What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack Log after Self Help

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Background:

Towards the end of last year we had a browser hijack/java exploit on our computer. I managed to delete the java exploit (or so I thought *grr*) and fix the browser hijack (thank to running hijack this.) Well, the darn java exploits popped up during a Zone Alarm daily scan about 3 days ago. This baby is running sloooow. My virus scans are taking so long that it's almost time for the next daily scan. Granted, there's a lot on this beast but this is way too slow.

Here's what we're running:

Windows XP (fully updated)
Zone Alarm Pro
Spyware Blaster
Spybot S&D
AdAware Personal
carp** Cleaner
Windows Defender

As of yesterday I also installed the trial versions of Ewido and Spysweeper.

Here's the bullet point issues:

- CPU is maxed out almost constantly right now (same as last year)
- Can't boot into safe mode
- MAJOR logoff problems; having to use the killswitch to boot down *yikes*
- Unable to manually delete java exploits this time
- Upon fresh boot Spysweeper denies access to DEDMAZAI.com (which I found info here about it- www.webhelper4u.com/CWS/greg-search/dedmazaimainpage.html)



Here's what I've done so far (per self-help topics)

- Ran Spybot S&D; results were clean
- Ad Aware; removed 1 coloumbo dialer
- Ewido (not in safe mode since i couldn't) removed Adaware.Delfin. and Dialer.Generic

Spysweeper finds the following (can't remove with free trial version)
Adaware found- items=5 trace=9
- ie driver
- searchbar toolbar
- findwhatevernow
- searchbar.html hijack
- wildmedia



This was the Hijack this log I started with:

Logfile of HijackThis v1.99.1
Scan saved at 16:59:24, on 9/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Owner\Desktop\HijackThis.exe /startupscan
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Here's my logs after doing all of the above stated:


———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 22:16:27 9/7/2006

+ Scan result:



HKLM\SOFTWARE\Dsi -> Adware.Delfin : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Enum\USB\Vid_041e&Pid_3010&MI_00\6&4e3bc53&0&0000\\DeviceDesc -> Dialer.Generic : Error during cleaning.
:mozilla.532:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Admarketplace : Cleaned.
:mozilla.665:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.242:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.243:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.244:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.245:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.581:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Com : Cleaned.
:mozilla.582:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Com : Cleaned.
:mozilla.233:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.234:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.235:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.236:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.442:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.497:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.498:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.599:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.640:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.445:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.136:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.137:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.138:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.139:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.140:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.141:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.122:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.123:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.124:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\cypq8x5i.default\cookies-1.txt -> TrackingCookie.Zedo : Cleaned.


::Report end



Logfile of HijackThis v1.99.1
Scan saved at 22:18:12, on 9/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKCU\..\Run: [HijackThis startup scan] "C:\Documents and Settings\Owner\Desktop\HijackThis.exe" /startupscan
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Thank you in advance for any help you can give. I've only lurked before and was able to fix most things along the way (diferent computer) so I do appreciate all the work everyone here puts into helping total strangers. :thumbup:
Post #2 last edited
Well, I've been busy and have had some success so I wanted to post updated logs. Since I am not able to boot safe mode I instead updated all my software to the latest updates, disconnected (wire out of the wall) from the net and disabled all protection (Zone Alarm AV&AS, teatimer, spysweeper, etc.) I went through each program one at a time and ran scans. I managed to find a lot of bad stuff that was hiding from me and I'm now able to shut Windows down properly instead of having to use the killswitch. That much is a definite improvement from the other day! :D

Here's the "at-a-glance" report:

Spyware Blaster- Enabled all protections. The update downloaded but it is not reflecting the date when loading although it showed that new protections needed enabled.

Spybot S&D- fully immunized. No threats found on 2 out of three accounts. 3rd account (the one the initial infection occured in) was not fully immunized and there was one threat found. (found that odd since I thought that when updating these programs it was supposed to do so across all accounts. i have it installed to do that.)

CCleaner- fixed all issues found under all three scans

AdAwareSE- Win32.trojan.downloader was quarrentined successfully. This was not showing up previously. Again, I ran it separately under the 3rd account and it found 4 more threats. All were fixed.

Ewido- dialer.generic Every time I try to either delete or quarentine this item it fails.

I did manage to delete the java explouts that ZoneAlarmPro's AV was finding. I cleaned out the cache's for all three accounts so that nothing was left in the java.bin folders.

Another note, when I rebooted Spysweeper blocked access to YSBWEB.com. I did some research on that and ran Kaspersky as instructed elsewhere. I'll post that log below. I made sure to set the settings for the online scanner as instructed here at your forums.



Here's the logs:


Ad-Aware SE Build 1.06r1
Logfile Created on:Tuesday, September 12, 2006 15:45:26
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R123 12.09.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):2 total references
Win32.Trojan.Downloader(TAC index:10):5 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


9-12-2006 15:45:26 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\Owner\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : S-1-5-21-1220945662-1580436667-1801674531-1003\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 484
ThreadCreationTime : 9-12-2006 01:07:57
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 544
ThreadCreationTime : 9-12-2006 01:08:02
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 624
ThreadCreationTime : 9-12-2006 01:08:03
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 668
ThreadCreationTime : 9-12-2006 01:08:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 680
ThreadCreationTime : 9-12-2006 01:08:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 856
ThreadCreationTime : 9-12-2006 01:08:12
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 904
ThreadCreationTime : 9-12-2006 01:08:13
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1052
ThreadCreationTime : 9-12-2006 01:08:14
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1196
ThreadCreationTime : 9-12-2006 01:08:17
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1316
ThreadCreationTime : 9-12-2006 01:08:22
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [guard.exe]
FilePath : C:\Program Files\ewido anti-spyware 4.0\
ProcessID : 1788
ThreadCreationTime : 9-12-2006 01:09:03
BasePriority : Normal
FileVersion : 4, 0, 0, 172
ProductVersion : 4, 0, 0, 172
ProductName : ewido anti-spyware
CompanyName : Anti-Malware Development a.s.
FileDescription : ewido anti-spyware guard
InternalName : ewido anti-spywareguard
LegalCopyright : Copyright © 2005 Anti-Malware Development a.s.
OriginalFilename : guard.exe

#:12 [slserv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1872
ThreadCreationTime : 9-12-2006 01:09:04
BasePriority : Normal
FileVersion : 2.80.00(24Apr2000)
ProductVersion : 2.80.00
ProductName : Modem
FileDescription : User-Level Modem Service
InternalName : slserv
LegalCopyright : Copyright © 1999-2000
OriginalFilename : slserv.exe

#:13 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1964
ThreadCreationTime : 9-12-2006 01:09:07
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:14 [wdfmgr.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1988
ThreadCreationTime : 9-12-2006 01:09:08
BasePriority : Normal
FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act)
ProductVersion : 5.2.3790.1230
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows User Mode Driver Manager
InternalName : WdfMgr
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : WdfMgr.exe

#:15 [spysweeper.exe]
FilePath : C:\Program Files\Webroot\Spy Sweeper\
ProcessID : 2028
ThreadCreationTime : 9-12-2006 01:09:09
BasePriority : Normal
FileVersion : 3,0,7,1608
ProductVersion : 3, 0
ProductName : Spy Sweeper SDK
CompanyName : Webroot Software, Inc.
FileDescription : Spy Sweeper Engine
LegalCopyright : Copyright © 2002 - 2006, All Rights Reserved.
LegalTrademarks : Spy Sweeper is a trademark of Webroot Software, Inc.
OriginalFilename : SpySweeper.exe

#:16 [isafe.exe]
FilePath : C:\WINDOWS\system32\ZoneLabs\
ProcessID : 580
ThreadCreationTime : 9-12-2006 01:09:22
BasePriority : Normal
FileVersion : Version 10.67.0.0
ProductVersion : Version 10.67.0.0
ProductName : ISafe
CompanyName : Computer Associates International, Inc.
FileDescription : ISafe Service
InternalName : ISafe
LegalCopyright : © 2003 Computer Associates International, Inc.
LegalTrademarks : Vet is a trademark of Computer Associates International, Inc.
OriginalFilename : ISafe.exe
Comments : ISafe

#:17 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1440
ThreadCreationTime : 9-12-2006 01:09:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:18 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 2872
ThreadCreationTime : 9-12-2006 01:16:13
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE

#:19 [point32.exe]
FilePath : C:\Program Files\Microsoft IntelliPoint\
ProcessID : 3128
ThreadCreationTime : 9-12-2006 01:16:27
BasePriority : Normal


#:20 [spysweeperui.exe]
FilePath : C:\Program Files\Webroot\Spy Sweeper\
ProcessID : 3500
ThreadCreationTime : 9-12-2006 01:16:51
BasePriority : Normal
FileVersion : 5,0,7,1608
ProductVersion : 5, 0
ProductName : Spy Sweeper
CompanyName : Webroot Software, Inc.
FileDescription : Spy Sweeper Client Executable
LegalCopyright : Copyright © 2002 - 2006, All Rights Reserved.
OriginalFilename : SpySweeper.exe

#:21 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 2912
ThreadCreationTime : 9-12-2006 19:07:50
BasePriority : Normal
FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
ProductVersion : 5.1.2600.2696
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:22 [wscntfy.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 3956
ThreadCreationTime : 9-12-2006 19:26:37
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Security Center Notification App
InternalName : wscntfy.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : wscntfy.exe

#:23 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 3512
ThreadCreationTime : 9-12-2006 19:45:04
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Win32.Trojan.Downloader Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{48e59293-9880-11cf-9754-00aa00c00908}

Win32.Trojan.Downloader Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{48e59291-9880-11cf-9754-00aa00c00908}

Win32.Trojan.Downloader Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{48e59290-9880-11cf-9754-00aa00c00908}

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 3
Objects found so far: 5


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Scanning Hosts file……
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
40 entries scanned.
New critical objects:0
Objects found so far: 5




Performing conditional scans…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Win32.Trojan.Downloader Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : inetctls.inet

Win32.Trojan.Downloader Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : inetctls.inet.1

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 2
Objects found so far: 7

15:57:16 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:11:49.938
Objects scanned:145891
Objects identified:5
Objects ignored:0
New critical objects:5




———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 16:43:23 9/12/2006

+ Scan result:



HKLM\SYSTEM\CurrentControlSet\Enum\USB\Vid_041e&Pid_3010&MI_00\6&4e3bc53&0&0000\\DeviceDesc -> Dialer.Generic : Error during cleaning.


::Report end






Logfile of HijackThis v1.99.1
Scan saved at 19:32:50, on 9/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Owner\Desktop\HijackThis.exe /startupscan
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


EDIT: The Kaspersky log is WAY too long to post even in it's own reply. Please let me know if you need to see it.
Post #3
Hello and welcome at TomCoyoteforum, Sorry for the delay in responding, it's been pretty busy here and not all logs get answered as quickly as we'd like. If you still need help with your problem, please reply to this message with a new HijackThis log. I will be notified automatically when you reply.
Post #4
Hi toscane,
I was able to get everything removed except for that generic dialer that shows up during an ewido scan. She's running a lot better but something is still eating up resources so I'm guessing that last dialer is to blame (i hope!)

Here's a fresh HJT log to get started-

Logfile of HijackThis v1.99.1
Scan saved at 19:10:19, on 9/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKCU\..\Run: [HijackThis startup scan] "C:\Documents and Settings\Owner\Desktop\HijackThis.exe" /startupscan
O4 - Global Startup: Spy Sweeper Updater V 2.0.0.lnk = ?
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


I'll run an ewido scan next so I can give you that log too if you need it.

Thanks for the much-needed guidance!
Post #5
——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 23:01:24 9/19/2006 + Scan result: HKLM\SYSTEM\CurrentControlSet\Enum\USB\Vid_041e&Pid_3010&MI_00\6&4e3bc53&0&0000\\DeviceDesc -> Dialer.Generic : No action taken. ::Report end
Post #6 last edited

not in safe mode since i couldn't)


Why not?

The Ewido log reports No action taken
Did you click the Apply all actions button?

Look here for the right setup:
  • Install ewido anti-spyware.
  • Start the program but don't scan for virus at this moment.
  • On the main screen select the icon "Update" then select the "Update now" link.
  • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Click on Scanner
  • Click on Complete System Scan
  • Let the program scan your pc, be patient this may take a little time.
  • If you have any infections you will prompted, select "Apply all actions"
  • Next select the button "Save Report".
  • Click the "Save report as" button and save the report to your desktop.
WIl you try again and post a new Ewido log please?
Post #7
Well, ewido did the same exact thing it's done for every scan…

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 8:04:50 PM 9/21/2006

+ Scan result:



HKLM\SYSTEM\CurrentControlSet\Enum\USB\Vid_041e&Pid_3010&MI_00\6&4e3bc53&0&0000\\DeviceDesc -> Dialer.Generic : Error during cleaning.


It just won't remove it and this is the only program that has shown this dialer. It doesn't show up in AdAware, Zone Alarm, Webroot Spy Sweeper or S&D. It's a pesky little bugger.

I've been trying to update Java on here for about two months and hadn't been able to until tonight. The brilliant idea of turning everything off (internet, all protections) finally dawned on me and it worked. I'm *guessing* since we were suffering from a java exploit that this bug didn't want us to update.


I haven't been able to boot into safe mode for quite some time. I'm not sure of the exact reason why. F8 does nothing. This might not even be related to the current issues. We used to have two hard drives on the computer. One was starting to fail so our guy made it a slave so we could transfer what we needed off of it. When the PC is booting up there's two options to boot (not talking about safe mode.) They both work exactly the same even though we're back to one drive. I can't remember what the first on the list is exactly. I'll reboot and edit this post so you have the info in case its necessary.
Post #8 last edited

I've been trying to update Java on here for about two months and hadn't been able to until tonight. The brilliant idea of turning everything off (internet, all protections) finally dawned on me and it worked. I'm *guessing* since we were suffering from a java exploit that this bug didn't want us to update.


:thumbup: @tnx for the feedback!

Perhaps this is the way for your to boot into safe mode:

How to use the System Configuration Utility method to Start Your Computer in Safe Mode in XP

*Close all open programs.
*Click Start, and then click Run. The Run dialog box appear and in the box type 'msconfig' (without the quotes)
*click OK.
*The System Configuration Utility appears
*Out a check mark beside the "/SAFEBOOT" option
*click OK.
*Click Restart.The computer restarts in Safe mode.

Do keep in mind to use an account with all permisions. Ewido gives this erro sometimes when there is limited permission to delete subregkeys.
F.i. you can log in with the administrator account, or make a new account.
Then, in safe mode, try to run Ewido and post back with a new log here :)

*when finished troubleshooting repeat steps 1-3
*in step 4, uncheck "/SAFEBOOT"
*click OK
*close all programs
*restart the computer as you normally would.
Post #9
Thanks for the help on safe mode! I knew there had to be another way to do it but I had no idea how. I'm going to run all the scans while I'm in there to see what all we can catch. I'm actually excited about this lol. I'll post the results when done. I'm sure it'll take a while but we're on opposite clocks so that'll work out perfect :) Critters beware! I'm back in safe mode again :D
Post #10
Here's what we have: (Everything was freshly updated before starting.) AdAware- Squeaky Clean SpywareBlaster- all protections enabled Spybot S&D- Squeaky Clean (fully immunized) I've been running everything under the original windows account (with full permissions) so that shouldn't be why ewido is giving that error. I had even tried it under the other two accounts (one has full permission, the other is limited since it's the kids' account.) Ewido- Same exact thing as above. It still won't remove it. "error during cleaning" I'm running my Zone Alarm virus/spyware scan now. I have it set for max strength detection so it'll take a while for the results… typically a few hours.
Post #11
Zone Alarm came back clean too. I ran CCleaner while I was at it and had it fix everything. On a strange side note, I'm getting a message to "reactive windows" due to so many hardware changes on the computer. Have you ever heard of this before?
Post #12
Perhaps it is time for the "Important system files check".

Go to the Run box on the Start Menu and type in:
sfc /scannow
This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem. You will need your XP CD if it finds any problems.

Expl.:
http://www.updatexp.com/scannow-sfc.html
Post #13
I ran it and it never requested the CD so I'm guessing everything there is fine. I did the reactivation yesterday. There have been a lot of hardware changes on this baby so I can't say I was shocked but I was surprised because I've never seen/heard of having to reactive Windows before. The computer is running a lot smoother (even before running this scan.) The CPU usage is back to normal levels. It only hits 100% when I'm running anti-virus scans but those typically do take a lot. It'll also spike when opening up a program but again, that's normal. Now if we can just get rid of this pesky dialer… :)
Post #14

Ewido- Same exact thing as above. It still won't remove it. "error during cleaning"


Perhaps when you go into safe mode and run Ewido from the administrator account you can delete this file.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI