What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please Assist: trojan.adh2 on Win7 [Closed]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Ken, Like I said, the restore point is way back in February of 2012. Was there any indication as to where this thing is hiding? I would very much appreciate another set of eyes looking at this. Also, as we go through the steps would you tell me what we are doing so that I might learn something? Thank you, very much!! Steve :clap: :clap: :clap: :clap:
Post #32
Steve,

This could be a false positive
https://www.symantec.com/security_response/…-99&tabid=2

From another expert
Problem here is the screenshot your User posted does not specify what file is causing Norton to flag, all we know is it is a heuristic detection of some unknown file or process.

My inclination would be to tell him to contact Norton and let them sort this out.


Run these please

Download CKScanner by askey127 from Here & save it to your Desktop.
  • Doubleclick CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Please Run this program only once
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply



Please run the MGA Diagnostic Tool and post back the report it creates:
  • Download MGADiag to your desktop.
  • Double-click on MGADiag.exe to launch the program
  • Click "Continue"
  • Ensure that the "Windows" tab is selected (it should be by default).
  • Click the "Copy" button to copy the MGA Diagnostic Report to the Windows clipboard.
  • Paste the MGA Diagnostic Report back here in your next reply.
Post #33
Ken,

Any and all education will be appreciated.
Steve

:pullhair: :pullhair:


CKScanner 2.1 - Additional Security Risks - These are not necessarily bad
c:\users\sadair\saved games\suse11\boot\x86_64\cracklib-dict-full.rpm
c:\users\sadair\saved games\suse11\suse\x86_64\cracklib-2.8.12-56.6.x86_64.rpm
c:\users\sadair\saved games\suse11\suse\x86_64\cracklib-32bit-2.8.12-56.6.x86_64.rpm
c:\users\sadair\saved games\suse11\suse\x86_64\cracklib-dict-full-2.8.12-43.16.x86_64.rpm
scanner sequence 3.BB.11.JGLBUT
—– EOF —–


Diagnostic Report (1.9.0027.0):
—————————————–
Windows Validation Data–>

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-7XK69
Windows Product Key Hash: CopaSPuRMyrzCOOR7iPAMO6S36g=
Windows Product ID: 55041-148-0805654-86291
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {B7671131-11BB-42C6-9C8B-911716C18A76}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130104-1431
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data–>
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data–>
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data–>
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data–>
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data–>
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data–>

Other data–>
Office Details: {B7671131-11BB-42C6-9C8B-911716C18A76}1.9.0027.06.1.7601.2.00010100.1.0.048x64*****-*****-*****-*****-BBBBB55041-148-0805654-862916S-1-5-21-3496914623-1557097719-4188195215System manufacturerSystem Product NameAmerican Megatrends Inc.3503 20110413000000.000000+0009B7C3807018400F204090409Central Standard Time(GMT-06:00)03109

Spsys.log Content: 0x80070002

Licensing Data–>
Software licensing service version: 6.1.7601.17514

Name: Windows® 7, Professional edition
Description: Windows Operating System - Windows® 7, VOLUME_MAK channel
Activation ID: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 55041-00172-148-080565-03-1033-7600.0000-0222012
Installation ID: 002932653454380673252551615940651190072804682313748094
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7XK69
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/3/2013 7:16:34 PM

Windows Activation Technologies–>
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data–>
HWID Hash Current: MgAAAAEABAABAAEAAAACAAAAAQABAAEAHKL22BSNVPJEbw4/EDOix1h9Yj3O7gD7Qho=

OEM Activation 1.0 Data–>
N/A

OEM Activation 2.0 Data–>
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 041311 APIC1656
FACP 041311 FACP1656
SRAT AMD FAM_F_10
HPET 041311 OEMHPET
MCFG 041311 OEMMCFG
OEMB 041311 OEMB1656

Steve
Post #34 last edited
I think at this point you need to contact Symantec and explain the problem and lets see what they say. All other malware scanners and antivirus scanners are not finding it MAK (multiple activation key) license type As a home user can you explain this license type ?
Post #35
Ken, Do you mean the license for Norton? Sure, I have a laptop and a desktop and my wife has a lap top. When I find a 3 user package for little or nothing it is a no-brainer. Why, is that a problem? Thank you, Steve :scratch:
Post #37
Right. I purchased a 3 PC license for Norton. I used one license on my laptop - Win XP. I used one license on my wife's laptop - Win XP. I used one license on my desktop - Win 7. Is there something odd, strange or wrong with doing that? Steve :scratch:
Post #38
Hello Steve, I am not concerned about Norton, the report from MGA Diagnostic Tool shows that you used MAK (multiple activation key) and the results from the scan may suggest that your Win 7 Operating System may not be legal. This was used when you installed Win 7 Windows License Type: Volume MAK
Post #43
Ken, The company that I work for pays for mine. With the subscription I have, I can get OSs, SQL Server, Visual Studio and a few more things. For more money, I could get Office, MapPoint, etc. Bottom line is, all it takes is money. I think that my subscription level is about $900/year. Steve

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI