What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Keyboard Vol. Control/ads

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I lost control of the hardware volume control on my keyboard for my speakers. I happened to notice there are three paths that obviously point to my keyboard. My questions are how do I know what to delete with ADS spy and could these ADS effect my keyboard? Are all these ADS bad or are some good or negligable? I have used ADS spy to remove what RAV scan pointed out as a trojan and didn't remove. Here is a ADS log: C:\WINDOWS\AolCInUn.exe : upetrr (7471 bytes) C:\WINDOWS\BOOTSTAT.DAT : rjddzv (9728 bytes) C:\WINDOWS\Capture : lvwxiz (7471 bytes) C:\WINDOWS\Capture : sgcgda (9728 bytes) C:\WINDOWS\CLOCK.AVI : pdeifs (9728 bytes) C:\WINDOWS\COM+.log : acupab (9728 bytes) C:\WINDOWS\COM+.log : evokcc (3567 bytes) C:\WINDOWS\DESKTOP.INI : irwlui (9728 bytes) C:\WINDOWS\DirectX.log : ejythu (3567 bytes) C:\WINDOWS\EXPLORER.SCF : fzmofk (9728 bytes) C:\WINDOWS\GatorPatch.log : aoqxf (29256 bytes) C:\WINDOWS\GatorPatch.log : ecdfzv (9728 bytes) C:\WINDOWS\Greenstone.bmp : stkpmr (9728 bytes) C:\WINDOWS\IIS6.LOG : onqrgt (9728 bytes) C:\WINDOWS\InfModM(4).ini : ffwena (9728 bytes) C:\WINDOWS\InfModM(4).ini : pylhr (95744 bytes) C:\WINDOWS\InfModM(4).ini : vwjmid (29256 bytes) C:\WINDOWS\IsUninst.exe : faipxo (11336 bytes) C:\WINDOWS\iun6002.exe : rvgwyk (9728 bytes) C:\WINDOWS\jptux.dat : bebdom (9728 bytes) C:\WINDOWS\jptux.dat : ghewan (9728 bytes) C:\WINDOWS\KB824141.log : waprhu (9728 bytes) C:\WINDOWS\KB825119.log : mpyry (29256 bytes) C:\WINDOWS\KB825119.log : tvwsqw (7471 bytes) C:\WINDOWS\KB828035.log : tteali (11736 bytes) C:\WINDOWS\KB828741.log : lwoxsy (3567 bytes) C:\WINDOWS\KB834707-IE6-20040929.115007.log : muxgol (7471 bytes) C:\WINDOWS\KB839643-DirectX9Uninst.log : evpliv (3567 bytes) C:\WINDOWS\KB887742.log : ifpjg (103566 bytes) C:\WINDOWS\MMKeybd.dll : yqzxof (9728 bytes) C:\WINDOWS\MMKeybd.exe.bak : moqpsk (9728 bytes) C:\WINDOWS\MMKEYBD.INI : nkkhsg (3567 bytes) C:\WINDOWS\MSDFMAP.INI : pndtej (9728 bytes) C:\WINDOWS\MSDFMAP.INI : szcbdo (11736 bytes) C:\WINDOWS\MSDFMAP.INI : ytzesy (9728 bytes) C:\WINDOWS\MSGSOCM.LOG : laoeru (9728 bytes) C:\WINDOWS\muninst.exe : bxjxqt (9728 bytes) C:\WINDOWS\muninst.exe : puugbd (3567 bytes) C:\WINDOWS\nsreg.dat : lsmgfz (7471 bytes) C:\WINDOWS\n_ctrueg.txt : dtfmzj (3567 bytes) C:\WINDOWS\n_ctrueg.txt : kszhd (103566 bytes) C:\WINDOWS\n_navlam.log : njmjhz (11336 bytes) C:\WINDOWS\OCMSN.LOG : xzbcqf (9728 bytes) C:\WINDOWS\ODBC.INI : wcgfi (95744 bytes) C:\WINDOWS\ODBC.INI : xkeojj (29256 bytes) C:\WINDOWS\OEWABLog.txt : jdmbwv (9728 bytes) C:\WINDOWS\OOBEACT.LOG : akpgfu (3567 bytes) C:\WINDOWS\OOBEACT.LOG : tuktot (9728 bytes) C:\WINDOWS\orun32.isu : gnqzt (29256 bytes) C:\WINDOWS\orun32.isu : hwjyf (29256 bytes) C:\WINDOWS\orun32.isu : thpuop (9728 bytes) C:\WINDOWS\Q308210.log : igjorg (9728 bytes) C:\WINDOWS\Q308677.log : yiwvy (103566 bytes) C:\WINDOWS\Q308678.log : bolzuy (9728 bytes) C:\WINDOWS\Q308678.log : pyuugj (9728 bytes) C:\WINDOWS\Q311889.log : zbkvzb (9728 bytes) C:\WINDOWS\Q311967.log : rwmfbn (7471 bytes) C:\WINDOWS\Q313450.log : uvxthr (9728 bytes) C:\WINDOWS\Q313484.log : tcstp (29256 bytes) C:\WINDOWS\Q313484.log : wkcddy (9728 bytes) C:\WINDOWS\Q314147.log : jwxkvx (3567 bytes) C:\WINDOWS\Q314862.log : zbrvoo (10824 bytes) C:\WINDOWS\Q315403.log : pgarkk (9728 bytes) C:\WINDOWS\Q316397.log : kckjjy (29256 bytes) C:\WINDOWS\Q318388.log : mtiwd (103566 bytes) C:\WINDOWS\Q320174.log : xepxpm (9728 bytes) C:\WINDOWS\Q326830.log : nmerel (9728 bytes) C:\WINDOWS\Q329115.log : lexjnr (9728 bytes) C:\WINDOWS\Q329170.log : dkhzfc (3547 bytes) C:\WINDOWS\Q330994(2).exe : rpkodq (9728 bytes) C:\WINDOWS\Q330994(3).exe : vcfinb (9728 bytes) C:\WINDOWS\Q330994.exe : jqxdfr (9728 bytes) C:\WINDOWS\Q815021.log : ubibl (103566 bytes) C:\WINDOWS\Q828026.log : xkeui (103566 bytes) C:\WINDOWS\REGOPT.LOG : jynud (103566 bytes) C:\WINDOWS\Santa Fe Stucco.bmp : duwvv (103566 bytes) C:\WINDOWS\setupapi.log.0(4).old : cyxqnc (9728 bytes) C:\WINDOWS\setupapi.log.0(4).old : ltotf (95744 bytes) C:\WINDOWS\setupapi.log.0(8).old : gjowt (103566 bytes) C:\WINDOWS\setupapi.log.0(8).old : ltotf (95744 bytes) C:\WINDOWS\setupapi.log.1.old : bqflcq (11336 bytes) C:\WINDOWS\setupapi.log.1.old : ygwabp (9728 bytes) C:\WINDOWS\smscfg.ini : kmifgu (9728 bytes) C:\WINDOWS\smscfg.ini : oioulw (9728 bytes) C:\WINDOWS\SND531unin.txt : jxiuxc (3547 bytes) C:\WINDOWS\spupdsvc.log : fkbjtn (29256 bytes) C:\WINDOWS\Sti_Trace.log : mpvhpl (9728 bytes) C:\WINDOWS\THXWALLP.BMP : dpcxcd (11336 bytes) C:\WINDOWS\TWUNK_32.EXE : gxbvef (9728 bytes) C:\WINDOWS\TWUNK_32.EXE : jchseh (9728 bytes) C:\WINDOWS\VB.INI : pxxlvo (9728 bytes) C:\WINDOWS\VB.INI : wabcqx (3567 bytes) C:\WINDOWS\VBADDIN.INI : lafakz (9728 bytes) C:\WINDOWS\VMINST.LOG : idjgvs (9728 bytes) C:\WINDOWS\Vtw.INI : oqfpyp (29256 bytes) C:\WINDOWS\Vtw.INI : uscjot (9728 bytes) C:\WINDOWS\WIASERVC.LOG : gjpmxo (11736 bytes) C:\WINDOWS\WindowsUpdate.log : smxtfl (29256 bytes) C:\WINDOWS\WININIT.INI : gzzvxf (9728 bytes) C:\WINDOWS\WININIT.INI : lksuib (10824 bytes) C:\WINDOWS\WINNT.BMP : rkswmj (3567 bytes) C:\WINDOWS\wmsetup.log : dlkakm (29256 bytes) C:\WINDOWS\WMSysPrx.prx : bwiskj (7471 bytes) C:\WINDOWS\Zapotec.bmp : twaymu (3567 bytes) C:\WINDOWS\Zapotec.bmp : zytszt (9728 bytes)
Post #2
Some new discoveries have occurred since my last post. When I run Adaware SE, AVG Resident tells me of 20+ Trojans that neither program can find on their own. I removed whatever AVG found in the ADS spytool. Alot of the Trojans were in System Volume Info, so I turned off system restore. I still get one Trojan that keeps regenerating in System Volume Info., in R1, A0000018.ini:thpuop.

Logfile of HijackThis v1.99.1
Scan saved at 1:55:46 PM, on 3/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\kmw_run.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\StartupMonitor.exe
C:\WINDOWS\system32\KMW_SHOW.EXE
C:\WINDOWS\System32\tbctray.exe
C:\Program Files\HistoryKill\histkill.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\HistoryKill\hkPopupKiller.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Mskexe] c:\PROGRA~1\mcafee\SPAMKI~1\spamkiller.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\System32\tbctray.exe
O4 - HKCU\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} (IEPlayInterface Class) - http://www.lotrdvd.com/dvdkey/extended_dvd…ds/iaieplay.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…84/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://directv.direcway.com/main/dpcsysinfo.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,21/mcgdmgr.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedCon…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…443/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2250FAC0-8257-4CB4-9BD8-F47858F856F0}: NameServer = 208.51.44.1 208.51.44.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{2250FAC0-8257-4CB4-9BD8-F47858F856F0}: NameServer = 208.51.44.1 208.51.44.2
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe



C:\WINDOWS\AolCInUn.exe : upetrr (7471 bytes)
C:\WINDOWS\Capture : lvwxiz (7471 bytes)
C:\WINDOWS\COM+.log : evokcc (3567 bytes)
C:\WINDOWS\DirectX.log : ejythu (3567 bytes)
C:\WINDOWS\KB825119.log : tvwsqw (7471 bytes)
C:\WINDOWS\KB828741.log : lwoxsy (3567 bytes)
C:\WINDOWS\KB834707-IE6-20040929.115007.log : muxgol (7471 bytes)
C:\WINDOWS\KB839643-DirectX9Uninst.log : evpliv (3567 bytes)
C:\WINDOWS\MMKEYBD.INI : nkkhsg (3567 bytes)
C:\WINDOWS\muninst.exe : puugbd (3567 bytes)
C:\WINDOWS\nsreg.dat : lsmgfz (7471 bytes)
C:\WINDOWS\n_ctrueg.txt : dtfmzj (3567 bytes)
C:\WINDOWS\OOBEACT.LOG : akpgfu (3567 bytes)
C:\WINDOWS\Q311967.log : rwmfbn (7471 bytes)
C:\WINDOWS\Q314147.log : jwxkvx (3567 bytes)
C:\WINDOWS\Q329170.log : dkhzfc (3547 bytes)
C:\WINDOWS\SND531unin.txt : jxiuxc (3547 bytes)
C:\WINDOWS\VB.INI : wabcqx (3567 bytes)
C:\WINDOWS\WindowsUpdate.log : smxtfl (29256 bytes)
C:\WINDOWS\WINNT.BMP : rkswmj (3567 bytes)
C:\WINDOWS\WMSysPrx.prx : bwiskj (7471 bytes)
Post #3
hi PatrickM,

lets try this first;


(winXP)

1. Turn off System Restore. (deletes old possibly >>infected<< restore point)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.(new restore points on a >>clean<< system)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK, then reboot
——————————————
now rescan computer with antivirus software.

what does ADS spy stand for?
is it>>>ADS Adware Remover ? if so i suggest you uninstall it see this link;

http://www.spywarewarrior.com/rogue_anti-spyware.htm

shelf life
Post #4
Thank you for your reply. I did as you suggested. AVG virus scan found nothing. The "ADS spy" I am referring to is the ADS spy tool that is packaged with HijackThis. It is found by opening HijackThis->Open Misc. Tools Section->Open ADS Spy…->Scan. This is were I got the logs that I posted in my original posts. The weird thing is, when running Lavasofts Ad-Aware SE->Scan for ADS(NOT Full System Scan!), my resident antivirus program would pop-up these trojan warnings (a whole bunch), giving the path to where these infections were located, but other than that, could not quarantine them or delete them. As a matter of fact, if I hadn't of sat and watched the entire Ad-Aware scan and wrote all the paths down quickly (the warning pop-up only lasts 20 sec.), I would have never known about the suspected Trojans. No other scan could find anything running on its own. This includes Ad-Aware SE, Avg antivirus, Spybot, TrojanHunter, plus 6 other online virus scans. I've removed all the suspected Trojans that AVG antivirus found using HijackThis ADS spy tool->scan->remove selected items. That is why my second ADS log is much, much smaller than the first. My fear is that the rest of the ADS files in the log are also Trojans that none of the scanning engine that I have/use can detect. I don't know much about Alternate Data Streams. The ADS spy tool of HijackThis says "this app also displays legitamate data streams. Do not delete streams if you are not completely sure they are malicious!"

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI