What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Massive Pop-ups, pls help!

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Here are the files in lower box: File C:\Documents and Settings\Owner\Bureau\E-Jay\Ejay Special - Full\Ejay\EJAY_SE\EJAY\OLEAUT_I.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Object "BearShare Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "BearShare Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "CoolWebSearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "WhenU Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Dan.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Deu.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Esp.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Fin.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Ita.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Jpn.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Nor.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Sve.nls". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Documents and Settings\Owner\Local Settings\Temp\uninstall.exe". Action Taken: No Action Taken. Entry "HKCR\CLSID\{BC54B24C-5A97-4C19-9181-8B8A05B2E931}" refers to invalid object "C:\WINDOWS\system32\nst5A.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{BD9584EF-C28C-4F6D-8D49-0CEE3C0E442F}" refers to invalid object "C:\WINDOWS\system32\nst5A.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C7888681-1A83-4C14-B9A5-95F91240B44F}" refers to invalid object "C:\WINDOWS\system32\nst5A.dll". Action Taken: No Action Taken. Entry "HKCR\btnetw.ohb" refers to invalid object "{9ADE0443-2AB2-4B23-A3F8-AC520773DE12}". Action Taken: No Action Taken. Entry "HKCR\btnetw.ohb.1" refers to invalid object "{9ADE0443-2AB2-4B23-A3F8-AC520773DE12}". Action Taken: No Action Taken. Entry "HKCR\LowSol.RichEditor" refers to invalid object "{F79A2C4B-8776-4ED7-8B2F-4786A4A3500A}". Action Taken: No Action Taken. Entry "HKCR\LowSol.RichEditor.1" refers to invalid object "{F79A2C4B-8776-4ED7-8B2F-4786A4A3500A}". Action Taken: No Action Taken. File C:\WINDOWS\idpgsvc.exe infected by "Trojan-Downloader.Win32.VB.hj" Virus! Action Taken: No Action Taken. File C:\WINDOWS\visfxun.exe infected by "Trojan-Downloader.Win32.VB.kd" Virus! Action Taken: No Action Taken. File C:\WINDOWS\system32\redtrsha.dll tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken. File C:\Documents and Settings\Owner\Bureau\E-Jay\Ejay Special - Full\Ejay\EJAY_SE\EJAY\OLEAUT_I.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\Owner\Mes documents\Incomplete\T-481556438-Hip Hop Ejay 4 Full (3).rar tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken. File C:\Documents and Settings\Owner\Mes documents\Ma musique\EJay (Hip Hop 4) (Beat Maker).zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\Owner\Mes documents\Ma musique\Pat\95DC8F7F-24ED-4940-B657-B5B14A1C59CE.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\Owner\Mes documents\Melange\Ejay - Trance Rave Hip-Hop - Warez.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\Owner\Mes documents\Melange\nailfix.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken. File C:\Program Files\asys\VFX8.0-1.exe infected by "Trojan-Downloader.Win32.VB.kd" Virus! Action Taken: No Action Taken. File C:\Program Files\Lavasoft\aawsepersonal.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\00505267.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\06FA3228 infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\0F6E2814.htm infected by "Exploit.VBS.Phel.a" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\0F7B5006.htm infected by "Exploit.VBS.Phel.a" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\103430F1.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\128B6E27 infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\178D6C78.exe infected by "Trojan-Downloader.Win32.Murlo.e" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\1E846117 infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\1E8A3510 infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\20DB3B60.EXE infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\213246BC.part infected by "P2P-Worm.Win32.Tibick.d" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\21330148.EXE infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\230C0EB3.part infected by "P2P-Worm.Win32.Tibick.d" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\2FD62A5B.EXE infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\2FE3524D.EXE infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\36445348 infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\36C205A1.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\37FC335D.EXE infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\425D3EA3.EXE infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\428A19C7 infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\428D43C3 infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\465B3632.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\482C240E.exe infected by "Worm.Win32.VB.an" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\48C4086B.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\5C810F8B.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\5FE14C66.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\63665964.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\67282140.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\69092E56 infected by "Trojan-Downloader.Win32.Agent.il" Virus! Action Taken: No Action Taken. File C:\Program Files\norton\Norton AntiVirus\Quarantine\7C780E14.exe infected by "Trojan-Downloader.Win32.Agent.ki" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP103\A0014784.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP105\A0014922.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP105\A0014924.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP105\A0015042.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP106\A0015177.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP107\A0015429.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP107\A0015431.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017118.exe infected by "Trojan-Downloader.Win32.Small.jf" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017224.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017309.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017310.EXE tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017311.EXE tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017355.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017360.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017418.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017475.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017480.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017481.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017488.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017490.exe tagged as "not-a-virus:AdWare.BetterInternet.b". Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017491.exe infected by "Trojan.Win32.Stervis.c" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017492.dll infected by "Trojan.Win32.Agent.db" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017497.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017505.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP119\A0017513.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP120\A0017522.exe infected by "Trojan.Win32.Agent.ay" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP120\A0017555.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP120\A0017559.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP120\A0017562.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken. File C:\System Volume Information\_restore{F39C325E-08F6-4272-90F3-BD716FE020B9}\RP120\A0017617.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\idpgsvc.exe infected by "Trojan-Downloader.Win32.VB.hj" Virus! Action Taken: No Action Taken. File C:\WINDOWS\system32\Macromed\Shockwave 10\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\system32\redtrsha.dll tagged as "not-a-virus:AdWare.SafeSurfing.j". Action Taken: No Action Taken. File C:\WINDOWS\visfxun.exe infected by "Trojan-Downloader.Win32.VB.kd" Virus! Action Taken: No Action Taken.
Post #20
This is a full system scanner from kapersky, have it check your system. Yes a log from ewido and then reboot to normal mode and a new hijackthis log.
Post #21
Ok… here are the 4 logs I've saved

Critical Areas with Online Scan:

——————————————————————————-
KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Thursday, July 14, 2005 23:00:52
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 15/07/2005
Kaspersky Anti-Virus database records: 130616
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\Owner\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 18310
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 748 sec

Infected Object Name - Virus Name
C:\WINDOWS\visfxun.exe Infected: Trojan-Downloader.Win32.VB.kd

Scan process completed.




All drives with Online Scan:

——————————————————————————-
KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Thursday, July 14, 2005 23:00:52
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 15/07/2005
Kaspersky Anti-Virus database records: 130616
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\Owner\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 18310
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 748 sec

Infected Object Name - Virus Name
C:\WINDOWS\visfxun.exe Infected: Trojan-Downloader.Win32.VB.kd

Scan process completed.



Ewido Safe Mode

———————————————————
ewido security suite - Rapport de scan
———————————————————

+ Créé le: 00:09:10, 2005-07-15
+ Somme de contrôle: C3F002A0

+ Résultats du scan:

C:\Documents and Settings\Owner\Cookies\[removed]-sys[1].txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@overture[1].txt -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00228800.TXT -> Spyware.Cookie.Qksrv : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229007.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229022.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229056.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229058.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229059.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229060.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229061.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229517.TXT -> Spyware.Cookie.Addynamix : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229590.TXT -> Spyware.Cookie.2o7 : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229591.TXT -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229592.TXT -> Spyware.Cookie.Centrport : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229593.TXT -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229594.TXT -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229595.TXT -> Spyware.Cookie.Qksrv : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229596.TXT -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229597.TXT -> Spyware.Cookie.Trafficmp : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229598.TXT -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229599.TXT -> Spyware.Cookie.Adserver : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229600.ZIP/Setup.exe -> Worm.VB.an : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229601.EXE -> Spyware.NewDotNet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229602.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229603.dll -> Spyware.HotSearchBar : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229604.dll -> Spyware.HotSearchBar : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229605.dll -> Spyware.HotSearchBar : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229606.dll -> Spyware.EliteBar : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229636.TXT -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229682.TXT -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00229700.TXT -> Spyware.Cookie.Addynamix : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00230416.TXT -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00230417.TXT -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00230421.TXT -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00230422.TXT -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00230712.TXT -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00230714.TXT -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00752494.TXT -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00752495.TXT -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\RECYCLER\NPROTECT\00752496.TXT -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder


::Fin du rapport



HiJackThis :

Logfile of HijackThis v1.99.1
Scan saved at 00:11:31, on 2005-07-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\CMAPP\Client\cmappclient.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\windowsautomaticupdates.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HiJackThis\HijackThis.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kav…can_unicode.cab
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\CMAPP\Client\cmappmf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Automatic Updates - Stanford University - C:\WINDOWS\system32\windowsautomaticupdates.exe




Now what LOL! Looks like the computer is completely screwed up!
Post #24
Works fine and found the way to remove the ABI thing!! Thanks a lot for ur help…big deal here!! That forum is the best thing I've ever seen! Thanks for all the time u gave…really appreciate it! :thumbup:
Post #25
If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. In my signature below is also a tutorial on how to harden IE, a good read and very helpful to stop these things in the future. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on.

Safe Surfing. :D


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI