ABA) Motherboard Chipset ATI Radeon Xpress 200M, AMD Hammer System Memory 896 MB (PC2700 DDR SDRAM) BIOS Type Phoenix (08/30/06) Display Video Adapter ATI RADEON XPRESS 200M (128 MB) Video Adapter ATI RADEON XPRESS 200M (128 MB) 3D Accelerator ATI Radeon Xpress 200M (RS480M) Monitor Plug and Play Monitor Monitor Generic Television Multimedia Audio Adapter ATI SB400 - AC'97 Audio Controller Storage IDE Controller Standard Dual Channel PCI IDE Controller IDE Controller Texas Instruments PCIxx21 Integrated FlashMedia Controller Disk Drive ST9100822A (100 GB, 5400 RPM, Ultra-ATA/100) Optical Drive TSSTcorp CD/DVDW TS-L532M (DVD+R9:2.4x, DVD+RW:8x/4x, DVD-RW:8x/4x, DVD-ROM:8x, CD:24x/10x/24x DVD+RW/DVD-RW) SMART Hard Disks Status OK Partitions C: (NTFS) 95385 MB (48291 MB free) Input Keyboard Quick Launch Buttons Mouse Synaptics PS/2 Port TouchPad Network Network Adapter Realtek RTL8139/810x Family Fast Ethernet NIC (10.5.12.93) Modem AC97 Data Fax SoftModem with SmartCP Peripherals USB1 Controller ATI SB400 - USB Controller USB1 Controller ATI SB400 - USB Controller USB2 Controller ATI SB400 - USB 2.0 Controller Battery Microsoft AC Adapter Battery Microsoft ACPI-Compliant Control Method Battery Ok, I have finished ALL of the insructoins listed and have attached the files to the post instead of having a 300 PAGE to look at. Again thanks for the help and I look foward from reading everyones posts. [attachment deleted by admin]Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop. http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://subs.geekstogo.com/ComboFix.exe Close any open web browsers (FIREFOX, Internet Explorer, etc) before starting ComboFix. Temporarily DISABLE your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them. Double-click combofix.exe and follow the prompts. When finished, ComboFix will produce a log for you. Post the ComboFix log and a new HijackThis log in your next reply. NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall. Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.Ok, I have done the combofix and hijackthis again and they are attached. Thanks for the further assistance. I look foward to the next step in this process. [attachment deleted by admin]I don't see anymore infections. How are things running now?

2467.	Solve : win32:patched-ck just can't get rid of it!!?
Answer» I know this thread is old, but I know what happened here because it just happened to me. Explorer.exe got deleted and it's hung because it doesnt have a shell to load. If you GO into safe mode and do the crtl-shift-esc (I think thats it...it MAY be crtl-alt-esc) to pull up the taskmgr.exe the FILE explorer.exe is gone. I OPENED taskmgr and expanded explorer.exe from the xpsp2 directory (explorer.ex_). After that I loaded the file I just expanded (explorer.exe) and the system is fine now.

2472.	Solve : Anti - Spyware/Trojan/Worm/Virus...?
Answer» Before asking people to SPEND time answering my personal Trojan/Worm issues, I was wondering if you could point me towards the best Anti- Spyware/Trojan/Worm/Virus... programme. I've installed Kaspersky recently but it seems unable to get rid off some of them (trojan csrssc.exe, HEUR.worm, trojan clicker, backdoor.win32.tdss.atb etc etc...) so was wondering if there was ANYTHING better available (prior to Kaspersky, tried Norton but was unable to COMPLETE installation....) Your suggestions would be much appreciated As you might have guessed I'm not too good with non-basic computer skills so would prefer one software to clean the whole thing up rather than the ten steps/ten hours VERSION (acknowledging that I might have to COME to it though !) Thanks a lot for your suggestionsAVG: http://free.avg.com/ Avira: http://www.free-av.com/ SuperAntiSpyware: http://www.superantispyware.com/ Remember to have only one antivirus program running at any one time.

2478.	Solve : Task Manager, Registry Editor, msconfig and DVD Combo not working!?
Answer» My Computer is seriously infected. I am unable to OPEN Task Manager, Registry Editor, msconfig. My DVD Combo is also unable to read from CD/DVD. Ante-Virus = AVG Free Edition Hijack this and Malwarebytes' Anti-Malware's Logs are attached! I've also performed SUPERAntiSpyware Free Edition (Complete SCAN). [ATTACHMENT deleted by admin]I SCANNED my PC today with AVG-Free Edition, Malwarebytes' Anti-Malware and SUPERAntiSpyware Free Edition. Task Manager, Registry Editor and Microsoft System Configuration Utility (msconfig) is now working.... But DVD Combo is still not working...... Any help.....No replies...

2481.	Solve : re occuringpop ups hijack this?
Answer» Hi hope you can help i downloaded hijack this did a system scan and saved LOG file as follows. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:43:22, on 19/01/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\LEXMARK X1100 Series\lxbkbmgr.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\PieAutoUpdater\PieAutoUpdater.exe C:\Program Files\JAVA\jre6\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\PieAutoUpdater\pglite.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE C:\Program Files\Yahoo!\SEARCH Protection\SearchProtection.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\documents and settings\kevin\local settings\application data\fcdarpp.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: 209.216.253.186 www.winmx.com err.winmx.com O1 - Hosts: 65.75.216.6 cache0.winmx.com test3201.winmx.com test3206.winmx.com O1 - Hosts: 65.75.216.7 cache1.winmx.com test3202.winmx.com test3207.winmx.com O1 - Hosts: 82.43.229.238 cache2.winmx.com test3203.winmx.com test3208.winmx.com O1 - Hosts: 205.238.40.1 cache3.winmx.com test3204.winmx.com O1 - Hosts: 205.238.40.2 cache4.winmx.com test3205.winmx.com O1 - Hosts: 65.75.216.6 c3310.z1301.winmx.com c3310.z1302.winmx.com c3310.z1303.winmx.com c3310.z1304.winmx.com c3310.z1305.winmx.com c3310.z1306.winmx.com O1 - Hosts: 65.75.216.6 c3311.z1301.winmx.com c3311.z1302.winmx.com c3311.z1303.winmx.com c3311.z1304.winmx.com c3311.z1305.winmx.com c3311.z1306.winmx.com O1 - Hosts: 65.75.216.6 c3312.z1301.winmx.com c3312.z1302.winmx.com c3312.z1303.winmx.com c3312.z1304.winmx.com c3312.z1305.winmx.com c3312.z1306.winmx.com O1 - Hosts: 65.75.216.7 c3313.z1301.winmx.com c3313.z1302.winmx.com c3313.z1303.winmx.com c3313.z1304.winmx.com c3313.z1305.winmx.com c3313.z1306.winmx.com O1 - Hosts: 65.75.216.7 c3314.z1301.winmx.com c3314.z1302.winmx.com c3314.z1303.winmx.com c3314.z1304.winmx.com c3314.z1305.winmx.com c3314.z1306.winmx.com O1 - Hosts: 65.75.216.7 c3315.z1301.winmx.com c3315.z1302.winmx.com c3315.z1303.winmx.com c3315.z1304.winmx.com c3315.z1305.winmx.com c3315.z1306.winmx.com O1 - Hosts: 82.43.229.238 c3316.z1301.winmx.com c3316.z1302.winmx.com c3316.z1303.winmx.com c3316.z1304.winmx.com c3316.z1305.winmx.com c3316.z1306.winmx.com O1 - Hosts: 82.43.229.238 c3317.z1301.winmx.com c3317.z1302.winmx.com c3317.z1303.winmx.com c3317.z1304.winmx.com c3317.z1305.winmx.com c3317.z1306.winmx.com O1 - Hosts: 205.238.40.1 c3318.z1301.winmx.com c3318.z1302.winmx.com c3318.z1303.winmx.com c3318.z1304.winmx.com c3318.z1305.winmx.com c3318.z1306.winmx.com O1 - Hosts: 205.238.40.2 c3319.z1301.winmx.com c3319.z1302.winmx.com c3319.z1303.winmx.com c3319.z1304.winmx.com c3319.z1305.winmx.com c3319.z1306.winmx.com O1 - Hosts: 65.75.216.6 c3520.z1301.winmx.com c3520.z1302.winmx.com c3520.z1303.winmx.com c3520.z1304.winmx.com c3520.z1305.winmx.com c3520.z1306.winmx.com O1 - Hosts: 65.75.216.6 c3521.z1301.winmx.com c3521.z1302.winmx.com c3521.z1303.winmx.com c3521.z1304.winmx.com c3521.z1305.winmx.com c3521.z1306.winmx.com O1 - Hosts: 65.75.216.6 c3522.z1301.winmx.com c3522.z1302.winmx.com c3522.z1303.winmx.com c3522.z1304.winmx.com c3522.z1305.winmx.com c3522.z1306.winmx.com O1 - Hosts: 65.75.216.7 c3523.z1301.winmx.com c3523.z1302.winmx.com c3523.z1303.winmx.com c3523.z1304.winmx.com c3523.z1305.winmx.com c3523.z1306.winmx.com O1 - Hosts: 65.75.216.7 c3524.z1301.winmx.com c3524.z1302.winmx.com c3524.z1303.winmx.com c3524.z1304.winmx.com c3524.z1305.winmx.com c3524.z1306.winmx.com O1 - Hosts: 65.75.216.7 c3525.z1301.winmx.com c3525.z1302.winmx.com c3525.z1303.winmx.com c3525.z1304.winmx.com c3525.z1305.winmx.com c3525.z1306.winmx.com O1 - Hosts: 82.43.229.238 c3526.z1301.winmx.com c3526.z1302.winmx.com c3526.z1303.winmx.com c3526.z1304.winmx.com c3526.z1305.winmx.com c3526.z1306.winmx.com O1 - Hosts: 82.43.229.238 c3527.z1301.winmx.com c3527.z1302.winmx.com c3527.z1303.winmx.com c3527.z1304.winmx.com c3527.z1305.winmx.com c3527.z1306.winmx.com O1 - Hosts: 205.238.40.1 c3528.z1301.winmx.com c3528.z1302.winmx.com c3528.z1303.winmx.com c3528.z1304.winmx.com c3528.z1305.winmx.com c3528.z1306.winmx.com O1 - Hosts: 205.238.40.2 c3529.z1301.winmx.com c3529.z1302.winmx.com c3529.z1303.winmx.com c3529.z1304.winmx.com c3529.z1305.winmx.com c3529.z1306.winmx.com O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Pie Auto Updater] "C:\Program Files\PieAutoUpdater\PieAutoUpdater.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [AOL_Demo] C:\Applications\Tool\AOL Demo\DSGDemo.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [fcdarpp] "c:\documents and settings\kevin\local settings\application data\fcdarpp.exe" fcdarpp O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O14 - IERESET.INF: START_PAGE_URL=http://www.pcservicecall.co.uk O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O24 - Desktop Component 0: (no name) - http://ly.lygo.com/ly/lmail/img/the_paper_clip.png -- End of file - 10965 bytes I previously deleted r3,02 help ,o2 ie help,04 aol demo,09 extra buttx4,09extra tools,016 all,024 desktop comp(n0 name) and the pop ups still showed up so i restored from back up to original as shown above ,what do you think i should delete that may be causing the pop ups .help;

2487.	Solve : Internet Properties Cookies Reset?
Answer» NEVERMIND, I MANAGED to FIX the PROBLEM myself.

2489.	Solve : Check out Open DNS VIdeo. Avoid DBS attack!?
Answer» Instead of a virus inside YOUR computer it may be a DNS atttack! Here is a nice video. It is EASY to do. Protect yourself from hostile sites. Over 10,00 sites out there that want to feed you false pages. Anti-virus alone is not enough. Make sure the DNS is not contaminated. Reportedly everybody knows about this and they are going to fix it. Real Soon. So they say. When they get around to it. Look at the video: http://www.opendns.com/support/videos/getstarted/ dont dns attacks just slow down your internet?No. It is not a DOS attack. It is an DNS attack. It is very FAST and you have no idea of what append. It occurs in a fraction of a second, If a hostile site gets the DNS cache from the server, it can send you to a bogus page. Like Google, eBay, or any site that you would know it will put up a clever site that looks just like the real thing. And the address bar has the right address. About a year ago they were warned about this and nobody would believe it. There is a very tiny hole in the server software that is open to a DNS attack for a fraction of a second. Because it is near impossible to do the attack manually, most IT people could just not believe it. But the DNS attack only needs to HIT the target a few times out of a thousand attempts to rack in money, advertising, credit cards, bank accounts and whatever else. Of course, the chance of an one person being hurt by it is very slim. Like maybe we don't really need to wear a seat belt while in an AIRPLANE. Right?

2473.	Solve : YIKES & now what?
Answer» I have followed the instructions in the FORUM except for Step #2 as the following error came up: Ccleaner.exe-corrupt file/$mft. Broni was helping me (very patient) with some other folks and told me to uninstall and try again. I did and the same thing happened. I went to Step#3 and followed the rest. Now when I restart my comuter I get: Blue Box: ASSERT Assert Failed/Porjects/wKernel/src/Win32/cm/core/cmCodeModule.cpp:90_mCodeHandle !=NULL then I get another Blue Box: ddcmigrateexe.application error The Application failed to initalize properly(0x8000003).Clik OK to term application. When I hit OK I had to hit it again and then the screen went back to the first blue box. When I got that cleared, it went back to the second error and I had to hit it twice to go away. had to be done twice. Here is System Info: Hewlett-Packard Pavillon AMD Athlon(tm)XP 300+ 2.10 GH2 448 MB of Ram File System NTFS Capacity 144 GB Free Space 102 GB % Free 70% I had to use Attach files for logs. [attachment DELETED by admin]Sorry I forgot to ad the Hijack log. [attachment deleted by admin]Download ComboFix by sUBs from one of the below links. Be sure to SAVE it to the Desktop. http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://subs.geekstogo.com/ComboFix.exe Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix. Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a SCAN. Click this link to see a list of security programs that should be disabled and how to disable them. Double-click combofix.exe and follow the prompts. When finished, ComboFix will produce a log for you. Post the ComboFix log and a new HijackThis log in your next reply. NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall. Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

2474.	Solve : Possible virus with Task bar?
Answer» Hi I'm using a Toshiba Satellite Pro laptop with Windows XP Professional. My antivirus software is the latest free version of Avast. My problem at the minute is quite strange. I was using Bittorrent and any time i TRIED to open it, it appeared on the taskbar but i couldn't open it. The same problem happens with FIREFOX when i close it. I can open firefox and then when closing it down a tab for clear browser history appears on the taskbar but i can't open it. I click on it but it wont enlarge. There are a few other programs which also have this problem such as msn messenger. I can open the program but cant open any messages, they appear on the task bar but there is nothing i can do to open them. I'm not SURE if this is related to a virus or could it be related to a RAM problem? I've attached the required log files for your attention and I really appreciate any help you can offer. You guys do amazing work! THANKS so much. 02/01/09 Hi again, anyone got any ideas? How about the log files, are they at least clean? Could it be a problem with some settings? I've also tried to use TVU and spocast (TV software) and they will open but i always get the error message "An error has occurred in the script of this page" - "Do you want to continue running SCRIPTS on this page - yes or no" Clicking yes doesn't work Thanks again [attachment deleted by admin]Sorry for the long wait. We are VERY backed-up right now! I don't see much in your logs, but if you still require assistance, please post new logs and we'll see what we can do. If we have updated logs, we can see if any changes have been made.

2475.	Solve : fails to boot after infection?
Answer» Hey guys, i'm in a bit of a pickle, I have a new toshiba satellite LAPTOP with vista 32. I did something very silly today and downloaded an exe file from dailykeys.com where every file contains a trojan - afterwards my avg and windows defender attempted to stop the onslaught but I knew there was still things lurking. I then ran malwarebytes anti-malware, it said it has to finish deleting the infected files on REBOOT but on that reboot something went very wrong. Now nothing happens after the toshiba screen is loading and it goes to a black screen and hangs forever with no sign of windows. Can't go into safemode and can't boot from cd. I downloaded and burnt the Vista_Recovery_Disc.iso but my laptop won't boot from cd now for some reason - i'm guessing the malware that is on the hdd is stopping this. I know my dvd drive is fine because when I disable the hdd my recovery disc starts working. So at the moment I can only access bios with the hdd enabled. I'm thinking the only thing I can do is buy another hdd and xp disc (my laptop didnt come with vista install). This way I can access my files externally and format the infected vista partition. Unless there is any way to clean the partition externally whilst I am in XP? thanks guys.You have to set your Boot Orde (In the BIOS) to have it boot from the CD Drive first. From what you have told us, it seems that when the computer cannot find the Hard Drive, it boots from the CD/DVD. Do you have the Windows Vista DVD? If so, you need to perform a Repair Install. This way you can repair your OS without having to reinstall.Thanks for your reply - i've ALREADY tried setting cd to boot first - but somehow the cd does not work with the hdd still connected, only when it is disconnected. I think the malware is controlling this.Although I'm not a Malware Specialist, I highly doubt this is possible. A VIRUS cannot control how the computer boots. Can you try another CD/DVD Drive? Otherwise, do you have access to another computer?I have access to another computer and as the one infected is a laptop, i have ordered an external ENCLOSURE so I can hook up my laptop hdd to this other computer and use it's cd drive to try Vista Recovery. Or if I use my toshiba vista cd, will going back to factory settings get rid of the malware completely?Reformatting (or "going back to factory settings") will get rid of your infection, but it will also get rid of all of your personal data. But if you can't run any scans on the computer, then you may have no other choice. This is what messing with warez can do to your computer...

2476.	Solve : need virus help?
Answer» picked up trojan horse that I thought I had cleaned off but obviously not fast enough. computer would boot FINE, but at XP log-in screen, you can SELECT a user and type password, then it takes you right back to log-in screen. booted the machine in safety mode and ran eTrust with week old data file. found bad files, deleted those...but also identified userinit.exe file as corrupted without being able to identify a fix or the virus. left those files in quarantine. now, can not log in even in safety mode...any suggestions other than rebuilding?Do you have the Windows CD?Will have on Sunday when I return homeOk. When you can, perform a Repair Install. http://www.michaelstevenstech.com/XPrepairinstall.htm (None of your files will be lost)Okay...FOLLOWED instructions as WRITTEN for repair install. Everything seemed to work fine, but when completed still have same problem. Get to login screen, let's me enter password and then says logging off. Any other ideas? You've performed a repair install yet you still cannot log in? What about Safe Mode?

2477.	Solve : System32 Virus Suspected?
Answer» Hey again, I'm suspecting there is a system32 virus on my WIN XP PC. Automatic Updates are being turned off and i get the security center alert in the notification bar. SUPERANTISPYWARE seems to pick up the same 4 files every time i run it, along with a number of registry ENTRIES. Adn what ever this is, it keeps trying to open an internet page. The "Cannot connect to Internet, Connect or Try Again" box keeps popping up. I've disconnected it from my home network so it can't re-download files as it's weeded out. I've gone into MSCONFIG and disabled a startup process named xftbolwc.dll in System32. I've run an Avira Anti virus scan, no hits. SUPERAntiSpyware log attached. MBAM log attached. No java installed. (I re-formatted last week). HijackThis log attached. [attachment deleted by admin]Hm, it seems whatever was messing with security center was was caught by MBAM. Everything works as it should. But there are still viruses found in further scans. EDIT: Still infected. with a nnzllu.dll, when i try to nuetralize it in SUPERAntiSpyware, windows logon services crashes and i get a blue screen SAYING that it crashed. I got it. Had to disable neutralize memory items before quarantining.

2479.	Solve : Virus Help Needed - Trojans and other problems?
Answer» I really hope you guys will be able to help me out. I'm not sure how I got infected, I've had malware/virus problems in the past few months but since I recently re-formated my laptop over the break I've tried to be really careful. Anyhow, the infections appeared after I rebooted my computer and my boyfriend was using my laptop last Friday. I have no idea what websites he went to, but a whole slew of infections have shown up and I'm not sure what to do. Generally, it is just a lot of pop-ups. It seems to be more problematic in Internet Explorer so I do not use it. While RUNNING Mozilla Firefox, I get pop-ups of random websites EVERY so often, which I just close right away. I've been using Avast as my virus protection and it warns me every so often of all the infections. My laptop is a Compaq Presario R4000, running Windows XP. I tried to do a System Restore to last Thursday (where it says it is the "Last Known Good Configuration"), but after my system reboot, it said that the restore was incomplete and could not be done. All the other available dates were after the infections appeared. I followed all the steps in the instruction post, and LOGS are posted. When I did the SUPERAntispyware Scan, the scan finished, but the program crashed and my system reboot before it could remove the problems. Let me know if there are any other details I can include. Thank you!! [attachment deleted by admin]well the first step is always a systems restore. it returns you setting back to an earlyer time windows makes backup files so to speak. to do this go to start menu select my documents / at top of my documents screen there should be a help drop down menu option. in the menu is the help and support option. in this menu half way down the page is the system resore option resore my computer to an earlier time. choose from the calandar a date before the infection happened where there is a restore point usally a system chk point.http://support.microsoft.com/kb/306084 here is the link this expalins it better than meThanks for the advice. I MENTIONED in my post that I have already tried doing a system restore. There was only ONE checkpoint available before my infection. When my system attempted to restore to this date, it said that the system restore was incomplete and no changes were made.You say that SuperAntiSpyware crashed- can you run it again?

2482.	Solve : Trojan.Smitfraud Variant-Gen/Bensorty?
Answer» Been having a bit of trouble ridding myself of this. I've run all types of spyware/virus cleaners and it seems to get rid of it, until I reboot. I'm UNABLE to find what is re-installing it. Here are requested logs. --------------------------------------------------------- SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 12/24/2008 at 11:02 PM Application Version : 4.23.1006 Core Rules Database Version : 3685 Trace Rules Database Version: 1662 Scan TYPE : Complete Scan Total Scan Time : 00:29:18 Memory items scanned : 354 Memory threats detected : 0 Registry items scanned : 4708 Registry threats detected : 6 File items scanned : 37695 File threats detected : 0 Unclassified.Unknown Origin HKLM\Software\Classes\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C}\InprocServer32 Trojan.Smitfraud Variant-Gen/Bensorty HKLM\Software\Classes\CLSID\{D5BF49A2-94F1-42BD-F434-3604812C807D} HKCR\CLSID\{D5BF49A2-94F1-42BD-F434-3604812C807D} HKCR\CLSID\{D5BF49A2-94F1-42BD-F434-3604812C807D}\InProcServer32 --------------------------------------------------------- Malwarebytes' Anti-Malware 1.30 Database version: 1306 Windows 5.1.2600 Service Pack 3 12/24/2008 11:09:08 PM mbam-log-2008-12-24 (23-09-08).txt Scan type: Quick Scan Objects scanned: 44930 Time elapsed: 3 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) --------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:11:10 PM, on 12/24/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Trend Micro\HijackThis\Sniper.exe C:\WINDOWS\System32\svchost.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search PAGE = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' MENUITEM: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QUICKTIME Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 3678 bytes --------------------------------------------------------- Any help would be greatly appreciated. thxSorry for the long wait. We are VERY backed-up right now! If you still require assistance, please post new logs and we'll see what we can do.

2483.	Solve : YEA IT WORKED?
Answer» I just finished doing all the steps for REMOVING spyware/malware and my computer is free! Thank you for your HELP. I am now off to read about how to make computer RUN smoother! If you want, we can help make sure your computer is completely healthy if you POST the logs.Thank you very much! I sincerely APPRECIATE all the help and patience I've been given. You folks are awesome! I have attached the most recent logs. [attachment deleted by admin]

2484.	Solve : Re: Trojans, Gadcom.exe SHeur2.GAS csrssc.exe - Please help?
Answer» I'm trying to run through the STEPS to get rid of this virus but most of the NAMES in my log don't match. I've attached a copy of the log. Which ones am I supposed to check off to get rid of it? Thank you for your help. [attachment deleted by admin]Sorry for the long wait. We are VERY backed-up RIGHT now! I don't see MUCH in your log. What exactly is your PROBLEM? I don't know what you mean by "most of the names in my log don't match".

2485.	Solve : SHeur2.GAS?
Answer» my internet is going pretty CRAZY. i keep getting random popups, even when IM not surfing the web, and i get randomley redirected to sites for virus protection software and other things. also, AVG has found a whole slew of viruses, most prominently SHeur2.GAS, which KEEPS coming up as csrssc.exe, as well as a bunh of other trojan horses. spybot wont run, and this virus kept redirecting me to a different page when i tried to download the recommended software. i disabled TDSSserv.sys, and that seemed to fix that problem, so i downloaded and ran all of the scans, and ATTACHED the logs. [attachment deleted by admin]Sorry for the long wait. We are VERY backed-up right now! If you still require assistance, please post new logs and we'll see what we can do.

Explore topic-wise InterviewSolutions in .

Solve : avg 8.0 help?

Solve : start up to windows message occurred...?

Solve : Can't get access to programs?

Solve : CARNIVOR?

Solve : Hijack this logfile help please.?

Solve : Trojan help - please?

Solve : My computer is sick and needs CPR! Windows XP?

Solve : Got something, logs included...?

Solve : Spyware guard 2008 keep coming up.?

Solve : Having ctxfihlp mfc error probs might be from malware?

Solve : I would REALLY love someones help :)! (A Trojan problem)?

Solve : Unable to view videos longer than ~1 minute on internet?

Solve : Trojans, Gadcom.exe SHeur2.GAS csrssc.exe - Please help?

Solve : Can only boot to safe mode?

Solve : BOOT UP from other forum?

Solve : Malware/Spyware Problems?

Solve : win32:patched-ck just can't get rid of it!!?

Solve : Help needed - Rootkit?

Solve : Getting my logs to you?

Solve : Spyhunter??

Solve : am I good to go??

Solve : Anti - Spyware/Trojan/Worm/Virus...?

Solve : YIKES & now what?

Solve : Possible virus with Task bar?

Solve : fails to boot after infection?

Solve : need virus help?

Solve : System32 Virus Suspected?

Solve : Task Manager, Registry Editor, msconfig and DVD Combo not working!?

Solve : Virus Help Needed - Trojans and other problems?

Solve : Anti-Virus Problem and Computer Suddenly running about 10 times slow?

Solve : re occuringpop ups hijack this?

Solve : Trojan.Smitfraud Variant-Gen/Bensorty?

Solve : YEA IT WORKED?

Solve : Re: Trojans, Gadcom.exe SHeur2.GAS csrssc.exe - Please help?

Solve : SHeur2.GAS?

Solve : radz services still on internet explorer?

Solve : Internet Properties Cookies Reset?

Solve : removing avg8?

Solve : Check out Open DNS VIdeo. Avoid DBS attack!?

Solve : Spyware Guard 2008 blocking anti-virus software downloads?

Solve : THANK YOU!!!!?

Solve : Trojan, I think it's winloggn.exe??

Solve : Antiirus 2008 or 2009?

Solve : I Followed The Directions but....!!!!?

Solve : Computer Hijacked, Can't update software, starting to panic.?

Solve : Tough Hijacker - can't run Spybot, SAS, or MBAM, and HJT log looks clean?

Solve : Browser not working but Internet is?

Solve : Malware removal logs for followup?

Solve : A virus that can't be detected by an anti vi and its hiding your files?

Solve : Internet Security. A Waste of Money??

2486.	Solve : radz services still on internet explorer?
Answer» i followed the instructions given in this THREAD after finding a radz virus. i completed it up to the last step. i saw on the AVAST report that radz was ALREADY dealt with. im not sure if it has really been fixed but everytime i open my internet explorer, "Radz Services and Internet Cafe" STILL appears. and thanks for the help! i didnt know there were pro bono solutions from EXPERTS in the net. wish i had learned this earlier. [attachment deleted by admin]Sorry for the long wait. We are VERY backed-up right now! Your log still shows an infection, so if you still require assistance, please post new logs and we'll see what we can do.

2491.	Solve : THANK YOU!!!!?
Answer» I was actually kind of embarassed to have to find this site!!! Im normally the one people call when they have a computer issue. I had a narley Vundo virus I was unable to catch for a while censored babysitters anywayz!!! But it turned my windows updates off, I could not turn them back on for nothing >< It prevented me from updating my ad aware, AVG was seeing it, but unable to remove it. It got into my system restore and deleted all the checkpoints from before i got the virus. It caused pop-ups EVERY 30 seconds when I would try to use the internet for anything. It made walking through the steps that more frustrating >< It was nasty, I have spent the last week trying to remove it. hours into it I thought i was gonna have to re-do windows Followed the steps, and it was the SUPERantispyware program that finally got rid of it It stored itself on my memory and in my registry's but its gone now, thanx to Evilfantasy's steps (almost sounds like Im in an aa meeting now, lol) Didnt want to just come in here, learn what to do, and bail without saying a word, so THANX!!!! Lots of work and very frustrating, but a good learning expierence anywayz SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 01/02/2009 at 01:28 PM Application Version : 4.24.1004 Core Rules Database Version : 3694 Trace Rules Database Version: 1670 Scan type : Complete Scan Total Scan Time : 01:03:34 Memory items scanned : 408 Memory threats detected : 3 Registry items scanned : 6662 Registry threats detected : 46 File items scanned : 81017 File threats detected : 30 Adware.Vundo/Variant C:\WINDOWS\SYSTEM32\XHSCQO.DLL C:\WINDOWS\SYSTEM32\XHSCQO.DLL C:\WINDOWS\SYSTEM32\CSDEVQ.DLL C:\WINDOWS\SYSTEM32\QGOTXV.DLL C:\WINDOWS\SYSTEM32\YAKWNQ.DLL Trojan.Vundo-Variant/Small C:\WINDOWS\SYSTEM32\XXYYYYQI.DLL C:\WINDOWS\SYSTEM32\XXYYYYQI.DLL Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\xxyyyYQI Trojan.Vundo-Variant/Small-GEN C:\WINDOWS\SYSTEM32\PMNLMMMD.DLL C:\WINDOWS\SYSTEM32\PMNLMMMD.DLL HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\ Ext\Stats\{CFDD11EC-6332-4B6F-B369-E58CC025F9F4} Adware.Vundo Variant HKLM\Software\Classes\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C}\InprocServer32 HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C}\InprocServer32#ThreadingModel HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{6D794CB4-C7CD-4c6 f-BFDC-9B77AFBDC02C} HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\ Ext\Stats\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} C:\WINDOWS\SYSTEM32\XEFWFMWM.DLL Trojan.Vundo-Variant/NextGen-Six HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{865c0079-4a6a-473f-93a6-7031c9cc8eb7} HKCR\CLSID\{865C0079-4A6A-473F-93A6-7031C9CC8EB7} HKCR\CLSID\{865C0079-4A6A-473F-93A6-7031C9CC8EB7}\InprocServer32 HKCR\CLSID\{865C0079-4A6A-473F-93A6-7031C9CC8EB7}\InprocServer32#ThreadingModel Trojan.Vundo-Variant/NextGen HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFDD11EC-6332-4B6F-B369-E58CC025F9F4} HKCR\CLSID\{CFDD11EC-6332-4B6F-B369-E58CC025F9F4} HKCR\CLSID\{CFDD11EC-6332-4B6F-B369-E58CC025F9F4}\InprocServer32 HKCR\CLSID\{CFDD11EC-6332-4B6F-B369-E58CC025F9F4}\InprocServer32#ThreadingModel Adware.Tracking Cookie C:\Documents and Settings\Katie\Cookies\[emailprotected][2].txt C:\Documents and Settings\Katie\Cookies\[emailprotected][1].txt C:\Documents and Settings\Katie\Cookies\[emailprotected][2].txt C:\Documents and Settings\Katie\Cookies\[emailprotected][1].txt C:\Documents and Settings\Katie\Cookies\[emailprotected][1].txt C:\Documents and Settings\Katie\Cookies\[emailprotected][1].txt .sonyonlineentertainment.112.2o7.net [ C:\Program Files\Sony\EverQuest\mozilla\cookies.txt ] .doubleclick.net [ C:\Program Files\Sony\EverQuest\mozilla\cookies.txt ] .cgm.adbureau.net [ C:\Program Files\Sony\EverQuest\mozilla\cookies.txt ] .cgm.adbureau.net [ C:\Program Files\Sony\EverQuest\mozilla\cookies.txt ] .cgm.adbureau.net [ C:\Program Files\Sony\EverQuest\mozilla\cookies.txt ] .sonyonlineentertainment.112.2o7.net [ C:\Program Files\Sony\EverQuest II\mozilla\cookies.txt ] .cgm.adbureau.net [ C:\Program Files\Sony\EverQuest II\mozilla\cookies.txt ] .cgm.adbureau.net [ C:\Program Files\Sony\EverQuest II\mozilla\cookies.txt ] .cgm.adbureau.net [ C:\Program Files\Sony\EverQuest II\mozilla\cookies.txt ] Unclassified.Unknown Origin HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C} Adware.Zango Toolbar/Hb C:\Documents and Settings\Katie\Application Data\ZangoToolbar\v3.0\ZangoToolbar\dynamic C:\Documents and Settings\Katie\Application Data\ZangoToolbar\v3.0\ZangoToolbar C:\Documents and Settings\Katie\Application Data\ZangoToolbar\v3.0 C:\Documents and Settings\Katie\Application Data\ZangoToolbar\zbar.log C:\Documents and Settings\Katie\Application Data\ZangoToolbar Trojan.DNSChanger-Codec HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\GetModule HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iCheck HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iCheck#DisplayName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iCheck#UninstallString Adware.AdSponsor/ISM C:\Program Files\GetModule C:\Program Files\iCheck\Uninstall.exe C:\Program Files\iCheck Adware.Vundo Variant/Rel HKLM\SOFTWARE\Microsoft\FCOVM HKLM\SOFTWARE\Microsoft\RemoveRP HKLM\SOFTWARE\Microsoft\contim HKLM\SOFTWARE\Microsoft\contim#SysShell HKLM\SOFTWARE\Microsoft\MS Track System HKLM\SOFTWARE\Microsoft\MS Track System#Uid HKLM\SOFTWARE\Microsoft\MS Track System#Shows HKLM\SOFTWARE\Microsoft\MS Track System#Uqs HKLM\SOFTWARE\Microsoft\rdfa HKLM\SOFTWARE\Microsoft\rdfa#F HKLM\SOFTWARE\Microsoft\rdfa#N Trojan.Unclassified/C00-WL HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C0063DFE HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C0063DFE#Asynchronous HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C0063DFE#DllName HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C0063DFE#Impersonate HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C0063DFE#Startup HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C0063DFE#Logon Rogue.Component/Trace HKLM\Software\Microsoft\6CBC1F30 HKLM\Software\Microsoft\6CBC1F30#6cbc1f30 HKLM\Software\Microsoft\6CBC1F30#Version HKLM\Software\Microsoft\6CBC1F30#6cbcb2b0 HKLM\Software\Microsoft\6CBC1F30#6cbcdb55 HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\CS41275 HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\FIAS4018 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:57:42 PM, on 1/2/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running PROCESSES: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Microsoft IntelliType Pro\type32.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\ResChanger 2005\ResChanger2005.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {033D9E79-723E-43C8-B18D-677BB46D0B3E} - C:\WINDOWS\system32\pmnlmmMD.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar NOTIFIER BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: {483e600a-3ebc-88e8-7bc4-c37535ad792b} - {b297da53-573c-4cb7-8e88-cbe3a006e384} - C:\WINDOWS\system32\qgotxv.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKCU\..\Run: [ResChanger 2005] C:\Program Files\ResChanger 2005\ResChanger2005.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [GetModule32] "C:\Program Files\GetModule\GetModule32.exe" O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: D-Link AirPlus.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Resume Beyond Media Installation.lnk = E:\Beyondmedia\Setup.exe O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://www.msn.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab53083.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave FLASH Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll qgotxv.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WUSB54Gv42SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe O24 - Desktop Component 0: (no name) - http://spectraleyes.com/albums/artworx/NAMESTE_HOLO_U.gif -- End of file - 10352 bytes

2493.	Solve : Antiirus 2008 or 2009?
Answer» A couple of weeks ago I got this virus. I thought I had it REMOVED by using AVG, Malwarebites, Spybot and Adaware. And maybe this problem is not related, but from time to time while on the computer some kind of error occurs. Or what I will CALL an error. The computer will make the "dong" sound just as if you were trying to click out of something that you shouldn't. It does this without my doing ANYTHING. I have no warnings actually come up. I went through the routine for cleaning virus and malware. I have attached the log files that were requested. Any HELP would be appreciated. Thanks, JIM [attachment deleted by admin]

2495.	Solve : Computer Hijacked, Can't update software, starting to panic.?
Answer» My computer has been hijacked. My browser redirects, I can't update anti-virus software and no amount of malware or anti-virus software seems to help. If anyone can give me some advice on how to save my computer it would be greatly appreciated. I ran Hijack this and have included the log file. Help, please! Logfile of Trend Micro HijackThis v2.0.2 Scan SAVED at 12:42:26 PM, on 1/19/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet EXPLORER v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\WDBtnMgr.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Registry Mechanic\RegMech.exe C:\Program Files\Belkin\F5D8053v4\BelkinWCUI.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -SCHEDULER O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H O4 - Global Startup: Belkin Wireless Networking Utility.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{0B662D5E-E8AD-42C6-92E1-F1EA6399E697}: NAMESERVER = 85.255.115.34;85.255.112.112 O17 - HKLM\System\CCS\Services\Tcpip\..\{82D279C3-D942-48BD-AEB6-31A75FBD29AD}: NameServer = 85.255.115.34;85.255.112.112 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.34;85.255.112.112 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.34;85.255.112.112 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.34;85.255.112.112 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 6491 bytes

2496.	Solve : Tough Hijacker - can't run Spybot, SAS, or MBAM, and HJT log looks clean?
Answer» I've got a tough one for you. It's a HIJACKER of some sort, it blocks me from accessing sites like AVG, superantispyware.com, spybot, etc. It also won't let me run Spybot, SAS, MBAM, etc... when I try to run them the computer just processes for a few minutes, and nothing happens, even when I try in Safe Mode. Other than that, I've run everything as close as possible to the instructions in the sticky post at the top of this forum. I can run AVG and have updated it manually by downloading the defs on my uninfected laptop, and did the same for Adaware, but both scans came out clean. My HJT log is attached. The "DBRas" and "CONFIDENCE Online" entries are for getting onto my WORK's network from home. I've TRIED updating HJT to the latest version, and it does not work... it just processes for a minute and does not continue. I'm running Windows XP Pro, Version 5.1 (Build 2600.xpsp_sp3_gdr.080814-1236 : Service Pack 3) It's a homebuilt machine, Pentium 4, 3.2Ghz, 1.00 GB of RAM I've had no hardware problems, and first noticed this problem about two weeks ago. Edit: AVG reports that I have an adware.secondthought infection. I'm going to try removing it by using the instructions at www.safer-networking.com/removeadwaresecondthought.php I doubt this is my only problem but we'll see. Edit #2: no luck. Still there. Thanks for your help! [attachment deleted by admin]I have been having the same problem. I went to the Spybot site and cannot navigate anywhere there. Wanted to E-mail Spybot about the problem, but when I try to click to go to the contact E-mail, get a FAILED connection notification.

2498.	Solve : Malware removal logs for followup?
Answer» HI -- First, God bless you for this site! I just went through the malware removal process because of a nasty FAKE virus alert that hijacked my internet, too. All seems well now, but I am posting the LOGS as REQUESTED for review. Thank you so much for your help! [attachment deleted by admin]

2500.	Solve : Internet Security. A Waste of Money??
Answer» Internet Security. A Waste of Money? Now if I took that position, Whould you agree? Look here: CODE: [Select]The U.S. federal government is accelerating its efforts to SECURE the Internet's routing system, with plans this year for the Department of Homeland Security to quadruple its investment in research aimed at adding digital signatures to router communications The blurb is from a reliable source in the internet. Rather that give a link, I would invite you to do your own research. Or just make a comment without any research. In view of the present economical problems, would this not be a big waste of money? The Internet is already as safe as it will ever be. Do you agree? Digital Signatures never worked for ActiveX... Don't see how you would add digital signatures to a router system anyway. And besides, the internet is a Global network, and as much as the U.S likes to think otherwise they have no jurisdiction as to the network infrastructure of other countries, so it would just be a waste of money. Unless of course they are actually TAPPING into the internet infrastructure for "big brother" monitoring... but that's another story altogether they will catch and trace heap of people for doing heaps of stuff. its probably a good idea. but some one will hack it. they hack every thing. so yeah it will work but if you really wont to there always a way. a hacker never quits it just increases the FUN. Yep. If they make the internet safer, the crooks will go back to breaking and ENTERING our homes. In some cities apartment houses already look like jails. All the iron bars and gates.