What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can you help me please

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
lukem :D

The reason for all this is because the bad entries we are trying to remove are known as a Rootkit, its something that loads before windows actually starts and goes undected. I would like you to run Panda again and lets see if its gone.

Panda ActiveScan <<

I have one uncle and 2 cousins in Piacenzia :D
Post #17
I live 2 hours car far from Piacenza :) this is new Panda log: Incident Status Location Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.yadro.ru/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.tradedoubler.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.advertising.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\lucamarantelli\Dati applicazioni\Mozilla\Firefox\Profiles\f7icq3lf.default\cookies.txt[.com.com/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.atdmt.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.questionmarket.com/] Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.tradedoubler.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.doubleclick.net/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.2o7.net/] Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][landing.domainsponsor.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][ad.yieldmanager.com/] Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][statse.webtrendslive.com/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.hitbox.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.fastclick.net/] Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.burstnet.com/] Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.adtech.de/] Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.centrport.net/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.tribalfusion.com/] Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][searchportal.information.com/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.hg1.hitbox.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.advertising.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.realmedia.com/] Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\lucamarantelli\Documenti\firefox_backup\Firefox 1.5.0.6 it - 2006-08-29.pcv[cookies.txt][.bfast.com/] Dialer:Dialer.Gen Not disinfected Cartelle archivio\Posta inviata\R: crack\ee.zip[empire earth crack.exe][connect.exe] Dialer:Dialer.Gen Not disinfected Cartelle archivio\Posta inviata\R: crack\ee.zip[Empire Earth CRACK (3).exe][GO.exe] thanks
Post #20
Good Morning Lukem, Yes my wife and I have been to Italy twice. In 2002 and 2004. My cousin took us all over Northern Italy and met many friends and relatives from my grandmothers side of the family. My other cousin lives in Sala Mandella as did my grandfather. I love Italy and we want to go back and visit soon. Would you post one last HJT log and let me make sure that all is well. Ken :D
Post #21
Logfile of HijackThis v1.99.1
Scan saved at 13.10.32, on 18/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
C:\Programmi\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Programmi\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\RA7F7.EXE
C:\WINDOWS\Explorer.EXE
C:\Programmi\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Programmi\FireTrust\MailWasher Pro\MailWasher.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programmi\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
C:\Documents and Settings\lucamarantelli\Desktop\ogame\OgameClient\OgameClient.exe
C:\Programmi\eclipse\eclipse.exe
C:\WINDOWS\system32\javaw.exe
C:\Programmi\Java\jre1.5.0\bin\javaw.exe
C:\Programmi\Java\jre1.5.0\bin\javaw.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\lucamarantelli\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 172.16.1.100 testsintesi.provincia.como.it
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programmi\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nposistemi.it
O17 - HKLM\Software\..\Telephony: DomainName = nposistemi.it
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nposistemi.it
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmi\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: MySQL - Unknown owner - C:\Programmi\MySQL\MySQL.exe (file missing)
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Programmi\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Programmi\OpenVPN\bin\openvpnserv.exe
O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Programmi\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
O23 - Service: StoneGate VPN Client (SGClient) - Stonesoft Corp. - C:\Programmi\Stonesoft\StoneGate VPN Client\gatekeeper.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Tomcat5.0\bin\tomcat5.exe
Post #23
Lukem :D

Make sure you still have windows enabled to show all files and folders and boot to safemode and delete this file. You may have to do a windows search for it to find exactly where it is.

R: crack\ee.zip


The rest of your log looks fine :thumbup:



How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

System Restore <– Do this first to prevent reinfecting yourself.
TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


If you feel your still having problems, please post back.

Ken :D
Post #24
ok I don't know what to say Ken. Thank you! It's the work pc and it gave me a lot of problems, but now they are solved thank to you great!
Post #26
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI