jatsjk
Topic Starter
hi
I am having serious problems with my PC at the moment. I have installed and purchased many spware,adware,trojan,bot and worm removal tools,scanners, etc and it finds problems every time, says it deletes them, but then another virus appears. Norton's advises me of the viruses..many of them being W32 sillywormP2p,W32 spybot (which i purchased a product by the name of scan spyware which guarenteed to clean the virus) and a big problem i have is when i scan the computer it tells me i have these RegKey's by grokster(?) located in HKEY local machine..i dont even know what this means. I have looked on symnatec for answers and i cannot find any!! Lastly i have this stupid mIRC screen that appears every time i start the computer. I attempted to delete the program and when i did it brought up system32 with this weird folder containing files I could not open. I attempted to delete it following instructions from a site and I got nowhere… I didnt even download mIRC, and have no clue of it's use and why its there. I get funny little messages every now and then about some shell port not running..Im not the best with computer talk so I hope whoever reads this can help me out here….
Logfile of HijackThis v1.99.1
Scan saved at 3:08:52 AM, on 3/5/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Vet\isafe.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\System32\msjvm.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\System32\msnplus.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Winferno\Secure IE\SIEPulse.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Vet\VetTray.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\NavNT\VPC32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SuperBar - {79EC5E6F-B2F3-4048-A4AE-87FB9F9908E4} - C:\Program Files\_SUPERBAR\_SUPERBAR.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\Run: [Microsoft Security] winService.exe
O4 - HKLM\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SIE2004] "C:\Program Files\Winferno\Secure IE\SIEPulse.exe"
O4 - HKLM\..\Run: [ser] C:\WINDOWS\System32\ocprt\targa5.exe
O4 - HKLM\..\Run: [windowsx] C:\WINDOWS\System32\iceep\vo.exe
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Hot_Tarts_Au] C:\Program Files\Video1\Dialers\Hot_Tarts_Au\Hot_Tarts_Au.exe /dontdial
O4 - HKLM\..\Run: [Virgins_au] C:\Program Files\Video1\Dialers\Virgins_au\Virgins_au.exe /dontdial
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [Msn Updater] msnplus.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\RunServices: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\RunServices: [Microsoft Security] winService.exe
O4 - HKLM\..\RunServices: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunServices: [Msn Updater] msnplus.exe
O4 - HKLM\..\RunOnce: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunOnce: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKCU\..\Run: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SpywareKilla] "C:\PROGRA~1\SPYWAR~2\SpywareKilla.exe" /s
O4 - HKCU\..\RunOnce: [Msn Updater] msnplus.exe
O4 - Global Startup: LimeWire 4.0.5 Pro.lnk = C:\Program Files\LimeWire\LimeWire 4.0.5 Pro\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.allgamesfree.com/gamefiles/rico…bGameLoader.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe
I notcied that theres even diallers for porn on this scan!! where the hell is it all coming from???????
HELP
I am having serious problems with my PC at the moment. I have installed and purchased many spware,adware,trojan,bot and worm removal tools,scanners, etc and it finds problems every time, says it deletes them, but then another virus appears. Norton's advises me of the viruses..many of them being W32 sillywormP2p,W32 spybot (which i purchased a product by the name of scan spyware which guarenteed to clean the virus) and a big problem i have is when i scan the computer it tells me i have these RegKey's by grokster(?) located in HKEY local machine..i dont even know what this means. I have looked on symnatec for answers and i cannot find any!! Lastly i have this stupid mIRC screen that appears every time i start the computer. I attempted to delete the program and when i did it brought up system32 with this weird folder containing files I could not open. I attempted to delete it following instructions from a site and I got nowhere… I didnt even download mIRC, and have no clue of it's use and why its there. I get funny little messages every now and then about some shell port not running..Im not the best with computer talk so I hope whoever reads this can help me out here….
Logfile of HijackThis v1.99.1
Scan saved at 3:08:52 AM, on 3/5/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Vet\isafe.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\System32\msjvm.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\System32\msnplus.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Winferno\Secure IE\SIEPulse.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Vet\VetTray.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\NavNT\VPC32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SuperBar - {79EC5E6F-B2F3-4048-A4AE-87FB9F9908E4} - C:\Program Files\_SUPERBAR\_SUPERBAR.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\Run: [Microsoft Security] winService.exe
O4 - HKLM\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SIE2004] "C:\Program Files\Winferno\Secure IE\SIEPulse.exe"
O4 - HKLM\..\Run: [ser] C:\WINDOWS\System32\ocprt\targa5.exe
O4 - HKLM\..\Run: [windowsx] C:\WINDOWS\System32\iceep\vo.exe
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Hot_Tarts_Au] C:\Program Files\Video1\Dialers\Hot_Tarts_Au\Hot_Tarts_Au.exe /dontdial
O4 - HKLM\..\Run: [Virgins_au] C:\Program Files\Video1\Dialers\Virgins_au\Virgins_au.exe /dontdial
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [Msn Updater] msnplus.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\RunServices: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\RunServices: [Microsoft Security] winService.exe
O4 - HKLM\..\RunServices: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunServices: [Msn Updater] msnplus.exe
O4 - HKLM\..\RunOnce: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunOnce: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKCU\..\Run: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SpywareKilla] "C:\PROGRA~1\SPYWAR~2\SpywareKilla.exe" /s
O4 - HKCU\..\RunOnce: [Msn Updater] msnplus.exe
O4 - Global Startup: LimeWire 4.0.5 Pro.lnk = C:\Program Files\LimeWire\LimeWire 4.0.5 Pro\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.allgamesfree.com/gamefiles/rico…bGameLoader.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe
I notcied that theres even diallers for porn on this scan!! where the hell is it all coming from???????
HELP