InterviewSolution
Saved Bookmarks
InterviewSolution
This section includes InterviewSolutions, each offering curated multiple-choice questions to sharpen your knowledge and support exam preparation. Choose a topic below to get started.
| 4601. |
Solve : UST Scandal virus? |
|
Answer» my friend's loptop has a virus named "UST Scandal". she got this virus from her friend in yahoo messenger, and when this virus detected from AVG free edition antivirus. AVG can't heal/delete this. and not only that, ANOTHER problem is that this virus is really harmful because everytime she opens a program and making her thesis, this virus automatically closes the PROGRAMS that she is using..and because of that, she decided to reformat her loptop. usually when we reformat our HDD and OS,all files are deleted and even the viruses. but this virus still in her HDD and after she reformat her loptop and continue her work, again the virus still striking and my friend GETTING irritated with what is happening in her loptop. |
|
| 4602. |
Solve : deepfreeze and antivirus? |
|
Answer» guys... |
|
| 4603. |
Solve : Alternating Blue and Red Shields? |
|
Answer» Hi. I recently had some problems with my computer (PC, Win XP Pro, Service Pack 2) when I inadvertantly downloaded a virus through what I thought was an active x CONTROL. I resolved most of the issue with virus scans and spyware scans using "Avast" and "Spybot: Search and Destroy". But I still have this icon in my system tray that alternates between a red shield with a white x and a blue shield with a white question mark. Whether I right-click or left-click the icon the same thing happens (though I don't recieve a name of what this icon is for, not even when I just let the cursor hover) multiple Internet Explorer WINDOWS pop-up. All are blank though so I can't even find out what this is through a website. When I "Alt + Tab" between windows, the icon is within the "Alt + Tab" menu but carries no name there nor do the websites that pop-up from clicking on it. I currently don't have a mouse (due to unrelated circumstances) and have been using hotkeys (mostly Tab). This program that carries the shield icon periodically interupts Tab hotkey usage and I have to reselect a window or program to use hotkeys for that window or program. This interuption tells me that the program carrying the shield icon has become the main window, on top of whatever window I was just on, yet nothing appears on the screen to show me what this icon is. Can someone please tell me what this program is or how to identify what it is and how to remove it? Thank you. Lets look at a HJT log and see if it reveals anything.
- --------------- Next post please add: Smitfraudfix log |
|
| 4604. |
Solve : is the Dell (Ctrl + F11) recovery image safe from infection?? |
|
Answer» i'm fixing my friend's Dell Inspiron E1405. it's running Windows XP Home EDITION Service Pack 2 (build 2600). i don't feel i need to add lots of info here because my question is pretty general. If you are able to unhide the hidden restore partition then just right clik it and scan it with whatever AV program you are running... thanks. do you know where this file is located? i have been looking all over the internet with no success. not to get too deep into the infection discussion, but i'm not sure how to define "nasty". it took me hours to clean all the stuff on there (no trojans or rootkits that i could tell) and it still may have a last bit of spyware. it runs beautifully, though. can an infection "spread" to the IMAGE? or can it just disable the image? [meanwhile, i will head over to the Dell forums to see if i find out more.]The Dell Forums will have instructions on accessing the hidden partition...i'd bet the image is safe. To be ultra sure another option would be to burn the image to CD and then scan it before you do the restore...Quote from: patio on January 19, 2008, 05:10:41 PM The Dell Forums will have instructions on accessing the hidden partition...i'd bet the image is safe. i'm getting my questions answered there now. it seems the partition should indeed be safe, as it is a hidden partition. so glad i have the recovery option on this machine. thanks!No problem. Let us know how it goes and Welcome Aboard !the system recovery went GREAT, thanks. it is amazingly fast (15 minutes or so). it's the windows update and getting everything set up and secure that took many hours. she was happy with her laptop. i shall tackle my other problems/questions, like the ominous-sounding "nbsess" that i gave permission to Comodo for internet access, later (i'm never satisfied!). Now that you have a "clean" install you may want to consider investing in an imaging program. The advantage to one of these is after you have all your programs installed and have everything tweaked to your liking you run an image and it creates an exact replica of how things are. If you get into a pickle again you simply "restore" the image you created and you're back up and running in 15 minutes... I Use Acronis True Image but there are others such as Ghost... If you need more info post back. patio. |
|
| 4605. |
Solve : Avast is blocking my son from browsing the web? |
|
Answer» I'm asking this on behalf of my full-time working college STUDENT son who doesn't have a LOT of time to try and figure out his own problems. |
|
| 4606. |
Solve : Annoying virus undetected by scan? |
|
Answer» Hi, I noticed that when I turned on my PC this morning my internet wasn't working right and could not browse the web or use programs that require net access. Which was strange because it said my internet was very good and running at 54mbps. I tried repairing then rebooting windows but still no internet. I then tried a norton full system scan but no luck. As I thought it could not get any worse after I rebooted a second time it changed my theme from WinXP to Windows classic I checked display properties and the theme had been deleted, luckily I have a backup drive from which I was able to retrieve the theme, My knowlage on this subject is very slim so I have no idea on how to fix my internet.Lets look at a HJT log and see if it reveals anything.
Anyways here are the reports. SDFix: Version 1.129 Run by Administrator on Mon 21/01/2008 at 10:13 p.m. Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOCUME~1\ADMINI~1.TIM\Desktop\SDFix Safe Mode: Checking Services: Name: FCI SysLibrary xpdx Path: C:\WINDOWS\system32\svchost.exe:ext.exe \??\C:\WINDOWS\system32\DefLib.sys \??\C:\WINDOWS\system32\xpdx.sys FCI - Deleted SysLibrary - Deleted xpdx - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\Program Files\Helper\superfindout.dll - Deleted Folder C:\Program Files\Helper - Removed Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-21 22:25:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk" "C:\\DOCUME~1\\Owner\\LOCALS~1\\Temp\\win3EA.exe"="C:\\DOCUME~1\\Owner\\LOCALS~1\\Temp\\win3EA.exe:*:Enabled:win3EA" "C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:svchost" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\WINDOWS\\system32\\wewpmofe.exe"="C:\\WINDOWS\\system32\\wew" "C:\\Program Files\\Steam\\SteamApps\\andrew_timothy_hughes\\garrysmod\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\andrew_timothy_hughes\\garrysmod\\hl2.exe:*:Enabled:hl2.exe" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Disabled:DNA" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: --------------- File Backups: - C:\DOCUME~1\ADMINI~1.TIM\Desktop\SDFix\backups\backups.zip Files with Hidden Attributes: Sun 28 Oct 2007 196 A.SHR --- "C:\BOOT.BAK" Thu 6 Sep 2001 1,700,352 A..H. --- "C:\gdiplus.dll" Tue 11 Dec 2007 197,120 A..H. --- "C:\RECYCLER\S-1-5-21-2418244512-849263507-4064612095-500\Dc36.tmp" Sat 24 Nov 2007 197,120 A..H. --- "C:\RECYCLER\S-1-5-21-2418244512-849263507-4064612095-500\Dc37.tmp" Mon 5 Nov 2007 197,120 A..H. --- "C:\RECYCLER\S-1-5-21-2418244512-849263507-4064612095-500\Dc38.tmp" Sat 17 Nov 2007 197,120 A..H. --- "C:\RECYCLER\S-1-5-21-2418244512-849263507-4064612095-500\Dc39.tmp" Wed 7 Nov 2007 376 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti7CB.tmp" Thu 19 Oct 2006 5,294,080 A..H. --- "C:\hp\patches\42WW1REC\src\App00153.exe" Thu 19 Oct 2006 452,096 A..H. --- "C:\hp\patches\42WW1REC\src\App00292.exe" Thu 19 Oct 2006 444,416 A..H. --- "C:\hp\patches\42WW1REC\src\App00491.exe" Thu 19 Oct 2006 1,838,592 A..H. --- "C:\hp\patches\42WW1REC\src\App02995.exe" Thu 19 Oct 2006 492,544 A..H. --- "C:\hp\patches\42WW1REC\src\App04827.exe" Thu 19 Oct 2006 1,401,856 A..H. --- "C:\hp\patches\42WW1REC\src\App05447.exe" Thu 19 Oct 2006 440,320 A..H. --- "C:\hp\patches\42WW1REC\src\App05705.exe" Thu 19 Oct 2006 462,848 A..H. --- "C:\hp\patches\42WW1REC\src\App09961.exe" Thu 19 Oct 2006 15,596,032 A..H. --- "C:\hp\patches\42WW1REC\src\App14604.exe" Thu 19 Oct 2006 5,256,704 A..H. --- "C:\hp\patches\42WW1REC\src\App16827.exe" Thu 19 Oct 2006 3,668,992 A..H. --- "C:\hp\patches\42WW1REC\src\App17421.exe" Thu 19 Oct 2006 696,832 A..H. --- "C:\hp\patches\42WW1REC\src\App18716.exe" Thu 19 Oct 2006 423,936 A..H. --- "C:\hp\patches\42WW1REC\src\App19169.exe" Thu 19 Oct 2006 1,157,632 A..H. --- "C:\hp\patches\42WW1REC\src\App19718.exe" Thu 19 Oct 2006 995,328 A..H. --- "C:\hp\patches\42WW1REC\src\App19895.exe" Thu 19 Oct 2006 453,632 A..H. --- "C:\hp\patches\42WW1REC\src\App23281.exe" Thu 19 Oct 2006 453,632 A..H. --- "C:\hp\patches\42WW1REC\src\App24464.exe" Thu 19 Oct 2006 2,251,776 A..H. --- "C:\hp\patches\42WW1REC\src\App26962.exe" Thu 19 Oct 2006 481,792 A..H. --- "C:\hp\patches\42WW1REC\src\App29358.exe" Thu 19 Oct 2006 12,426,752 A..H. --- "C:\hp\patches\42WW1REC\src\App32391.exe" Thu 19 Oct 2006 12,426,752 A..H. --- "C:\hp\patches\42WW1REC\src\App99990.exe" Thu 19 Oct 2006 15,596,032 A..H. --- "C:\hp\patches\42WW1REC\src\App99992.exe" Thu 19 Oct 2006 5,256,704 A..H. --- "C:\hp\patches\42WW1REC\src\App99993.exe" Thu 19 Oct 2006 5,256,704 A..H. --- "C:\hp\patches\42WW1REC\src\xApp14604.exe" Thu 9 Aug 2007 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg" Thu 9 Aug 2007 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg" Sun 28 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0089cd1ec7c03d0a52caa6b6ea801507\BITC9.tmp" Fri 14 Dec 2007 857 ...HR --- "C:\Documents and Settings\Owner\Application Data\SecuROM\UserData\securom_v7_01.bak" Finished! Hi jack this: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:35:46 p.m., on 21/01/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Belkin\Belkin 802.11g Wireless PCI Card Configuration Utility\utility.exe C:\Program Files\Xfire\xfire.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - S-1-5-18 Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'Default user') O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe O4 - Global Startup: Belkin 802.11g Wireless PCI Card Configuration Utility.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193513486234 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1193513461562 O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://atl.img.digitalriver.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe -- End of file - 6259 bytes You have no antivirus running. Why? Please download Combofix by sUBs from one of the below links. (Try all three if necessary)IMPORTANT - Combofix.exe MUST be saved to your your Desktop.
I have norton 2008 running.
|
|
| 4607. |
Solve : Viruses vs. Networks? |
|
Answer» I am trying to answer a DQ at my COLLEGE, but I am at a loss. I have been doing some searches, but cannot SEEM to get this question answered. So, here it GOES... |
|
| 4608. |
Solve : How to minimize the time virus scanners adware scanners ect take to perform scan? |
|
Answer» I have been scanning my computer with avg antivirus, WINDOWS DEFENDER and a AVG Anti-Spyware, and Spyware Terminator and all of the scans ( full) have taken more than TWO hours to complete. I used those programs at different times. How can I speed up the time they take to scan. I know the more files I have on the computer the more time it takes to scan.Quote from: alyoob on January 20, 2008, 08:25:45 AM I know the more files I have on the computer the more time it takes to scan. Using CCleaner prior to the scan will help some. Run them in safe mode. That is about all. If I Run the scans in safe mode it will find less viruses, because in safe mode there is limited number of processes running.Quote from: alyoob on January 20, 2008, 10:54:44 AM If I Run the scans in safe mode it will find less viruses, because in safe mode there is limited number of processes running. No, it still scans every file. The fewer processes running allow it to go through them faster.Scanning in safe mode might actually reveal more viruses since some viruses tries hide from or disable AV software in normal mode. 1) Keep the machine in shape. 2) Run Diskclean and defrag regularly, depending on usage. 3 ) Update and run scans more often...at first you may want to scan at night when you are not using the machine. 4 ) The more often the scans are run the quicker they will run. 5 ) Stay organised. If you have a ton of music files, photos and /or videos burn them to CD/DVD once they've been scanned. |
|
| 4609. |
Solve : Anti virus source code !!? |
|
Answer» Can any body help me in WRITING an ANTI virus source code ??Well basically a traditional antivirus engine does nothing more than comparing file signatures against signatures of known viruses. (In real LIFE it's more complex than that, but this is the basic idea.) |
|
| 4610. |
Solve : Worm targets Grand Theft Auto IV (and everything else)? |
|
Answer» http://www.sophos.com/security/blog/2008/05/1415.html Sophos has posted a blog entry last week about the popular video game, Grand Theft Auto IV. They NOTED that they saw a story on The Daily Mail which is a British NEWSPAPER about the game and that a new Trojan has targeted it. The Daily Mail claimed it is rojan-Downloader.Win32.VB.dck. After investigating the case, they found that it is not a Trojan but it is a worm. The worm is CAPABLE of propagating itself over the Gunetalla network and it does this process by sharing itself. This particular worm ALSO targets other video games such as Fortress 2 and Two Worlds.Good thing I don't have any of those games But Will it Blend?Quote from: evilfantasy on May 25, 2008, 02:44:32 AM But Will it Blend?that's gotta be one of the funniest posts i've seen here for a long time. i wish there was a laughing emoticon. |
|
| 4611. |
Solve : Another Bug screensaver virus? |
|
Answer» Here are a few other sites to scan the file from. You will have to copy and paste the results from them though.
Is everything running OK now?YES!!!!!!!!!!!!!! THANKS!!!!!!!!!!!!!!!!!!!!!!!! i noticed that after coming back from dinner with the PC left on i did not have the bugs all over my screen. And it seem my web browsing is a little faster i would like to personally thank you for this site and the professional help all you geeks sorry mean experts give to help remove other aholes programing that could make millions writing software for the good insted of getting kicks writing spam!!! again i am pretty good with computers IE networking and software, but it would have taken me a long time to fix this mess your status should be up graded from expert to guru!! as i have noticed that you have helped a lot of other people if i can i will leave co dos with the site MikeGlad you have your PC back! Still a few more final steps to do. Let's clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally. These steps will also help secure the work you have done. .
. The above procedure will:
---------- Set a New Restore Point to prevent possible REINFECTION from an old one Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.
Use the Secunia Software Inspector to check for out of date software.
Here are some great tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC. To prevent unknown applications from being installed on your computer install WinPatrol 2008 Another thing I would suggest installing SiteAdvisor. SiteAdvisor rates sites on business PRACTICES and spam. SpywareBlaster - Secure your Internet EXPLORER to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox. Using SpywareBlaster to protect your computer from Spyware and Malware Check out Keeping Yourself Safe On The Web for tips and free tools to keep you safe in the future. Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth. Let us know if anything else comes up. Safe surfing.... |
|
| 4612. |
Solve : trojanloader.xs help?? |
|
Answer» Sorry, back again...
I'm 99.99% sure you are now clear of malware. Let me know if anything else comes up. Everything appears to be FUNCTIONING as it should... even better than before the bug. Thanks for all your excellent help. Greatly appreciated. |
|
| 4613. |
Solve : Relentless pop-ups? |
|
Answer» I've had these pop ups that just won't stop no matter how many scans/fixes I do, helllllp Welcome to CHYeah, sorry, I kinda rushed and posted without reading that thing, I noticed it a minute ago >.<. I'll do those things in a little while and get back to you (sort of busy right now x_x). Thanks again. |
|
| 4614. |
Solve : Restore computer speed? |
|
Answer» Hi |
|
| 4615. |
Solve : Keylogger(s) residing within my PC?? |
|
Answer» Removed the folder, now what exactly am I supposed to do?Quote from: evilfantasy on May 23, 2008, 09:39:11 PM How does everything seem to be now? Sorry. Was I supposed to scan again?I just want to know if you are NOTICING any problems is all. I am 99.99% sure you are now clear of any virus/keyloggers etc. Check for any outdated programs, updates usually patch security holes as well as fix performance issues. Use the Secunia Software Inspector
---------- To prevent unknown applications from being installed on your computer INSTALL WinPatrol 2008 ---------- Install BOClean, just install it and forget it. It's that easy to use. Protect yourself from online identity theft - Comodo BOClean - Also stops trojans and many more malicious attacks. Learn more about how to protect yourself while on the internet read this article by TONY Klien: So how did I get infected in the first place? How is everything now?I think I'm all good, thanks for putting up with my ignorance. If I have anymore problems I'll let ya know. Thanks again!Quote thanks for putting up with my ignorance. Not ignorance! Thanks for putting up with .......us We'll be here if anything else comes up. Safe surfing... |
|
| 4616. |
Solve : internet slowdown and explorer errors? |
|
Answer» Hello... its me again.. do you think the avg is causing the windows explorer errors too?We won't find out until AVG is gone. There has been a lot of problems with 8.0 version. |
|
| 4617. |
Solve : AVG or AVAST?? |
|
Answer» On a new LAPTOP, I will USE avg or avast. Which of the 2 do you suggest? I have read here in the forum that latest avg (8?) is not as performing as previous ONE. thank you. airAS far as I have SEEN, most of the usuals on the board favor Avast! over AVGThe newest AVG (8.0) is definitely having problems, so, at this point, get Avast.I'm definitely in favor of AVG. Just get 7.5 until they work all of the KINKS out of the new version.I like avast better, you can only use one other wise it causes problems. |
|
| 4618. |
Solve : Zone Alarm Suite? |
|
Answer» I find this program using a lot of computer rescources.Are the free PROGRAMS any good.I usually go to SAFE sites only?Yes there are alot of free programs and they are really good I have avg, threatfire and comodo firewall I also have windows DEFENDER which are all free. Thank you brett 74 SURE no problem Suites usually suck (resources ).In my experience, I have FOUND that the free programs are actually better than most of the ones that cost money.I think Kaspersky is pretty good |
|
| 4619. |
Solve : Many problems.....please help!? |
|
Answer» OK - obviously I've got something wrong - computer is running extremely slow, booting up takes 10-15 minutes - same as shutting down, web pages take several minutes to load (if at all), etc. I've read the rules on what to do before posting here and downloaded Super AntiSpyware, Malwarebytes' Anti-Malware and HiJack This. I ran MBAM but after completing the scan I didn't see anywhere where it offered to clean the items it found. Not only that but it doesn't show any logs either. I've ran it several times & it's the same thing.
Code: [Select]KillAll:: Folder:: C:\WINDOWS\VmFsdWVkIEN1c3RvbWVy FILE:: C:\WINDOWS\system32\lpjooesx.exe C:\WINDOWS\system32\qyskketg.exe C:\WINDOWS\system32\atmtd.dll.tmp C:\WINDOWS\system32\rvhqjxoh.exe C:\jfcjr.exe C:\flciijjq.exe C:\1154735127 C:\60.tmp C:\WINDOWS\b156.exe_old C:\EZ-DJ_Plus_v1.2_-_By_Samurize.rar C:\WINDOWS\SCE2287D1.tmp Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BM47e0ef24"=- [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{FA8BE6D5-40E0-48B8-B317-18A4A590918A}"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXPJYrq] 3. Go to the Notepad window and click Edit > Paste 4. Then click File > Save 5. Name the file CFScript.txt - Save the file to your Desktop 6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully! ComboFix will begin to execute, just follow the prompts. After reboot (in case it asks to reboot), it will produce a log for you. Post that log (Combofix.txt) in your next reply. Note: Do not mouseclick combofix's window while it is running. That may cause your system to freeze ---------- After combofix has completed run a new Hijackthis scan and post the new log from it along with the combofix log. New combofix and Hijack This logs attached. Is it ok to attach these logs or do you prefer them copied into the post? Thanks for all your help! [recovering space - attachment deleted by admin]
Open Hijackthis and select Do a system scan only then place a CHECK mark next to: O20 - Winlogon Notify: byXPJYrq - byXPJYrq.dll (file missing) Now click Fix checked. Exit Hijackthis. ---------- You need to install a free antivirus and do a full scan with it. Pick one of these. http://www.filehippo.com/download_avg_antivirus/ ---------- Before you start the scan uninstall combofix. Time to do some cleanup and secure the work you have done.
---------- Now do the antivirus scan and have it remove or quarantine anything it finds. Let me know how things are now. ok - I did everything as you said - fixed that missing file with HiJack This, uninstalled Combofix, downloaded and ran the AVG antivirus & it came up clean. Computer is running much better. Do you think I am clean?From the logs and now the AVG scan I would think you are in the clear You need to do a few more final steps. Set a New Restore Point to prevent possible reinfection from an old one Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.
---------- Here are some great tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC. To prevent unknown applications from being installed on your computer install WinPatrol 2007 Another thing I would suggest installing SiteAdvisor. SiteAdvisor rates sites on business practices and spam. SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like FIREFOX. * Using SpywareBlaster to protect your computer from Spyware and Malware And finally. Learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place? Let us know if anything ELSE comes up. Awesome! Thanks so much for all your help. I think I have learned my lesson about using warez & crackz. Have a great night! |
|
| 4620. |
Solve : got another trojan...please help? |
|
Answer» Here we go again. Norton auto protect picks it up over and over but doesn't get rid of it. Here are the LOGS...SUPERAntiSpyware Scan Log |
|
| 4621. |
Solve : Windows Security Center Virus? |
|
Answer» I have a HP Pavilion Computer running Microsoft XP. When I turned on my compute this morning a Windows Security Center box popped up telling me I was not protected with anitvirus and spyware, even though I have norton antivirus, webroot spyware and adaware, which are all run regularly. When I clicked on the Windows Security box to install, my Norton blocked it and labeled it a virus. After running all my anitvirus and several spyware programs, I cannot get rid of this. It continues to pop up boxes telling me to click on the security button on my taskbar and download.Quote Windows Security Center box popped upMost likely, fake warning... Print these instructions out. 1. Download SUPERAntiSpyware Free for Home Users: http://www.superantispyware.com/ * Double-click SUPERAntiSpyware.exe and use the default settings for installation. * An icon will be created on your desktop. Double-click that icon to launch the program. * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.) * Close SUPERAntiSpyware. Restart computer in Safe Mode. To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen * Open SUPERAntiSpyware. * Under "Configuration and Preferences", click the Preferences button. * Click the Scanning Control tab. * Under Scanner Options make sure the following are checked (leave all others unchecked): o Close BROWSERS before scanning. o Scan for tracking cookies. o Terminate memory threats before quarantining. * Click the "Close" button to leave the control center screen. * Back on the main screen, under "Scan for Harmful Software" click Scan your computer. * On the left, make sure you check C:\Fixed Drive. * On the right, under "Complete Scan", choose Perform Complete Scan. * Click "Next" to start the scan. Please be patient while it scans your computer. * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". * Make sure everything has a checkmark next to it and click "Next". * A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. * If asked if you want to reboot, click "Yes". * To retrieve the removal information after reboot, launch SUPERAntispyware again. o Click Preferences, then click the Statistics/Logs tab. o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. o Please copy and paste the Scan Log results in your next reply. * Click Close to exit the program. Post SUPERAntiSpyware log. RESTART COMPUTER! 2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop. * Double-click mbam-setup.exe and follow the prompts to install the program. * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. * If an update is found, it will download and install the latest VERSION. * Once the program has loaded, select Perform full scan, then click Scan. * When the scan is complete, click OK, then Show Results to view the results. * Be sure that everything is checked, and click Remove Selected. * When completed, a log will open in Notepad. * Post the log back here. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt RESTART COMPUTER! 3. Download HijackThis: http://www.snapfiles.com/get/hijackthis.html Post HijackThis log.So I have spent all night and morning trying to run the spyware... my computer keeps crashing in the MIDDLE of the scans. Here are the error messages I am getting: This pops up first, but doesn't shut the computer down. I just click o.k.: IE7 Explorer.exe Instruction at 0x0lcf34739 referenced memory at 0x02df2e50. memory could not be read. Then later, this one pops up and shuts the computer down: System Unstable. Problem detected with windows. Shutdown buggy application to PREVENT damage. Kernel 32x.sys- address 0xA73C20AE base error code C03200, Date Stamp 566836A3. Kernel Debugger port Com3. With the SuperAntiSpyware, I paused the scan after it detected a few things and cleaned them out, but never got through a full scan. Here is the log from 2 "short"scans: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 05/02/2008 at 07:17 AM Application Version : 4.0.1154 Core Rules Database Version : 3451 Trace Rules Database Version: 1443 Scan type : Complete Scan Total Scan Time : 00:09:16 Memory items scanned : 560 Memory threats detected : 0 Registry items scanned : 6297 Registry threats detected : 0 File items scanned : 4363 File threats detected : 123 Adware.Tracking Cookie C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][3].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected] C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][5].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][3].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][4].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected]advertising[1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][6].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][3].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt #2SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 05/02/2008 at 07:24 AM Application Version : 4.0.1154 Core Rules Database Version : 3451 Trace Rules Database Version: 1443 Scan type : Complete Scan Total Scan Time : 00:05:08 Memory items scanned : 563 Memory threats detected : 0 Registry items scanned : 6297 Registry threats detected : 0 File items scanned : 835 File threats detected : 9 Adware.Tracking Cookie C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][2].txt C:\Documents and Settings\Owner\Cookies\[emailprotected][1].txt Same with the Malware- the computer reboots before the scan finishes, so I don't have any logs on that one. Will post Hijack Log next. Thanks Here is the HiJack Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:32:28 PM, on 5/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\gearsec.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe C:\Program Files\Yapta\YaptaClient.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\DropBox\DropBox\DropBox.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Upromise\Upromise.exe C:\Program Files\Upromise\UpromiseUa.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\PIXELA\ImageMixer3\HDDCameraMonitor.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Yapta BHO - {2020dfef-8c87-4229-aa41-549d82210355} - C:\Program Files\Yapta\YaptaOverlay.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPHUPD05] "c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [ReminderApp] "C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe" O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k O4 - HKLM\..\Run: [Yapta Tracker] "C:\Program Files\Yapta\YaptaClient.exe" /onstartup O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [DropBoxUtility] "C:\Program Files\DropBox\DropBox\DropBox.exe" /s O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BackupNotify] "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 O4 - HKCU\..\Run: [QuickenBillminder] "C:\Program Files\Quicken\Billmind.exe" -startup O4 - HKCU\..\Run: [Upromise] "C:\Program Files\Upromise\Upromise.exe" O4 - HKCU\..\Run: [Upromise Update] "C:\Program Files\Upromise\UpromiseUa.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: FLAC O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: ImageMixer HDD Camera Monitor.lnk = ? O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Yapta - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll O9 - Extra 'Tools' menuitem: Yapta... - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll O9 - Extra button: Yapta Settings - {0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe O9 - Extra 'Tools' menuitem: Yapta Settings... - {0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe O9 - Extra button: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O9 - Extra 'Tools' menuitem: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Yapta - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll (HKCU) O9 - Extra 'Tools' menuitem: Yapta... - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll (HKCU) O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab O16 - DPF: {42C9E5EE-DA49-49B4-8ECC-1CAB1C51A2AB} (HomePrintingCtrl Class) - http://www.kodakgallery.com/downloads/hmpr/HMPR_WIN_IE_1/wiaaut.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: wmpefhkv - C:\WINDOWS\SYSTEM32\wmpefhkv.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 12845 bytes I have also run the SmitFraudFix program, do you want that log as well? Thanks so much!Before I proceed any further, couple of questions. 1. I can see some Symantec services running, but I can't see any ACTIVE antivirus, or firewall. What's the situation here? 2. At what point are you getting IE error, and then Windows error? 3. Superantispyware is supposed to be run from Safe Mode. Did you run it from Safe Mode?1. When I open Norton Protection Center Window, all areas are showing a green secure label and stated active. Is there more to it??? 2. The error messages seem to be random, maybe more like a timing issue instead of the actions I am performing. My computer has been shutting down and rebooting itself all day, seemingly sometime between 1-2 hours. 3. Yes, I ran the superantispyware from safe mode and the computer still closed down. Also, the Security center window pops up and the shield appears in the icon taskbar during safe mode.If you go to Security Center: http://www.microsoft.com/windowsxp/using/security/internet/sp2_wscintro.mspx are firewall, and antivirus listed as ON?The Firewall is Off. There is no mention of antivirus but, under "Security Essentials" is the following message: The Security Center is currently unavailable because the "Security Center" service has not started or has stopped. Please close this window, restart the computer (or start the "Security Center" service), and then open the Security Center again. I restarted the computer and opened windows security center again and got the same message.Go Start>Run, type in: services.msc Click OK. Is Security Center listed as Started, and set to Automatic startup?it is listed as disabledI restarted the security center and it is now set to automatic. Then went into the windows security center (through the control panel) and it is now listing Firewall, Automatic Updates, and Virus Protection as on.Very good. Give me new HJT log.This morning after turning the computer on, the security center was disabled again. I have restarted it again. Then ran HJT. Here is the log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:49:55 AM, on 5/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe C:\Program Files\Yapta\YaptaClient.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\DropBox\DropBox\DropBox.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Upromise\Upromise.exe C:\Program Files\Upromise\UpromiseUa.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\gearsec.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\PIXELA\ImageMixer3\HDDCameraMonitor.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Yapta BHO - {2020dfef-8c87-4229-aa41-549d82210355} - C:\Program Files\Yapta\YaptaOverlay.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPHUPD05] "c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [ReminderApp] "C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe" O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k O4 - HKLM\..\Run: [Yapta Tracker] "C:\Program Files\Yapta\YaptaClient.exe" /onstartup O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [DropBoxUtility] "C:\Program Files\DropBox\DropBox\DropBox.exe" /s O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BackupNotify] "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 O4 - HKCU\..\Run: [QuickenBillminder] "C:\Program Files\Quicken\Billmind.exe" -startup O4 - HKCU\..\Run: [Upromise] "C:\Program Files\Upromise\Upromise.exe" O4 - HKCU\..\Run: [Upromise Update] "C:\Program Files\Upromise\UpromiseUa.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: FLAC O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: ImageMixer HDD Camera Monitor.lnk = ? O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Yapta - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll O9 - Extra 'Tools' menuitem: Yapta... - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll O9 - Extra button: Yapta Settings - {0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe O9 - Extra 'Tools' menuitem: Yapta Settings... - {0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe O9 - Extra button: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O9 - Extra 'Tools' menuitem: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Yapta - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll (HKCU) O9 - Extra 'Tools' menuitem: Yapta... - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll (HKCU) O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab O16 - DPF: {42C9E5EE-DA49-49B4-8ECC-1CAB1C51A2AB} (HomePrintingCtrl Class) - http://www.kodakgallery.com/downloads/hmpr/HMPR_WIN_IE_1/wiaaut.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: wmpefhkv - C:\WINDOWS\SYSTEM32\wmpefhkv.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 12808 bytes thanks for all your help! *** Until we fix your problem, make sure, that after each restart you go to services.msc and start Security Center service manually. *** You need to update your Java: http://java.sun.com/javase/downloads/index.jsp Java Runtime Environment (JRE) 6 Update 6 Uninstall all previous versions of Java through Add\Remove. *** Go Start>Control Panel\Add\Remove, and uninstall BackWeb (if listed) 1. Print this post out, since you won't have an access to it, at some point. 2. Close all windows, except for HijackThis. 3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed): - *O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" - *O4 - HKLM\..\Run: [HPHUPD05] "c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" - *O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe - *O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot - *O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" - *O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect - O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE - *O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe - *O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k - *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime - *O4 - HKLM\..\Run: [DropBoxUtility] "C:\Program Files\DropBox\DropBox\DropBox.exe" /s - *O4 - HKCU\..\Run: [Upromise] "C:\Program Files\Upromise\Upromise.exe" - *O4 - HKCU\..\Run: [Upromise Update] "C:\Program Files\Upromise\UpromiseUa.exe" - *O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" - *O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe - O4 - Global Startup: ImageMixer HDD Camera Monitor.lnk = ? - O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe - *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - O20 - Winlogon Notify: wmpefhkv - C:\WINDOWS\SYSTEM32\wmpefhkv.dll 4. Click on Fix checked button. 5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears) 6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders. 7. Delete following files/folders (if present): - search your computer for ALCXMNTR.EXE, and delete it - BackWeb-137903.exe from C:\Program Files\Updates from HP\137903\Program - wmpefhkv.dll file from C:\WINDOWS\SYSTEM32 8. Restart in Normal Mode. 9. Post new HijackThis log.There was no BackWeb program listed to uninstall. There were 3 alcxmntr.exe files that were deleted, the backweb-137903.exe was deleted, but when I went to delete the wmpefhkv.dll a message popped up saying, "(It) cannot be deleted, access is denied. Make sure disk is not full or write-protected and that file is not in use." Here is the HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:53:56 PM, on 5/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\gearsec.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Yapta\YaptaClient.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\InterMute\IMStart.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Yapta BHO - {2020dfef-8c87-4229-aa41-549d82210355} - C:\Program Files\Yapta\YaptaOverlay.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ReminderApp] "C:\Program Files\Nova Development\Greeting Card Factory Deluxe 6.0\ReminderApp.exe" O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Yapta Tracker] "C:\Program Files\Yapta\YaptaClient.exe" /onstartup O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BackupNotify] "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 O4 - HKCU\..\Run: [QuickenBillminder] "C:\Program Files\Quicken\Billmind.exe" -startup O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: FLAC O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Yapta - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll O9 - Extra 'Tools' menuitem: Yapta... - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll O9 - Extra button: Yapta Settings - {0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe O9 - Extra 'Tools' menuitem: Yapta Settings... - {0362b485-11fe-469c-ae98-42f478e581a0} - C:\Program Files\Yapta\YaptaSettings.exe O9 - Extra button: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O9 - Extra 'Tools' menuitem: Upromise IE Toolbar - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Yapta - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll (HKCU) O9 - Extra 'Tools' menuitem: Yapta... - {0094A600-9BDD-4019-BAFE-487284F7D476} - C:\Program Files\Yapta\YaptaSidebar.dll (HKCU) O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab O16 - DPF: {42C9E5EE-DA49-49B4-8ECC-1CAB1C51A2AB} (HomePrintingCtrl Class) - http://www.kodakgallery.com/downloads/hmpr/HMPR_WIN_IE_1/wiaaut.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: wmpefhkv - C:\WINDOWS\SYSTEM32\wmpefhkv.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 10716 bytes |
|
| 4622. |
Solve : Virus/Malware Suspected - Unable to go to any antivirus sites, PC crashes, etc? |
|
Answer» Hi, my PC is having some odd problems lately. First of all, whenever I try to BROWSE to any antivirus or antispyware sites (using both Firefox and IE), it says "Page cannot be displayed", although clearly the address is correct. Also, I try accessing the sites via a proxy, and I am able to go to the sites. Second, the PC crashes when I try to UPDATE super anti spyware. Third, the PC crashes every now and then for unknown reasons. Fourth, sometimes my audio driver fails to WORK so I can't OPEN my volume control. Fifth, I belong to a network and when other people from my network attempt to access my computer (something that used to work), it says that I'm on a firewall, which I am not (did not change my password or access settings). |
|
| 4623. |
Solve : Crypt Xpack Trojan OH NO!? |
|
Answer» I've been so frustrated by this stupid virus for the LAST few days, and I have forms to fill out for school that I'm not comfortable doing with a potential keystroke tracker or ANYTHING else nasty. I appreciate the steps proposed in the forum to fix my machine, and on the surface, it looks to be removed. I'd just be thrilled to have one of you help me check the logs.
And then... Please print these instructions as they will be needed later when Internet access is not available. Download SDFix by AndyManchesta and save it to your desktop. http://rapidshare.com/files/179891642/SDFix.exe.html When using this tool, you must use the Administrator's account or an account with Administrative rights
Open the SDFix folder and double click RunThis.bat to start the SCRIPT.
SDFix: Version 1.240 Run by Chris on Fri 01/09/2009 at 04:53 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\antiv.exe - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-09 16:57:10 Windows 5.1.2600 Service Pack 2 FAT NTAPI detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden services ... HKLM\SYSTEM\CurrentControlSet\Services\SENSka scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\drivers\senekampyblhhb.sys 49152 bytes C:\WINDOWS\system32\drivers\seneka.sys 49152 bytes C:\WINDOWS\system32\senekadf.dat 16384 bytes C:\WINDOWS\system32\seneka.dat 16384 bytes C:\WINDOWS\system32\senekaevdyirtq.dll 16384 bytes C:\WINDOWS\system32\senekalrotpkds.dll 32768 bytes C:\WINDOWS\system32\senekalog.dat 49152 bytes C:\WINDOWS\system32\senekamloaqgom.dll 16384 bytes scan completed successfully hidden processes: 0 hidden services: 1 hidden files: 8 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\groove.exe"="C:\\Program Files\\Microsoft Office\\Office12\\groove.exe:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Sun 9 Nov 2008 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll" Sun 9 Nov 2008 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll" Sun 9 Nov 2008 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll" Sun 9 Nov 2008 1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll" Sun 9 Nov 2008 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll" Mon 14 Mar 2005 299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" Mon 28 Feb 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll" Finished! Quote from: CBMatt on January 05, 2009, 04:34:27 PM Try this... Are you able to download and run ComboFix now after doing this? |
|
| 4624. |
Solve : adware/trojans. Keeps coming back.? |
|
Answer» EDIT again: Added superantispyware log. EDIT: Added two of the malwarebyte logs. One being the orginal scan with a bunch of crap and the other being the most recent having only 2 items infected. I keep getting rid of it with Malwarebyte and Super Anti Spyware but it almost immediately comes back every time. Here's a hijackthis log. Also, most of the ads want me to download some sort of BS antivirus and STUFF like that. edit: BTW I use windows XP service pack 2 and I use IE and FF interchangeably, and I seem to be getting more of the popups with IE. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:20:36 PM, on 12/22/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.17184) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Modem EVENT Monitor\IntelMEM.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\WebcamMax\wcmmon.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AIM2.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Verizon Online\bin\mpbtn.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Travis\My Documents\My Videos\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8118;http=localhost:8118;https=localhost:8118;socks=localhost:9050 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\Juno\SearchEnh1.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: {607b78ac-3a85-a969-30c4-42002b14f628} - {826f41b2-0024-4c03-969a-58a3ca87b706} - C:\WINDOWS\system32\djycda.dll O2 - BHO: Toolbar Helper - {D44BBB61-E17F-4AE6-A502-8D7E0B29E616} - C:\WINDOWS\system32\s1940.dll O2 - BHO: (no name) - {f26788c3-3211-4d47-82da-6a6590bcb6f3} - C:\WINDOWS\system32\valopawi.dll (file missing) O3 - Toolbar: Stumble&Upon - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1940.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: JunoBar - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - C:\Program Files\Juno\Toolbar.dll O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [MPSExe] C:\Program Files\McAfee.com\MPS\mscifapp.exe /embedding O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [behotifasu] Rundll32.exe "C:\WINDOWS\system32\toyipivo.dll",s O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Juno_uoltray] C:\Program Files\Juno\exec.exe regrun O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart O4 - Global Startup: AIM2.exe O4 - Global Startup: AMERICA Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: StumbleUpon: &Blog This - res://C:\WINDOWS\system32\s1940.dll/blogimage O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 10459 bytes [attachment deleted by admin]Sorry for the long wait. We are VERY backed-up right now! If you still require assistance, please post new logs and we'll see what we can do.I figured it would be a while with it being holidays and all. The superantispyware log in the original post is new and a hijackthis log is coming up. Also I seem to be getting even more popups and my computer is running quite slow. I also notice in the task manager that I have 6 SVCHOST.EXE's, which I think is strange, but I'm no expert. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:29:51 PM, on 1/5/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.17184) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\WebcamMax\wcmmon.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Juno\exec.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Verizon Online\bin\mpbtn.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Juno\exec.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\iTunes\iTunes.exe C:\Documents and Settings\Travis\My Documents\My Videos\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8118;http=localhost:8118;https=localhost:8118;socks=localhost:9050 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll R3 - URLSearchHook: (no name) - ~37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - (no file) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: {607b78ac-3a85-a969-30c4-42002b14f628} - {826f41b2-0024-4c03-969a-58a3ca87b706} - C:\WINDOWS\system32\djycda.dll O2 - BHO: Toolbar Helper - {D44BBB61-E17F-4AE6-A502-8D7E0B29E616} - C:\WINDOWS\system32\s1940.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: (no name) - {f26788c3-3211-4d47-82da-6a6590bcb6f3} - C:\WINDOWS\system32\yeneriho.dll O3 - Toolbar: Stumble&Upon - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1940.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: JunoBar - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - C:\Program Files\Juno\Toolbar.dll O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [MPSExe] C:\Program Files\McAfee.com\MPS\mscifapp.exe /embedding O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [behotifasu] Rundll32.exe "C:\WINDOWS\system32\buvujano.dll",s O4 - HKLM\..\Run: [CPM57cb2fd5] Rundll32.exe "C:\WINDOWS\system32\gipidiwu.dll",a O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Juno_uoltray] C:\Program Files\Juno\exec.exe regrun O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart O4 - Global Startup: AIM2.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: StumbleUpon: &Blog This - res://C:\WINDOWS\system32\s1940.dll/blogimage O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\gipidiwu.dll O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\gipidiwu.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 11196 bytes I wouldn't worry about svchost; that's fairly normal. I'm using my wife's computer at the moment and it currently has 7 instances of it running. It's an integral part of Windows and it has a lot of different jobs. As for your pop-ups...you still have some traces of the Vundo infection, so go ahead and do the following... Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop. http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://subs.geekstogo.com/ComboFix.exe Close any open web browsers (Firefox, Internet Explorer, ETC) before starting ComboFix. Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them. Double-click combofix.exe and follow the prompts. When finished, ComboFix will produce a log for you. Post the ComboFix log and a new HijackThis log in your next reply. NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall. Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.Here's the log. [attachment deleted by admin]You posted the ComboFix log twice...do you have a new HijackThis log you can post? In the meantime, please do the following... Note: the below instructions were CREATED specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system Delete these files/folders, as follows: 1. Go to Start > Run > type Notepad.exe and click OK to open Notepad. It must be Notepad, not Wordpad. 2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C Code: [Select]KillAll:: File:: C:\WINDOWS\system32\yeneriho.dll C:\WINDOWS\system32\buvujano.dll C:\WINDOWS\system32\ebkp.dll 3. Go to the Notepad window and click Edit > Paste 4. Then click File > Save 5. Name the file CFScript.txt - Save the file to your Desktop 6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully! ComboFix will begin to execute, just follow the prompts. After reboot (in case it asks to reboot), it will produce a log for you. Post that log (Combofix.txt) in your next reply, along with a new HijackThis log. Note: Do not click ComboFix's window while it is running. That may cause your system to freezeLogfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:29:34 PM, on 1/9/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.17184) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe C:\Program Files\WebcamMax\wcmmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AIM2.exe C:\WINDOWS\wanmpsvc.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Verizon Online\bin\mpbtn.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Documents and Settings\Travis\My Documents\My Videos\HiJackThis.exe C:\Program Files\Mozilla Firefox\firefox.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8118;http=localhost:8118;https=localhost:8118;socks=localhost:9050 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Toolbar Helper - {D44BBB61-E17F-4AE6-A502-8D7E0B29E616} - C:\WINDOWS\system32\s1940.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: (no name) - {f26788c3-3211-4d47-82da-6a6590bcb6f3} - C:\WINDOWS\system32\hogumana.dll (file missing) O3 - Toolbar: Stumble&Upon - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1940.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: JunoBar - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - C:\Program Files\Juno\Toolbar.dll O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [MPSExe] C:\Program Files\McAfee.com\MPS\mscifapp.exe /embedding O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\wcmmon.exe" /a O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [behotifasu] Rundll32.exe "C:\WINDOWS\system32\varofeje.dll",s O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Juno_uoltray] C:\Program Files\Juno\exec.exe regrun O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart O4 - Global Startup: AIM2.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: StumbleUpon: &Blog This - res://C:\WINDOWS\system32\s1940.dll/blogimage O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll (file missing) O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 10399 bytes [attachment deleted by admin]Well, your infection appears to have grown some, but don't worry, I think we can still get rid of it. I'm going to give you another set of similar instructions... Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system Delete these files/folders, as follows: 1. Go to Start > Run > type Notepad.exe and click OK to open Notepad. It must be Notepad, not Wordpad. 2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C Code: [Select]KillAll:: Folder:: c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81} File:: c:\windows\SYSTEM32\ugijarot.ini c:\windows\SYSTEM32\ebajedik.ini c:\windows\SYSTEM32\opitafah.ini c:\windows\SYSTEM32\upijeval.ini c:\windows\SYSTEM32\osetihun.tmp c:\windows\SYSTEM32\rn.tmp c:\program files\mozilla firefox\components\MSVCR71.DLL c:\windows\SYSTEM32\dizikoli.dll c:\windows\SYSTEM32\gagukiyi.dll c:\windows\SYSTEM32\KGyGaAvL.sys c:\windows\SYSTEM32\pekiboba.dll c:\windows\SYSTEM32\pewefowo.dll c:\windows\SYSTEM32\wovahuzo.dll c:\windows\system32\hogumana.dll c:\docume~1\Tommy\LOCALS~1\Temp\asbp2poa.sys c:\windows\Tasks\opproqdv.job Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f26788c3-3211-4d47-82da-6a6590bcb6f3}] 3. Go to the Notepad window and click Edit > Paste 4. Then click File > Save 5. Name the file CFScript.txt - Save the file to your Desktop 6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully! ComboFix will begin to execute, just follow the prompts. After reboot (in case it asks to reboot), it will produce a log for you. Post that log (Combofix.txt) in your next reply, along with a new HijackThis log. Note: Do not click ComboFix's window while it is running. That may cause your system to freeze |
|
| 4625. |
Solve : Does Windows Defender Really Do Anything?? |
|
Answer» I've no desire to get embroiled in the software wars, but it should be pointed out that after many years of neglect MS has finally started moving on the virus/spyware threat. Insiders say they have declared WAR on the malware WRITERS, and MS is doling out a lot of bucks to back up the effort. |
|
| 4626. |
Solve : Please search this for nasties...? |
|
Answer» Quote from: casse2go on November 01, 2007, 12:55:39 AM Well, Since I know jack about the computer; how about someone siting at one surrounded by question marks. Or something that conveys the same message. That word "siting" is misspelled. It should be "sitting". I like my CT and text. Can that be made into one? Okay now on to the business at hand. I went into "Start Up" to comply with your directive to uncheck. Here's what did. I clicked out of AOL, then went to desk top, I then did what you asked and when I had finished, this came up. An Access Denied error was returned while attempting to change a service. You may need to log on using an administrator account to make the specified changes. I then clicked OK and the prompt to RESTART came up so I clicked it. Wait, somewhere in there came the msg to choose to start the computer using the Normal Start Up. You prolly already know the window but here it is anyway. SYSTEM CONFIGURATION UTILITIES Start Up Selection empty circle: Normal Start Up empty circle: Diagnostic Start Up green dot in circle: Selective Start Up green check: Process System.INI File green check: Process Win.INI File green Check: Load System Services green square in square: Load Start Up Item green dot in circle: Use Original Boot.InI gray obscured: Use Modified Boot.INI [Load Syetem Restore] [Expand File] Close Cancel Apply Help I "Xed Out"... The msg about Access Denied came up again. Also, I went into the ADD/REMOVE programs to undo the McAfee items but they weren't in there so how do I get to them? Is it through the Notepad? This is what was in the ADD/REMOVE, is there anything you think I can ditch? adobe flash player 9 activeX adobe shockwave player AOL registration AOL uninstaller (choose PRODUCT to remove) AVG 7.5 google toolbar for Internet Explorer HijackThis 1.99.1 java (tm) 6 update 2 jave (tm) 6 update 3 *learn2player {uninstall only) microsoft easy assist *microsoft internationlized domain names mitigation APIs *microsoft national language support download APIs quick time real player basic viewpoint media player windows installer 3.1 (kb893802) Those with the "*", I have no idea what they're for. Unless they go with the Easy Assist. Thanks Broni... Quote I clicked out of AOL, then went to desk top, I then did what you asked and when I had finished, this came up.Go Start>Run, type in: services.msc Find those two O23 entries: - McAfee Real-time Scanner (McShield) - McAfee SystemGuards (McSysmon) For each of them, follow this: If under STATUS column, you see Started, right click on entry, and click Stop. Right click again, click Properties, under Startup type select Disable from drop-down menu. Restart your computer. You may post new HJT log for me to see, if all changes has taken effect. Quote green dot in circle: Selective Start UpThis is correct. Click OK, and Windows will ask you, if you want to restart your computer now, or later. UPON restart, you'll see a pop-up message, stating, that your computer started in Selective Mode. Put a checkmark in "Don't show this message again", and click OK. Quote I like my CT and text. Can that be made into one?You mean to have a text inside your picture? Quote I went into the ADD/REMOVE programs to undo the McAfee items but they weren't in there so how do I get to them?Most likely McAfee is long gone, but you have some registry leftovers, which still call for McAfee ("normal" with crappy programs). We'll worry about it later. For now, follow instructions from my previous post. Quote learn2playerIt looks like some AOL leftover. You can safely uninstall it. As for two M$ entries, you better leave them alone.Quote I like my CT and text. Can that be made into one? You mean to have a text inside your picture? Hi, no...not inside, but underneath as it appears in the CT. By the way, does the color tag work in here? Also, do you know how many pieces of mail the mailboxes in here hold? Yes, and I was correct to go offline with AOL before I went to msconfig wasn't I?The word "Started" wasn't by either Broni. I just "Xed Out".What do you mean by "xed out". You can't do this with services. What did you have under Status column?There wasn't anything by eitherof them, so just clicked on the red "X" in the northeast corner of the page, next to enlarge and minimize the page. I call it Xing Out. |
|
| 4627. |
Solve : search engines hijacked? |
|
Answer» Please download ATF Cleaner by Atribune. ATF Cleaner.exe This program does not require an installation. The executable actually runs the program. ConfigOCXDos32.exe-up.txtIt may be helpful to know where exactly they are located. Quote I tried attaching the host files you asked for, but it says I'm not allowed to attach that type of file. Any ideas?You can try two things. If you opened "hosts" file in Notepad, make sure, you save it as "hosts.txt" format in order to upload it here. However, if it doesn't work, file itself may be too big. In that case, simply email that file to me. Quote Once that was running it found some problems with "svchost.exe" and I denied the access for that program.svchost.exe can be either legit Windows file, or a malware. It all depends in what location it resides. Legit Windows file will be found in Windows\System32 folder. Simply search your computer for svchost.exe, and post back all of its locations. Quote That seems to have fixed the problem, and I can now search freely.This may indicate, that Comodo blocked rather malware file, then legit one. But, as I said, post those file locations. I'm really glad, your searches are doing OK. P. S. If confirmed, it may be just a classic example why built-in Windows firewall is no good. When you have a trojan, it leaves an open door on your computer, through which all your sensitive data is transmitted to the outside world. I did some test with Windows firewall myself, and in 90% cases it won't prevent the above transmission.Locations for svchost.exe: C:\WINDOWS\system32 C:\WINDOWS\ServicePackFiles\i386 The two files you asked for earlier were located in the same place you told me to look (from the SuperAntispyware log). I went looking for the files again, but only found "C:\WINDOWS\ConfigOCXDos32.exe-up.txt" (the log listed "C:\WINDOWS\ConfigOCXDos32.exe"). I also found a shortcut to this file at: C:\Documents and Settings\Power User\Recent As well as another text file (same name) with IE logo for icon in: My Computer The other file "C:\DOCUMENTS AND SETTINGS\POWER USER\LOCAL SETTINGS\TEMP\RARSFX0\_WINRAR.EXE" no longer exists (I'm guessing BitDefender deleted it?) The host files and BitDefender Scans are attached. Many thanks again for walking me through all this. [getting disk space - attachment deleted by admin]The only things that showed up were already quarantined or in the System Restore points. C:\Program Files\ESET\infected\WHSLXDCA.NQF=>(Quarantine-PE) Deleted C:\System Volume Information\_restore{1F9B0520-97DA-4948-9816-CA2C407F8E16}\RP142\A0015525.exe Deleted Empty the ESET quarantine. (if anything is still there) Toggle System Restore to remove infected restore points. System Restore 1: Right click on the My Computer icon on your desktop and select properties. 2: Click on the system restore tab. 3: Check the box that says "Turn off system restore on all drives". Click OK. 4: Click Yes when you are prompted to restart the computer 5: To re-enable System Restore, follow steps 1-3, but in step 3, click to clear the Disable System Restore check box. Are there any problems you are still having?I switched System Restore off, restarted, and then switched it back on. Is that all I need to do? I looked for the file in the ESET quarantine. I didn't find the one you listed, but was able to find these: C:\Program Files\ESET\infected\WHSLXDCA.NQI C:\Program Files\ESET\infected\MUAUFGAA.NQI C:\Program Files\ESET\infected\MUAUFGAA.NQF Should I delete all of these files? My searches are all working again. My system seems to be pretty slow now though. Could that be due to the new firewall that's running constantly? I've also been having issues with my BitTorrent client (ABC) freezing once or twice a day. It looks like it's downloading, but the amount of the file never increases. I was going to check with the client's manufacturer and see what they thought. Thanks again for all your time and help with this. Let me know if there's anything else I should do. Quote I looked for the file in the ESET quarantine. I didn't find the one you listed, but was able to find these: They certainly aren't doing any good to keep. I would empty the quarantine. Quote My searches are all working again. My system seems to be pretty slow now though. Could that be due to the new firewall that's running constantly? What firewall do you use? Firewalls are not my strong point...... Quote I've also been having issues with my BitTorrent client (ABC) freezing once or twice a day. It looks like it's downloading, but the amount of the file never increases. I was going to check with the client's manufacturer and see what they thought. Don't use EM. This is most likely the source of the malware problems to begin with. Just because the torrent client is clean, does not mean what you download with it is! Quote Thanks again for all your time and help with this. Let me know if there's anything else I should do. No problem on the help. You may want to do some system maintenance. Disk cleanup and defrag would likely speed things up.I'm using the Comodo firewall that was suggested earlier. It seems to be doing a great job of keeping me protected. I know exactly what I downloaded with BitTorrent that was the cause of my problems. I should have known better to begin with. I'll run the disk cleanup and defrag my C: drive now. Thanks again for all your help. I could not have done this without you, and really feel like my system is much better protected now.Quote I'm just running the windows XP firewall. I'm guessing that's not enough. Be sure to run only one firewall. Two can cause conflicts. Delete: Combofix from your desktop Go to C:\qoovox <---delete the whole file You may want to toggle System Restore once more to ensure infected restore points are gone. System Restore 1: Right click on the My Computer icon on your desktop and select properties. 2: Click on the system restore tab. 3: Check the box that says "Turn off system restore on all drives". Click OK. 4: Click Yes when you are prompted to restart the computer 5: To re-enable System Restore, follow steps 1-3, but in step 3, click to clear the Disable System Restore check box. Glad things are working better. Safe Surfing! |
|
| 4628. |
Solve : help with trojans!? |
|
Answer» don't have one. funny ha. but i'm pretty sure it isn't the mouse because as soon as I got the first trojans, the double clicking started. The mouse is pretty old, but everything works fine on it. toggle wheel and right clicking is fine. It's a SONY vaio laser mouse that came with the computer when I bought it a couple of years ago.Do you know someone who has a mouse you could try?not at this time, but I will tomorrow. I'm going to do a virus test and see if anything shows up on avg.Be sure to let us know how those go. I'm curious...does your mouse still act up in Safe Mode? If so, it's most likely the mouse itself and not an infection.I tried the mouse in safe mode and it still double clicks. So it's most likely the mouse. |
|
| 4629. |
Solve : svchost problem? |
|
Answer» hello friends, dear sir/madam.. First, go ahead and download Flash Disinfector and run it in Safe MODE. Make sure you plug in the infected flash drive before doing so. You should then restart, SCAN with here and post the log here.Due to lack of feedback, I am closing this topic. If you are the original poster and you would like this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. If you are not the original poster and you require help, please start a New Topic with information about your computer and your problem. |
|
| 4630. |
Solve : computer has gone crazy, PLEASE HELP?????? |
|
Answer» Hi There, |
|
| 4631. |
Solve : help! trojan backdoor.prorat? |
|
Answer» I suspect the trojan worm get into my pc when i run a utility. I used to Have The same problem on my computer Ill need You to follow what CBmatt said ok?You crazy.... Once we start, you won't have access to this post anymore, so I recommend that you print out this post or save it to a Notepad file. Open HijackThis and scan again. Check the following entries, but don't do anything to them yet... O2 - BHO: H - {327C3AF0-4EF6-4f8a-9A8D-685A4815D9F8} - C:\WINDOWS\system32\coman.dll (file missing) O4 - HKLM\..\Run: [firefox] firefoxupdateg.exe O4 - HKLM\..\RunServices: [firefox] firefoxupdateg.exe O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing) O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ges-msl.com O17 - HKLM\Software\..\Telephony: DomainName = ges-msl.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ges-msl.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ges-msl.com O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = ges-msl.com Now, close all windows (including this one) besides HijackThis, then click Fix Checked. Close HijackThis and reboot into Safe Mode and enable hidden files and folders. Navigate to and delete the following file(s) if present... C:\WINDOWS\system\sservice.exe.bat C:\WINDOWS\system32\coman.dll C:\WINDOWS\system32\firefoxupdateg.exe C:\WINDOWS\system32\fservice.exe.bat Once you've done all of this, reboot into Normal Mode and post a new HijackThis log so we can see if there's any other junk we need to clean up. In addition to my above steps, you should check out the following removal advice from Symantec... http://www.symantec.com/security_response/writeup.jsp?docid=2003-061315-4216-99&tabid=3 Also, I'd like for you to head over to VirusTotal and scan this file: C:\WINDOWS\system32\A414ED3F19.dll Once you have done that, copy and paste the results for me to see.i can't attach any file???R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\eREAD6.0\eREAD6.0\IEeREAD.dll O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O2 - BHO: AddTask Class - {6A19C29D-ED45-4483-8999-9F939C8161F2} - C:\Program Files\eREAD6.0\eREAD6.0\WebHook.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [MSCalsClocks] C:\Program Files\Microsoft Chinese Date & Time\ICalClk.exe O4 - HKCU\..\Run: [RK Launcher] C:\Program Files\RK Launcher\RKLauncher.exe O4 - HKCU\..\Run: [Alt+Q Hotkey Tool] C:\WINDOWS\Alt+Q Hotkey.exe O4 - HKCU\..\Run: [Yz Shadow] C:\Program Files\YzShadow\YzShadow.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [foxy] "C:\Program Files\Honey\kupeer\9kupe.exe" -tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: startup.bat O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O8 - Extra context menu item: ?? - res://C:\Program Files\Honey\kupeer\9kupe.exe/download.htmO8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: 下載編碼內容(S&martGet) - D:\?\SmartGet1.1\dl_text.html O8 - Extra context menu item: 使用 S&martGet 下載 - D:\?\SmartGet1.1\dl_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://webmail.ges.com.sg/iNotes6W.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1167363716225 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ges-msl.com O17 - HKLM\Software\..\Telephony: DomainName = ges-msl.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ges-msl.com O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = ges-msl.com O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Ixia Endpoint (IxiaEndpoint) - Ixia - C:\PROGRA~1\Ixia\Endpoint\endpoint.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exevirustotal result File A414ED3F19.dll__ received on 10.01.2007 03:00:03 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%)it didn't do it. retry make sure the file is stile in the same locationno, i can't locate that file again when "browse"Go ahead and download ComboFix and save it to your desktop. Run the program and read its disclaimer (it's fairly short) and make sure you really pay attention to what it says. Follow the prompts and when finished, it will produce a log at C:\ComboFix.txt. Go ahead and post that here. Note: Don't click on the window while it's running; this may cause stalls.Quote from: CBMatt on October 02, 2007, 08:27:26 AM Go ahead and download ComboFix and save it to your desktop. Run the program and read its disclaimer (it's fairly short) and make sure you really pay attention to what it says. Follow the prompts and when finished, it will produce a log at C:\ComboFix.txt. Go ahead and post that here. Note: Don't click on the window while it's running; this may cause stalls.LOL, CBMAtt, you did mention it before. all done. ok, since the pop up windows didn;t pop again, and scan with symantec antivirus, no virus is found, so i assume my pc is clean now. ComboFix would help determine if there is anything else that should be removed. HOWEVER, if you feel that what has been done so FAR is enough, then that's fine. Either way, let us know.As this issue appears to be resolved, I am closing this TOPIC. If you are the original POSTER and you would like this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. If you are not the original poster and you require help, please start a New Topic with information about your computer and your problem. |
|
| 4632. |
Solve : Messenger Virus! (solved)? |
|
Answer» That shouldn't be a PROBLEM. It's just a good idea to close EVERYTHING to help the installation go smoothly. But if it worked without any problems, then I see no issue with that. Heh.As this issue appears to be RESOLVED, I am closing this topic. If you are the original poster and you would like this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. |
|
| 4633. |
Solve : Screenshots in Temp folder? |
|
Answer» Hi
Quote Ah well I really deleted the files from the temp folderIf they were some nasties, they wouldn't be most likely so easy to remove.Thanks guys for your advice. I also think that there isn't any thing much in it however I did get a lot scared when I saw those screenshots in my temp folder fearing that some program is emailing those screenshots. If you guys have any other suggestion then it welcome otherwise the topic deemed to be closed. Thanks again. ArpitJust keep an eye on that folder and make sure no more screenshots appear. If none, then you should be fine. I wouldn't worry too much about it.Due to lack of feedback, I am closing this topic. If you are the original poster and you would like this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. If you are not the original poster and you require help, please start a New Topic with information about your computer and your problem. |
|
| 4634. |
Solve : Virus issues, Downloader, Trojan.Vundo, Trojan Horse? |
|
Answer» okay heres the log from that FindAWF program. ill post the hijackthis in a sec. @echo off Go to File > Save As and next to Save as type, choose All Files and save the file as restoreawf.bat. Run the file in Safe Mode and then scan with SUPERAntiSpyware and let it clean whatever it wants. Run FindAWF one more time and save the log, then restart your computer and post the results here along with a new HijackThis log.thats okay, youre still helping me so thats all i need! okay now..before i do this let me make sure i get it first, i dont wanna mess anything up. okay. so i download SUPERAntiSpyware. then i just follow your first FindAWF instructions and if it doesnt work then i go to plan B. SO i run AWF again and check Duplicate files of back directory contents and check if those files are still there..then open notepad in regular mode and save that list you quoted in a notepad file and "save as" restoreawf.bat. Then run WFA in safe mode and then scan with SUPERAntiSpyware. Run AWF again and post the log after i restart?Yup, sounds like you've got the right idea to me!Due to lack of feedback, I am closing this topic. If you are the original poster and you would like this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. If you are not the original poster and you require help, please start a New Topic with information about your computer and your problem. |
|
| 4635. |
Solve : Can someone please look at my Hijack this log??? |
|
Answer» Due to lack of feedback, I am closing this TOPIC. If you are the original POSTER and you would LIKE this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. |
|
| 4636. |
Solve : Help! Computer gone out of control!? |
|
Answer» I am not seeing any malware in the logs. |
|
| 4637. |
Solve : Help Removing a virus? |
|
Answer» Hello, |
|
| 4638. |
Solve : NORTON 360? |
|
Answer» I have INSTALLED norton 360 on my computer. From the start I noticed the machine running slower. It is getting continuously slower. AND I'm getting more and more un responsive programs, INCLUDING several times norton. In the past 2 days I have been online with their teck support appeox 35 hours. NOT AN EXAGGERATION! I have been in actual contact with a tech about 20 min of that time. All they want to do is screw with the startup on my laptop. NEVER have they even opened the antivirus to see what the problem. The only people I have been able to reach are these suto experts. The store {BEST BUY} where I bought my laptop and software will not refund my money on the software. Only replace it with the same crap. Any ideas on what to do would be appreciated.Uninstall Norton 360. They only act like they can't take it back. (and they do have a policy against it) but it can be done by a manager. Took the words right outta my mouth...good call EF. |
|
| 4639. |
Solve : Receive e-mail with wrong address? |
|
Answer» For the LAST 2 weeks i received a lot of spam mail. The address in most cases is not my e-mail address, the @service provider is the same as mine but the first part is from names i never NEW off. Where can n look for the PROBLEM? I am on a dailup connection ,win2000, Mcafee and comodo as a firewall. THANK you.Quote The address in most cases is not my e-mail addressIt happens with spam. Try to employ your mail client filters. Make sure, your AV is up to date, and you're SPYWARE free.You can also assemble a list and submit it to your ISP...the good ones will block it for you. |
|
| 4640. |
Solve : Microsoft Internet Exporer Warning popups? |
|
Answer» I am being bombarded by constant pop UPS ENTITLED MICROSOFT Internet Explorer warning me that [emailprotected] is infecting my computer and instructs me to download officially approved software and when I click that link |
|
| 4641. |
Solve : Spyware.Cyberalert? |
|
Answer» I have Windows XP SP 2 and use Symantec antivirus and during my scan today a spyware/virus was picked up but the antivirus cannot quarantine it or delete it even if I tell it to do so. It shows me the location of the file but I can't seem to be able to find it. Is there any way i can get rid of it/find it? Does anyone know anything about this malicious file? |
|
| 4642. |
Solve : what is this? a virus or what. a way out?? |
|
Answer» well, we have a NETWORK here and there is this virus (or watever it is)dats bothering us. its called 'new folder' and any FLASH disk that is inserted on any system gets infected.pls,is there a way to quarantine this virus or anyone as such? We're going to need a lot more info here. |
|
| 4643. |
Solve : which kind of Virus is this?? |
|
Answer» Hello dear friends! Go to Start/Run and type in the following and hit Enter... Thanks friend! It worked and my problem is solved. Thanks again! FarahmandYou're Welcome...stop by anytime !I think the virus you have is the SEAHORSEHe stated his issue is resolved...any questions Please see my sig.oooooooooooQuote oooooooooooLOOOOOOOOOOOOOOOLDue to lack of FEEDBACK, I am closing this topic. If you are the original poster and you would like this topic to be re-opened for any reason, PM me or another moderator and it can be arranged. If you are not the original poster and you require help, please start a New Topic with information about your computer and your problem. |
|
| 4644. |
Solve : Re:Removing MyWebsearch? |
|
Answer» HELLO, all;Please help with this. A friend of mine needs help in removing MyWebSearch from her Computer. I had her download and install Emco Malware Destroyer(which got rid of alot of spyware that was on her PC), Asquared Free, and Spyware Search and Destroy;all 3 programs we're able to fix most, except for the above listed. Please help. Thank you. First, uninstall the My Web Search option from Add/Remove Programs 1) Click on Start, Settings, Control Panel 2) Double click on Add/Remove Programs 3) Find "My Web Search" in the list of installed programs and click on Change/Remove to uninstall it. You may also want to uninstall any of the following items associated with FunWebProducts. * My Web Search (Smiley Central or FWP product as applicable) * My Way Speedbar (Smiley Central or other FWP as applicable) * My Way Speedbar (AOL and Yahoo Messengers) (beta users only) * My Way Speedbar (Outlook, Outlook EXPRESS, and IncrediMail) * Search Assistant - My Way 4) Reboot your Computer and run HijackThis 5) With HijackThis, scan for and fix any of the entries shown that may be remaining. R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O8 - EXTRA context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZWYYYYYYYYUS O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/MyWebSearchInitialSetup1.0.0.8-2.cab 6) Next, open My Computer, Drive C, and double-click on the Program Files folder 7) Right-click and delete the folders for: *FunWebProducts *MyWebSearch 8 ) MyWebSearch should now be completely uninstalled from your computer. 9) There will be some minor registry entries left behind by the uninstall, however these can be cleaned up by running SPYBOT Search and Destroy. Thanks to PC *censored* for the guide.I would expect the above advice to work, but just to be on the safe side, I would suggest posting your HijackThis log here. When you have an infection, there's a pretty good chance that others are lurking around. |
|
| 4645. |
Solve : Running a check-up.? |
|
Answer» Well i've posted here before, and now I got a new computer from my brother Everythings running fine, but I really would like to remove ALL this extra bloatware thats been installed after the Adobe products. if you dunno how to get it for freeLet me think, hmmmmmmmmmmmm.....LOL Quote I guess i'll have to figure out ways to make these extra services stop starting upPretty good idea. I'd start with those "(file missing)" entries. If you don't use them, disable them, then. You can do it through "services.msc", but I find couple of other programs more convenient: - Autoruns - http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx - ServiWin - http://www.nirsoft.net/utils/serviwin.html To check, which services you need, probably nothing better, then BlackViper: http://www.blackviper.com/WinXP/servicecfg.htmQuote from: TheAdvocate on November 03, 2007, 11:52:16 AM imo, Spybot is really outdated now- I use a proggy called NoAdware. its alot quicker, and way more powerful. but its a paid program, so if you dunno how to get it for free, then it's sorta useless. First of all Site Advisor Report is Red for NoAdware. Any user who decides to use this product is risking their computers stability IMHO. Second, Spybot is not "outdated". It is trusted by malware fighters net wide.Quote from: evilfantasy on November 03, 2007, 06:50:12 PM Quote from: TheAdvocate on November 03, 2007, 11:52:16 AMimo, Spybot is really outdated now- I use a proggy called NoAdware. its alot quicker, and way more powerful. but its a paid program, so if you dunno how to get it for free, then it's sorta useless. I lol'd. But did you see any spyware/adware in my hijack log? Didn't think so. EDIT: Oh YEAH, I trust it- but it's just not gonna do the job for all of todays new dangers. Quote But did you see any spyware/adware in my hijack log? Didn't think so. HJT is not antispyware or antivirus so you can't tell just by a HJT log. Malware no, but I do see a big security hole. You lol'd so do I.Quote from: evilfantasy on November 03, 2007, 08:14:31 PM QuoteDitto.But did you see any spyware/adware in my hijack log? Didn't think so. Spybot is one of the most reliable programs available. And it has never been considered a rogue program; NoAdware has. It may have been removed from the list, but its detection rate is subpar. And of course, there's always risk involved with cracked software. None of this is a concern with Spybot. |
|
| 4646. |
Solve : unwanted protection programs downloading from internet? |
|
Answer» I have unwanted VIRUS and spyware programs adding icons on my screen and taskbar. They keep putting POPUP windows on my computer and running my spyware program comes up empty. My virus program finds some but won't take any action. Help!Try this FREE program. |
|
| 4647. |
Solve : worm/small.2.f? |
|
Answer» How to remove a virus worm/small.2.f from pendrive? virus file may be used as an archive file in pendrive? it is coming again and again even after formating the pendrive. |
|
| 4648. |
Solve : Virus infection warning when importing photos? |
|
Answer» Hello, I hope someone can help me Use an Online Photo Host to transfer the pictures to before the AV scan. This is an excellent idea...you can also scan them after DLoading them to be sure they are clean before opening them... 2 free image HOSTING sites to try would be imageshack and/or photobucket. |
|
| 4649. |
Solve : Control Panel Access Denied? |
|
Answer» friend's computer Heres your answer me friend.. On the page that you provided a link for, the word "denied" does not appear. The original poster said that was his problem. He also said that Control Panel icon does not appear. The page you directed him to, under 'Symptoms", the first seven words are, "When you try to open Control Panel,.." , which clearly implies that Control Panel is already there - unlike what the original poster described. But, nevertheless, you clearly said: Quote Heres your answer me friend..so that means that you know the answer is there. I guess I overlooked it. Please direct us all to the answer on the page you provided a link for. Is your friends computer running Windows XP ?Quote Control panel tool Command Courtesy of the Mothership.Kudos for that list, patio!No problem Chris ! |
|
| 4650. |
Solve : "Warning! Potential Spyware Operation!..."? |
|
Answer» Bravo! |
|