What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help With geeba.dll Please

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Heres my Hijack Log, ive tried most things none seem to get rid of it. I often get popups but ive heard its a virus. Please help
Logfile of HijackThis v1.99.1
Scan saved at 9:00:01 PM, on 4/27/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Program Files\Wireless LAN\WlanUtil.exe
D:\Program Files\bin\iPodService.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Microsoft Office\Office\POWERPNT.EXE
D:\Program Files\Trillian\trillian.exe
D:\Program Files\iTunes.exe
C:\WINNT\system32\hpoipm07.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Michael Yang\My Documents\applications\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.103.182.58:6588
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: DPCUpdater Object - {E321ACA5-B12F-4D2C-B786-23B0A559CB21} - C:\WINNT\system32\geeba.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\Wireless LAN\WlanUtil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Jason\AIM\aim.exe
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9A081E8-FCCE-454E-B1F1-2B8480FE73F8}: NameServer = 192.168.1.1,192.168.1.1
O20 - Winlogon Notify: geeba - C:\WINNT\system32\geeba.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\bin\iPodService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
Post #2 last edited
Hello and Welcome to TomCoyote,

Let's try the following:

Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose:Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click
  • No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE:If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES.
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will shutdown your computer, click OK.
  • Turn your computer back on.
======
Ewido Trojan Scanner
Please download, install, and update the NEW free version of Ewido trojan scanner:
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  • From the main ewido screen, click on update in the left menu, then click the Start update button.
  • After the update finishes (the status bar at the bottom will display "Update successful")
  • Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
  • If ewido finds anything, it will pop up a notification. Select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
  • When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.
Next, please reboot your computer in Safe Mode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.

Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp (or is it Winnt in your case?) folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER) \Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #3
New Hijack Log
Logfile of HijackThis v1.99.1
Scan saved at 10:51:01 PM, on 4/28/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Program Files\Wireless LAN\WlanUtil.exe
C:\Program Files\Secretmaker\secretmaker.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
D:\Program Files\bin\iPodService.exe
C:\Documents and Settings\Michael Yang\My Documents\applications\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.103.182.58:6588
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINNT\system32\smiehlp.dll
O2 - BHO: DPCUpdater Object - {E321ACA5-B12F-4D2C-B786-23B0A559CB21} - C:\WINNT\system32\geeba.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\Wireless LAN\WlanUtil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\Secretmaker\secretmaker.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Jason\AIM\aim.exe
O10 - Broken Internet access because of LSP provider 'smnsp.dll' missing
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9A081E8-FCCE-454E-B1F1-2B8480FE73F8}: NameServer = 192.168.1.1,192.168.1.1
O20 - Winlogon Notify: geeba - C:\WINNT\system32\geeba.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\bin\iPodService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)

Normal Mode Ewido
———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 8:36:35 PM, 4/28/2006
+ Report-Checksum: E0F43E39

+ Scan result:

:mozilla.7:C:\Documents and Settings\jason yang\Application Data\Mozilla\Firefox\Profiles\sqfn42be.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\jason yang\Cookies\jason [removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\3-1-06 version 911 Big Lie Govt Mass Murder Police State pdf.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\7bridesfor7brothers avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Abc Access 2003.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Advanced search.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Air America Radio - The Majority Report 030106 [mp3].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Air America Radio - The Randi Rhodes Show 030106 [mp3].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\American McGee's Alice.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\americas.next.top model s05e14 where the girls are dieseltv.divx.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Angelina Jolie.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\AUBADE Calendar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\BF78 - Doctor Who - Pier Pressure.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Big Finish - Doctor Who - 79 - Night Thoughts.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\BloodRayne TC KVCD by PJ(TUS Release)[WWW.SEVEREDBYTES.COM].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Blue Seed One.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Bright Eyes - Lua (CDS) [2005].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Bright Eyes - Take it Easy (Love Nothing) [Single].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Browse categories.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Camel - The Snow Goose [1975].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Carmen Electra 88 Wallpaper by -[removed]/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Chaos! Comics Part 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Chris Howard - NLP & Leadership Master Practitioner Training - 31cd.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\CloneDVD v2.8.9.2 and Patch.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\ColorImpact 2 8 7 403 zip.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Command and Conquer Tiberiun Sun [PCTGameZone] www pctorrent com.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\CSI NY 2x15 (HDTV-LOL) [VTV].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Dire Straits- Making Movies.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Disgaea Hour Of Darkness 2 PS2 FULLCD JAP.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Download Accelerator Plus v8044 with Crack rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\elenor from driftking.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\eteraser2006 exe.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Freddie S01E16 Recipe For Disaster [Videoseed com] (iPod).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Frontpage Update.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Generation Of Chaos PS2 FULLCD USA.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\George Lopez S05E16 George Doesnt Trustee Angies Brother [Videoseed com] (iPod).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Goal DVDRip XviD-DoNE [www descargasweb net].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\HAMBURG CLUBMIX VOL 10 DJ WILLIAM rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Helena Karel Calender.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\idvolume2 rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\idvolume3 rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\idvolume4 rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\idvolume5 rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\idvolume6 rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\idvolume7 rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\IRC chat.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Jewel De Nyle 3 Full XXX Scenes P1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Kick Master - OST [Kupo Nutz] rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Kids In America 2005 PROPER DVDRip XviD-iMBT [www descargasweb net].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Le Monde PDF 02 03 06 zip.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Les Bronzes 3 FRENCH DVDScr Xvid By Te@m-HP[tracker heavenplace net].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Lets Ride Silver Buckle Stables PS2 FULLCD USA.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Lois McMaster Bujold - Vor Game.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Microsoft Windows 99 ENGLISH RARE BETA BOOTABLE ISO KICKO.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\MSDN TV - The Code Room - Breaking Into Vegas - Episode 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\MSDN TV - The Code Room - Building Mobile Apps and Bluetooth Enabled Kiosks - Episode 2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\MSDN TV - The Code Room – Pilot Episode - Episode 1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Nakahara No Hasha Sangoku Shouseiden PSP UMDRIP JAP.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Naruto - 003 - A Rival! Sasuke & Sakura rmvb.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Naruto - 004 - Trial! Survival Training rmvb.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Naruto - 005 - Failure - Kakashi's Conclusion rmvb.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Naruto - 006 - Important Mission! Heading to the Country of the Wave rmvb.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Nature and Wildlife Wallpapers2 (High Resolution 263 photos).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\NDS Roms 0261-0280.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\NDS Roms 0281-0300.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\NDS Roms 0301-0320.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Privacy policy.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Quickverse 2006 Platinum 3CDs [WwW LiMiTeDiVx CoM].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Ray Lamontagne - Rare Private concert for friends only.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Search Cloud.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Show all of today →.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Slysoft Clone DVD v2 8 9 2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Still Standing S04E17 Still Coaching [Videoseed com] (iPod).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Sylvia Saint 3 Full XXX Scenes P1.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Symantec Enterprise Secuirity Manager 6 5 3CDs [WwW LiMiTeDiVx CoM].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\The Clientele - Strange Geometry (2005).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\The Complete O'Reilly Series.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\The Vampire Lestat.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\TMPGEnc 3.0 Xpress v3.0.4.24 FULL!.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\TV Shows.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Upload a torrent.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Volvo Ocean Race 27 FEB xvid avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\winamp5 2 Pro Bêta 0441 +Crack By DiEgO rar.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Windows Genuine Advantage Patcher (1.5.512.0).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\World Series Of Poker PS2 FULLCD PAL.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\X Files - X FILES SEASON 6 FULL DVD RIP HQ 720 X 400 XVID.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\Yu-Gi-Oh GX - 41 - A Reason To Win[C-W](HQ) avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[AHQ] Fullmetal Alchemist 15-24 [Dual Audio] MKV.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[DB] Naruto 174 [652743B7] avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[httpWWW.SEVEREDBYTES.COM]Pink Panther 2006 maVen TS KVCD by Hockney(TUS Release).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[httpWWW.SEVEREDBYTES.COM]The Dukes Of Hazzard 2005 Unrated WS DVDRip kvcd Jamgood(TUS Release).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[Tsubasa-Fansub] Saint Seiya Hades - Meikai-Hen - OAV 04 [FRENCH SUBS].zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[www.severedbytes.com]Date Movie (2006) CCAT CAM KVCD by Hockney(TUS Release).zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\Complete\[^MDW^]Mai Otome (Mai Z-HiME) 17 sub ita avi.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Documents and Settings\Michael Yang\My Documents\applications\hijackthis.zip/backups/backup-20050723-171129-709.dll -> Adware.PurityScan : Cleaned with backup
C:\Program Files\outlook\p.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup
C:\Program Files\outlook\v.tmp -> Worm.VB.dw : Cleaned with backup
C:\WINNT\unin101.exe -> Trojan.VB.tg : Cleaned with backup
C:\WINNT\uni_eh.exe -> Trojan.VB.tg : Cleaned with backup
C:\WINNT\vdahscr.exe -> Adware.BetterInternet : Cleaned with backup


::Report End

Ewido Safe Mode
———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 10:46:22 PM, 4/28/2006
+ Report-Checksum: E9F9797F

+ Scan result:

No infected objects found.


::Report End
Post #4
Hello TheMike,

Let's do the following:

Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose:Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click
  • No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE:If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

STEP 1.
======
VirtumundoBeGone

Download VirtumundoBeGone by secured2k
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
Save the file to your desktop
Close all running programs (including your Internet Browser)
Double-click VirtumundoBeGone.exe on the desktop
Read the introductory information, and then click Continue
Click Start
When asked if you want to continue, click Yes to run the fix
Click "Save Log"


Note: It is normal for the the fix to terminate by producing a BLUE SCREEN OF DEATH so don't be concerned when this happens. It requires you to manually reboot to restore your normal windows desktop.

The log created by VirtumundoBeGone called VBG.TXT will be on located on your desktop. Please retain VBG.TXT.

Empty Recycle Bin.

Reboot and "copy/paste" a new HijackThis log file along with the VBG.TXT into this thread.
Also please describe how your computer behaves at the moment.
Post #5
Logfile of HijackThis v1.99.1
Scan saved at 12:54:05 PM, on 4/29/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NetZero\exec.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Program Files\Wireless LAN\WlanUtil.exe
C:\Program Files\Secretmaker\secretmaker.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Documents and Settings\Michael Yang\My Documents\applications\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.103.182.58:6588
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINNT\system32\smiehlp.dll
O2 - BHO: DPCUpdater Object - {E321ACA5-B12F-4D2C-B786-23B0A559CB21} - C:\WINNT\system32\geeba.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\Wireless LAN\WlanUtil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\Secretmaker\secretmaker.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Jason\AIM\aim.exe
O10 - Broken Internet access because of LSP provider 'smnsp.dll' missing
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9A081E8-FCCE-454E-B1F1-2B8480FE73F8}: NameServer = 192.168.1.1,192.168.1.1
O20 - Winlogon Notify: geeba - C:\WINNT\system32\geeba.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\bin\iPodService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)


[04/29/2006, 12:48:50] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Michael Yang\Desktop\VirtumundoBeGone.exe" )
[04/29/2006, 12:48:52] - Detected System Information:
[04/29/2006, 12:48:52] - Windows Version: 5.0.2195, Service Pack 4
[04/29/2006, 12:48:52] - Current Username: Michael Yang (Admin)
[04/29/2006, 12:48:52] - Windows is in NORMAL mode.
[04/29/2006, 12:48:52] - Searching for Browser Helper Objects:
[04/29/2006, 12:48:52] - BHO 1: {A491D208-B353-490F-B81A-A8A3DC97042D} (IeHelper Class)
[04/29/2006, 12:48:52] - BHO 2: {E321ACA5-B12F-4D2C-B786-23B0A559CB21} (DPCUpdater Object)
[04/29/2006, 12:48:52] - Finished Searching Browser Helper Objects
[04/29/2006, 12:48:52] - Finishing up…
[04/29/2006, 12:48:52] - Nothing found! Exiting…
Post #6
Disable Spyware Doctor:
Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:
  • Click the Spyware Doctor icon in the System Tray.
  • Click Settings.
  • Click Startup Settings under Pick a Category.
  • Uncheck Run at Windows startup.
  • Click Apply and Exit Spyware Doctor
Once your log is clean you can re-enable Spyware Doctor.

Update Your Java
Update your Java to the latest version.
  • Uninstall any and all versions you have listed in add/remove programs
  • Install the latest version from here: http://www.java.com/en/
  • The following explains how to remove items from your computer that are malware. These items must be fixed!

    STEP 1.
    ======
    CWShredder

    Please download and run CWShredder
    Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.


    Please set your system to show all files; please see here if you're unsure how to do this.

    Scan with HijackThis. Place a check against each of the following:
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    O2 - BHO: DPCUpdater Object - {E321ACA5-B12F-4D2C-B786-23B0A559CB21} - C:\WINNT\system32\geeba.dll
    O4 - HKLM\..\RunServices: [winlog] winlog.exe
    O20 - Winlogon Notify: geeba - C:\WINNT\system32\geeba.dll
    Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

    Do a search on winlog.exe to find its location and note the full path to use with Killbox below.

    STEP 2.
    ======
    Delete Files with Killbox

    Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
    ==========
    Double-click on KillBox.exe to launch the program. It is thered circle with a large white X in it
    - Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
    winlog.exe<=replace with full path
    C:\WINNT\system32\geeba.dll

    In Killbox click on the File menu and then the Paste from Clipboard item
    in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
    (Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
    Click the option to Delete on Reboot
    - If not greyed out click the checkbox for Unregister .dll Before Deleting
    - click End Explorer Shell while Killing File
    - Now click on the red button with a white 'X' in the middle to delete the files
    - Click Yes when it says all files will be deleted on the next reboot
    - Click Yes when it asks if you want to reboot now
    (Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

    Note: Killbox will let you know if a file does not exist. If that happens, just continue on.

    If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.

    Blacklight

    Download Blacklight Beta from here:
    http://www.f-secure.com/blacklight/try.shtml
    • Hit I accept. It will take you to download page.
    • Download blbeta.exe and save it to the Desktop.
    • Once saved… double click blbeta.exe to install the program.
    • Click accept agreement and Click scan
      This app too may fire off a warning from antivirus. Let the driver load.
      Wait for it to finish.
    • If it displays any items…don't do anything with them yet. Just hit exit (close)
    • It will drop a log on Desktop that starts with fsbl….big number
    Please post contents of fsbl….big number log.
    Post back a fresh HijackThis log and we will take another look.
Post #7 last edited
I cant find winlog.exe and when i try to install blacklight it says "F-secure Blacklight could not require nessasary privileges (SeDebugPrivilege)
Post #8
Please download NTrights.zip by freeatlast.
If you can't access it, download NTrights.zip via here: http://www10.brinkster.com/expl0iter/freea…/dumprights.htm
Save it on your desktop.
Unzip/extract it.
Read here how to unzip/extract properly:
http://metallica.geekstogo.com/xpcompressedexplanation.html
Open the NTrights-folder
Double click on the Debug.bat file to run it, follow any prompts it asks.

REBOOT

Doubleclick the Debug.bat again after reboot.

It will create a log.
If the log says:
"Granting SeDebugPrivilege to Administrators … successful", you must be ok and things restored well.

Please let me know if it was successful.

Then if if was successful, please run the Blacklight beta and post the results.
Post #9 last edited
Logfile of HijackThis v1.99.1
Scan saved at 3:10:11 PM, on 4/29/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Program Files\Wireless LAN\WlanUtil.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
D:\Program Files\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Michael Yang\My Documents\applications\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.103.182.58:6588
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IeHelper Class - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINNT\system32\smiehlp.dll
O2 - BHO: DPCUpdater Object - {E321ACA5-B12F-4D2C-B786-23B0A559CB21} - C:\WINNT\system32\geeba.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\Wireless LAN\WlanUtil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\Secretmaker\secretmaker.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Jason\AIM\aim.exe
O10 - Broken Internet access because of LSP provider 'smnsp.dll' missing
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9A081E8-FCCE-454E-B1F1-2B8480FE73F8}: NameServer = 192.168.1.1,192.168.1.1
O20 - Winlogon Notify: geeba - C:\WINNT\system32\geeba.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)


04/29/06 15:02:47 [Info]: BlackLight Engine 1.0.36 initialized
04/29/06 15:02:47 [Info]: OS: 5.0 build 2195 (Service Pack 4)
04/29/06 15:02:47 [Note]: 7019 4
04/29/06 15:02:47 [Note]: 7005 0
04/29/06 15:02:56 [Note]: 7006 0
04/29/06 15:02:56 [Note]: 7011 888
04/29/06 15:02:57 [Note]: 7026 0
04/29/06 15:02:57 [Note]: 7026 0
04/29/06 15:03:06 [Note]: FSRAW library version 1.7.1015
04/29/06 15:05:15 [Note]: 2000 1006
04/29/06 15:06:22 [Note]: 7007 0
Post #10
Let's try the following:
======
Delete Files with Killbox

Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
C:\WINNT\system32\geeba.dll

In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
(Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
Click the option to Delete on Reboot
- If not greyed out click the checkbox for Unregister .dll Before Deleting
- click End Explorer Shell while Killing File
- Now click on the red button with a white 'X' in the middle to delete the files
- Click Yes when it says all files will be deleted on the next reboot
- Click Yes when it asks if you want to reboot now
(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

Note: Killbox will let you know if a file does not exist. If that happens, just continue on.

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.

Please post a new hijackthis log.
Post #14
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\iTunesHelper.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Program Files\Wireless LAN\WlanUtil.exe
D:\Program Files\bin\iPodService.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
D:\Program Files\Trillian\trillian.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Michael Yang\My Documents\applications\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.103.182.58:6588
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\Wireless LAN\WlanUtil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\Secretmaker\secretmaker.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Jason\AIM\aim.exe
O10 - Broken Internet access because of LSP provider 'smnsp.dll' missing
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9A081E8-FCCE-454E-B1F1-2B8480FE73F8}: NameServer = 192.168.1.1,192.168.1.1
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
Post #15 last edited
Congratulations TheMike,

You sure killed it! :) Hijackthis log appears to be clean. Let me just see results of one more scan to make sure everything looks fine.


Now run this online scan using Internet Explorer:
Kaspersky WebScanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.

Copy and paste that information from Kapersky in your next post.


Susan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI