What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Error messages

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello there

Please help me I keep on getting these annoying error messages when I exit a programs like task manager and internet explorer they also appear on their own randomy an example of the messages are:

taskmgr.exe application error the instruction at "0x77f58dc5" references memory at "0x000076f9". The memory could not be read". please click ok to terminate the program. All the error messages display this data the only difference is the . exe eg security.exe or iexplorer.exe etc

Im also getting random realplay.exe application error messages too followed by an AUBgcheckWindow: Realplay.exe application error message.

When I start my machine I get the security.exe application error message, when I first go ontio internet explorer the application error message seems to pop up 6 times in a row, but then still pops up radomly.

Please help I am using Windows XP Professional.

Many thanks

p.s. doing a great job with the service, keep up the good work.




Here is my hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 17:08:18, on 16/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\PAStiSvc.exe
C:\Windows\System32\svchost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.blueyonder.co.uk:8080
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\Windows\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [system43.exe] C:\Windows\System32\system43.exe
O4 - HKLM\..\Run: [ms] C:\Program Files\Microsoft\svhost32.exe
O4 - HKLM\..\Run: [DxDialog] C:\Windows\System32\dxdlg32.exe
O4 - Startup: MS_update_0610_KB72306.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MS_update_0610_KB72306.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Indexings Services - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\systen32.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows Login (len) - Unknown owner - C:\Windows\System32\lmss.exe" -service (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Server Advance (ServerAC) - Unknown owner - C:\Windows\System32\Security.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
Post #2
I don't see any protection on your PC :o

Click the HERE and Save, Install, Update and run a full scan.


After the above

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select " "Quarantine" .".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
  • Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
    results of the AVG Anti-Spyware report scan along with a new HijackThis log.
Please use the [external image: Posted Image] Button below to reply.
Post #3
Hi LDTate Firstly many thanks for replying, regarding my problem I did try and install Windows service pack 2 as I did not have this on my machine, however whilst I was installing this the system crashed and now my system is runny very slow and my control panel will not open aswell as the error messages still popping up. My only guess is that service pack to has part downloaded onto my machine but not fully hence only some applications are not working. I will now have no choice but to reinstall my Windows and install a firewall and an anti virus software package and then download service pack 2. Do you agree that this is the best solution now and are there any good ones you could possibly recommend. Kind regards Deeps
Post #4
Try this first then.

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [system43.exe] C:\Windows\System32\system43.exe
O4 - HKLM\..\Run: [ms] C:\Program Files\Microsoft\svhost32.exe
O4 - Startup: MS_update_0610_KB72306.exe
O4 - Global Startup: MS_update_0610_KB72306.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"



Delete these Files if listed:
C:\Windows\System32\system43.exe
C:\Program Files\Microsoft\svhost32.exe <–Only from this location

Empty Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5
Hi LDTate:

Here is my log file. The application error messages are still appearing and login takes a while.

Regards

Logfile of HijackThis v1.99.1
Scan saved at 15:19:20, on 20/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\SVCH0ST.EXE
C:\Windows\System32\svchost.exe
C:\Windows\System32\winlogon.exe
C:\Windows\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft\svhost32.exe
C:\Windows\System32\winlogon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Windows\System32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.blueyonder.co.uk:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\system32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\Windows\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ms] C:\Program Files\Microsoft\svhost32.exe
O4 - HKLM\..\Run: [DxDialog] C:\Windows\System32\dxdlg32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168978190000
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Indexings Services - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\systen32.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows Login (len) - Unknown owner - C:\Windows\System32\lmss.exe" -service (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Server Advance (ServerAC) - Unknown owner - C:\Windows\System32\Security.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
Post #6
Run Hijackthis click >"config" then "misc tools" >"delete file on reboot"
(exact spelling counts!!! so dont browse to the file)
Copy/Paste the bolded line below into the File name box then click Open,

C:\Program Files\Microsoft\svhost32.exe



Run Hijack This again and put a check by these.

O4 - HKLM\..\Run: [ms] C:\Program Files\Microsoft\svhost32.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"



Empty Recycle Bin

Reboot.

Next:
I don't see a Anti-Virus program running. Get this free one

Click the HERE and Save, Install, Update and run a full scan.


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment
Post #7
Hi

Still getting application error messages and start up still slow. When I went to empty recyle bin it was empty anyway. For some reason a backup folder has been created on my desktop also.

Logfile of HijackThis v1.99.1
Scan saved at 15:50:34, on 20/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\SVCH0ST.EXE
C:\Windows\System32\services.exe
C:\Windows\Explorer.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.blueyonder.co.uk:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\system32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\Windows\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [DxDialog] C:\Windows\System32\dxdlg32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168978190000
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Indexings Services - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\systen32.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows Login (len) - Unknown owner - C:\Windows\System32\lmss.exe" -service (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Server Advance (ServerAC) - Unknown owner - C:\Windows\System32\Security.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
Post #8 last edited
You need to download the anti-virus program. You have a trojan that needs to go. Where are you running HijackThis from?
Post #9
Hi Am am going do a scan with the anti virus software you recommended now, im not quite sure what you mean by where am I running HijackThis from? Its on my desktop and I downloaded it from this site. I will reply back with a HijackThis log once my scan has finshed. Many thanks
Post #11
Hi LDT

Ive run a scan on AVG and it found 67 trojons which it removed however it did not remove something which was called c:\WINDOWS\report20050216.log My computer is still taking its time logging in it never used to and the application error messages are still appearing whenever I exit things like task manager.

here is my latest HighjackThis log

Thanks

Logfile of HijackThis v1.99.1
Scan saved at 19:11:51, on 20/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Windows\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\services.exe
C:\Windows\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\wuauclt.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.blueyonder.co.uk:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\system32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\Windows\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168978190000
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Indexings Services - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\systen32.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows Login (len) - Unknown owner - C:\Windows\System32\lmss.exe" -service (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Server Advance (ServerAC) - Unknown owner - C:\Windows\System32\Security.exe (file missing)
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
Post #13
This is what we are dealing with:

Name W32/Tilebot-AO
Type Worm

How it spreads Network shares

Affected operating systems Windows

Side effects Allows others to access the computer
Drops more malware
Installs itself in the Registry
Exploits system or software vulnerabilities

Aliases Backdoor.Win32.SdBot.aad
Sdbot.worm.gen.bd
W32.Spybot.Worm



Lets give this a go first.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Post #14
Hi LDT did exactly what you said and application error messages still pop up when I exit task manager, hijackthis, notepad etc.

Here is the SDFix report and below this is a new HijckThis log

Thanks LTD


SDFix: Version 1.60

20/01/2007 - 19:45:34.60

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
ServerAC

Path:
C:\Windows\System32\Security.exe

ServerAC Deleted

Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting…

Normal Mode:
Checking Files:

Files will be copied to Backups folder and removed:

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\svchost.exe - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp3.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp4.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp5.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp6.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp7.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp8.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp9.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpA.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpB.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpC.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpD.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpE.tmp - Deleted
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpF.tmp - Deleted
C:\Windows\system32\system43.exe - Deleted
C:\Windows\system32\TFTP208 - Deleted



Alternate Streams Check:

C:\Windows\system32
No streams found.

Final Check:

Remaining Services:
——————



Remaining Files:
—————

Backups Folder: - C:\SDFix\backups\backups.zip


Checking For Files with Hidden Attributes :

C:\Documents and Settings\Administrator\NetHood\bacitiexpressjobs.com.x.m6.net\Desktop.ini
C:\Program Files\170B53C8\E04B3535.DLL
C:\Program Files\34E219B0\E04B3535.DLL
C:\Program Files\Common Files\System\MS170B53.DLL
C:\Program Files\Common Files\System\MS34E219.DLL
C:\WINDOWS\system32\jbloader.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\system.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\Documents and Settings\Administrator\My Documents\~WRL1248.tmp
C:\WINDOWS\Temp\$_2341235.TMP
C:\WINDOWS\Temp\CS05138679-9882-4964-8C50-F20D7B70BB94.tmp
C:\WINDOWS\Temp\CS051B9E13-AAD8-49A8-9BA1-60BFC6CCBDC4.tmp
C:\WINDOWS\Temp\CS06813FB3-A204-4502-97D9-487D36C7D009.tmp
C:\WINDOWS\Temp\CS0951A9D7-57BB-4858-904E-A209D82F982D.tmp
C:\WINDOWS\Temp\CS095EE195-95AE-4AD8-AE9F-011AC1DAFF2F.tmp
C:\WINDOWS\Temp\CS0B6B94E0-E889-4340-B7D6-B55606898C1F.tmp
C:\WINDOWS\Temp\CS0CBFE934-7604-401C-A5B0-AF1C003F6C20.tmp
C:\WINDOWS\Temp\CS0D5F571C-8EA9-4D6C-B8E6-580822A43768.tmp
C:\WINDOWS\Temp\CS0D65026B-1060-41E4-BF50-50741BA464FF.tmp
C:\WINDOWS\Temp\CS0E5AA6F3-877F-4ACA-AE95-C58597B52DC2.tmp
C:\WINDOWS\Temp\CS0EA2347A-AC6B-45E1-A5FC-5085F867232F.tmp
C:\WINDOWS\Temp\CS0F6B0134-BE92-4CC5-BAB0-41143CA9023C.tmp
C:\WINDOWS\Temp\CS13F57101-E024-428D-8EEA-7A992BC28A4A.tmp
C:\WINDOWS\Temp\CS142BEA95-FA50-4D92-B176-C58B3B1B8105.tmp
C:\WINDOWS\Temp\CS145975E7-6B3A-4A97-9D7F-C7010FF0C2C4.tmp
C:\WINDOWS\Temp\CS172B25AF-0997-4060-8E3B-A3A37A91C3EF.tmp
C:\WINDOWS\Temp\CS19B83A48-8B83-4282-AA11-DD5AFCE42180.tmp
C:\WINDOWS\Temp\CS1B067A3B-A263-49BD-8F8C-E816459E0134.tmp
C:\WINDOWS\Temp\CS1BF971F9-2AE8-43C5-A117-28C16A4F3D3D.tmp
C:\WINDOWS\Temp\CS1DA38A27-9BEA-4A6E-BA10-27D94F48F2A6.tmp
C:\WINDOWS\Temp\CS2077A63D-BF93-425A-A5B6-15D0FF96248C.tmp
C:\WINDOWS\Temp\CS2127F2C8-20AA-45AA-8973-FA5F4479DF5D.tmp
C:\WINDOWS\Temp\CS22F0D8A7-3D5B-4ECE-9836-4F45E9C553FD.tmp
C:\WINDOWS\Temp\CS2626DBED-6768-47D2-9307-2B63385A2921.tmp
C:\WINDOWS\Temp\CS26ECE443-8A36-4D41-A203-C7FD17A4FFE4.tmp
C:\WINDOWS\Temp\CS2710392D-9DFE-4B32-BAD7-85D7CDB9BF63.tmp
C:\WINDOWS\Temp\CS27353C71-811D-4DEC-9CEA-718D95F1CAFE.tmp
C:\WINDOWS\Temp\CS2778350E-5293-4EAB-A5A1-D9CF3DFA8849.tmp
C:\WINDOWS\Temp\CS2920807B-79D9-4B46-BB50-FF8ABC297382.tmp
C:\WINDOWS\Temp\CS2D2E0B95-1347-4E06-AC5E-D22D3F92590B.tmp
C:\WINDOWS\Temp\CS2EEAF57A-1018-403A-8C7E-B72D7DC74F85.tmp
C:\WINDOWS\Temp\CS2F6F8EC1-EA97-4B6B-BC33-B658FC3A9B97.tmp
C:\WINDOWS\Temp\CS300BC720-8570-4ADC-AA92-29793921CECC.tmp
C:\WINDOWS\Temp\CS30340340-D745-4E16-823D-9384C8B8A7FB.tmp
C:\WINDOWS\Temp\CS33E66D18-0A45-4124-AFFC-C1D19CCD9B67.tmp
C:\WINDOWS\Temp\CS34D156FA-9245-40B6-BBE6-5DDE8584C7F1.tmp
C:\WINDOWS\Temp\CS3625E80C-B85A-446E-A4F1-BD4E35C6413F.tmp
C:\WINDOWS\Temp\CS39C9B17C-73FA-4714-A664-1A0166C04105.tmp
C:\WINDOWS\Temp\CS3A7D3A43-69D6-4772-B1F5-6131587DB48C.tmp
C:\WINDOWS\Temp\CS3ACA11AA-FC84-486C-A31D-252E5FF3B0EB.tmp
C:\WINDOWS\Temp\CS3B637F69-7705-43CB-88E8-8C15CB9E3340.tmp
C:\WINDOWS\Temp\CS3B8FCA83-5FCC-4468-9A99-A0F9BC39DF1D.tmp
C:\WINDOWS\Temp\CS3BE30051-543E-4931-896A-A14FE471C428.tmp
C:\WINDOWS\Temp\CS3C44FE52-C0F0-4BD5-A41D-1F0D599D9AEC.tmp
C:\WINDOWS\Temp\CS42CD4C45-326F-4C92-A8F8-8D773B63A449.tmp
C:\WINDOWS\Temp\CS446DBF36-6900-4E13-B775-ABB9FC9C8A3E.tmp
C:\WINDOWS\Temp\CS44E6B734-A7B5-464E-AD41-B8A03DCA0A6F.tmp
C:\WINDOWS\Temp\CS4634D9A0-2001-47BD-BA5F-32BA766FCE05.tmp
C:\WINDOWS\Temp\CS46653EC4-9E96-4EB7-B814-92C1EFDDBA99.tmp
C:\WINDOWS\Temp\CS4B1C95AD-B04E-4C82-992A-B7E4B50ABB00.tmp
C:\WINDOWS\Temp\CS4B677B52-2E18-43AF-AD84-3481C15407A5.tmp
C:\WINDOWS\Temp\CS4E742C7E-7F03-49DD-AC62-44CC036D71A1.tmp
C:\WINDOWS\Temp\CS4F29FDB2-3AA2-40F1-A2A7-91624F23F396.tmp
C:\WINDOWS\Temp\CS4F9C972F-4BFE-438B-8F13-B9B9A6A26C34.tmp
C:\WINDOWS\Temp\CS4FE6D498-E869-40B8-9B37-6C6A2E0D00D7.tmp
C:\WINDOWS\Temp\CS50C271BA-9F89-43E0-A1B8-D2760C015C60.tmp
C:\WINDOWS\Temp\CS516BFCAD-3798-4B30-8CD3-9C310EE3D418.tmp
C:\WINDOWS\Temp\CS53391823-791D-4DBE-AA57-AA10FFF188F7.tmp
C:\WINDOWS\Temp\CS55A4E10D-3F88-4A00-9986-F3EA843CA379.tmp
C:\WINDOWS\Temp\CS5BAFA236-5440-4B62-93B8-DA0DA40B9258.tmp
C:\WINDOWS\Temp\CS5C8FDEFF-F5FA-4919-B2D2-E04725A442AD.tmp
C:\WINDOWS\Temp\CS5D676979-D674-4BC8-B6F9-9B7677237DEE.tmp
C:\WINDOWS\Temp\CS5DF23444-5FAB-4344-B072-C0EAC1B9DBB2.tmp
C:\WINDOWS\Temp\CS62AFE4CC-2EBD-4F14-8E08-165EE1D12E42.tmp
C:\WINDOWS\Temp\CS6396DAB7-80D9-4F45-942A-6ED72CED3DE3.tmp
C:\WINDOWS\Temp\CS66B1964E-8C52-4C5A-A36E-0424D405F822.tmp
C:\WINDOWS\Temp\CS674515B7-F381-4414-AB15-BDB4FB8CF1E2.tmp
C:\WINDOWS\Temp\CS6B56B412-AFEB-41F6-BDD3-A463B0138606.tmp
C:\WINDOWS\Temp\CS6C8BF0D3-4685-432D-BE03-CB676C7C8770.tmp
C:\WINDOWS\Temp\CS6D2340C1-1129-46EE-8EA5-4B17989DC9EC.tmp
C:\WINDOWS\Temp\CS6D577819-67AC-4C22-A7E1-72D9EA327DA2.tmp
C:\WINDOWS\Temp\CS6E07EF3C-8A96-42F1-B46D-835B5899A5FB.tmp
C:\WINDOWS\Temp\CS6F133741-5870-40A6-83FD-E5F8A5D97F09.tmp
C:\WINDOWS\Temp\CS6F18F3C5-F2A4-4D59-AAE8-2475E30BCE71.tmp
C:\WINDOWS\Temp\CS72776A36-51B9-42F2-B271-06CBF5C0DA08.tmp
C:\WINDOWS\Temp\CS72B0A8BA-6A11-4108-AD6E-1DB976234745.tmp
C:\WINDOWS\Temp\CS72B2E7D8-EF76-4DC3-BE62-F9DBF32DBF13.tmp
C:\WINDOWS\Temp\CS731D107E-FD89-46A8-A910-62A72EF230F0.tmp
C:\WINDOWS\Temp\CS74E1C291-7434-464F-85D0-9C696700B2C3.tmp
C:\WINDOWS\Temp\CS74F4C710-F5C4-442D-96EE-F2078F5D9EAE.tmp
C:\WINDOWS\Temp\CS753B00E9-DBBF-4F90-A81E-E84AD7B95EE4.tmp
C:\WINDOWS\Temp\CS75D6EF3C-6B90-4BBA-8C7E-17167C5F8B69.tmp
C:\WINDOWS\Temp\CS75E13F77-E633-4ABD-AC4D-E735C9D03721.tmp
C:\WINDOWS\Temp\CS775AAECE-6BD3-4B0E-A7AE-7B806570A27A.tmp
C:\WINDOWS\Temp\CS77785991-83BA-41C1-81D6-D8655AA72FFB.tmp
C:\WINDOWS\Temp\CS796983BE-7F13-4B83-BB37-52A5E59F6E4D.tmp
C:\WINDOWS\Temp\CS7B4237FA-F630-48FB-BEDE-987298C9D4E1.tmp
C:\WINDOWS\Temp\CS7DDB2B16-6AE8-4906-90E0-829E3016D373.tmp
C:\WINDOWS\Temp\CS7EDEDF1E-46ED-417B-81C8-2DF1BA745A99.tmp
C:\WINDOWS\Temp\CS809583E3-D531-4777-B8F3-9A3CFEABD157.tmp
C:\WINDOWS\Temp\CS81BE8F10-8C60-45C3-9DF0-2D0ED9604A6E.tmp
C:\WINDOWS\Temp\CS820D981C-33AF-4569-A0DE-3A402495F8A1.tmp
C:\WINDOWS\Temp\CS836ABC7A-14B3-4B85-9F45-D06A5240D4B7.tmp
C:\WINDOWS\Temp\CS8484894F-2964-422C-A9D7-76447778CBDF.tmp
C:\WINDOWS\Temp\CS88B135F8-E2F8-4F2B-B6AA-310AFF491E73.tmp
C:\WINDOWS\Temp\CS8AA9C5BD-E49D-405C-A919-622401203250.tmp
C:\WINDOWS\Temp\CS8E6091C3-4838-43ED-B2AF-CC1F6066BD22.tmp
C:\WINDOWS\Temp\CS8FE2E6E1-A961-47D0-9DCA-513B353D77C9.tmp
C:\WINDOWS\Temp\CS94D118CA-2C95-4413-B857-BD9DE858579C.tmp
C:\WINDOWS\Temp\CS95F55F96-081D-469F-8447-B58C7539394B.tmp
C:\WINDOWS\Temp\CS9796EA0F-CB00-4894-AE85-C082C0CF1191.tmp
C:\WINDOWS\Temp\CS99EEBE30-1301-4193-A9D1-4128A55F410B.tmp
C:\WINDOWS\Temp\CS9A16A5C5-9839-4805-A849-6059CE6F9087.tmp
C:\WINDOWS\Temp\CS9B40EC80-8131-4A10-AAE6-C08EAB658C14.tmp
C:\WINDOWS\Temp\CS9CA60394-6BCF-484D-9032-F9530838D4BE.tmp
C:\WINDOWS\Temp\CS9D173DCA-8274-47FA-AF78-147EB4E0994B.tmp
C:\WINDOWS\Temp\CS9E116459-A26A-4676-8079-25E6590DE885.tmp
C:\WINDOWS\Temp\CS9EB4FB7D-D6E8-4753-8A1E-34A811E4CC99.tmp
C:\WINDOWS\Temp\CSA0C98893-1A05-467E-8EED-2530033A46F7.tmp
C:\WINDOWS\Temp\CSA363D9C2-33A4-4A6D-BCD4-94F2B5923A86.tmp
C:\WINDOWS\Temp\CSA3DB9509-304C-48CE-8B8A-6C5638C7795C.tmp
C:\WINDOWS\Temp\CSA59AB564-9182-40BE-984F-99D15E04A3E8.tmp
C:\WINDOWS\Temp\CSA82C2444-9290-436E-A5C3-41943122F556.tmp
C:\WINDOWS\Temp\CSA8377017-6E49-463C-839A-E05273CE6D34.tmp
C:\WINDOWS\Temp\CSAA1F0940-DB7E-4E08-89D4-A71BA3EC5F56.tmp
C:\WINDOWS\Temp\CSAA27197B-0BE3-4431-B4B3-E20509E50ED8.tmp
C:\WINDOWS\Temp\CSAEBF32A4-C31C-4A0B-8941-76F9E60888D9.tmp
C:\WINDOWS\Temp\CSAFCBEAE6-E4AF-406D-AE58-92F14EC99208.tmp
C:\WINDOWS\Temp\CSB04D74E5-2C09-417C-8990-C74F3A13FFDD.tmp
C:\WINDOWS\Temp\CSB270F683-1E56-4AF9-B8F6-810892987986.tmp
C:\WINDOWS\Temp\CSB3126E9E-23BC-4FC0-AF7E-9C6B7B3A9CAE.tmp
C:\WINDOWS\Temp\CSB3858156-F0C9-4646-A457-6BD7544E4C2F.tmp
C:\WINDOWS\Temp\CSB5EC3F64-3052-43F1-BF8C-523D1082EDD6.tmp
C:\WINDOWS\Temp\CSB62D4785-732F-41DC-97D7-B65ACF0BBAEA.tmp
C:\WINDOWS\Temp\CSB6A191F3-DB1F-4CE6-9D4B-0446417B86C8.tmp
C:\WINDOWS\Temp\CSB9A321E7-4852-4CEE-A54F-9F4AED32E594.tmp
C:\WINDOWS\Temp\CSC35651D0-B502-46CA-83FB-1804EED5FC97.tmp
C:\WINDOWS\Temp\CSC45884F0-253B-4A96-AE52-578D02A4E1D6.tmp
C:\WINDOWS\Temp\CSC508ECAC-8943-4457-83C8-3FBDCFBDA2A6.tmp
C:\WINDOWS\Temp\CSC6313797-E1C9-4FE6-9710-CA0D3BF5C5C7.tmp
C:\WINDOWS\Temp\CSC9883FEB-1FB8-4D9C-9D05-41225665E78D.tmp
C:\WINDOWS\Temp\CSCA1F7B19-EBB2-4209-AB65-A2551FBEF6AC.tmp
C:\WINDOWS\Temp\CSCA38CA00-045B-4B33-BADF-600DFA9B253A.tmp
C:\WINDOWS\Temp\CSCBCC9984-BC87-4B29-A819-E117839497A2.tmp
C:\WINDOWS\Temp\CSCBEE332C-583D-4056-B7EF-713DCC91CA0E.tmp
C:\WINDOWS\Temp\CSCE501EEB-720E-4059-93F5-60FD6D2BDEA6.tmp
C:\WINDOWS\Temp\CSD011F6CD-D29E-4383-99A4-45050629483E.tmp
C:\WINDOWS\Temp\CSD137BED0-72E7-437C-B4C0-F80BD2CBCF66.tmp
C:\WINDOWS\Temp\CSD1FCF2B9-9718-42B2-B350-43CA8DA8487E.tmp
C:\WINDOWS\Temp\CSD4A72F4D-20E3-4CA8-A4B0-66E0430A3F8E.tmp
C:\WINDOWS\Temp\CSD51CF0A8-5BCD-4773-89BC-E4A0880B5DD6.tmp
C:\WINDOWS\Temp\CSD85551D6-C163-45B8-862A-AEE38582D2B4.tmp
C:\WINDOWS\Temp\CSD8C38AD5-CDD0-4955-BF29-2C623ABFC8B9.tmp
C:\WINDOWS\Temp\CSDE61865F-D06A-4A05-8FDA-700CA9A0CCEB.tmp
C:\WINDOWS\Temp\CSDEAB130C-9367-4B79-AAE1-E786242908FF.tmp
C:\WINDOWS\Temp\CSDF12870C-4E3E-480F-A944-0A85D552000E.tmp
C:\WINDOWS\Temp\CSE0326903-A3DE-4B93-9737-02107B0D745C.tmp
C:\WINDOWS\Temp\CSE25D41FA-9F7C-48BA-B10E-EB68BFA4DAB7.tmp
C:\WINDOWS\Temp\CSE40F1E48-3A44-4869-AC50-AA23DDD1FBF6.tmp
C:\WINDOWS\Temp\CSE79633EA-9A0E-4D19-A41E-C117BDC15BDD.tmp
C:\WINDOWS\Temp\CSEA9F222A-4F0F-4C0F-9EF8-85B40A3C4D1F.tmp
C:\WINDOWS\Temp\CSEAF7DEC1-ECA3-4AB3-89EE-2AEE3B4F7D3F.tmp
C:\WINDOWS\Temp\CSEB3CE4A1-56F8-45A8-9A90-5E9A5AE372AC.tmp
C:\WINDOWS\Temp\CSEBE8AFBA-5687-491B-9610-C5607CB23239.tmp
C:\WINDOWS\Temp\CSEC70BA0A-C5A9-4410-8288-1FFD26F91924.tmp
C:\WINDOWS\Temp\CSED2CCBD6-3F42-4C07-91A5-9BD72179C01A.tmp
C:\WINDOWS\Temp\CSED633579-BA17-44AF-97BC-3ECA675CD0F4.tmp
C:\WINDOWS\Temp\CSEFBCEEF0-8A1A-4526-BAC1-88C7107EC028.tmp
C:\WINDOWS\Temp\CSEFD4FBC5-58FD-420F-8FB3-DE353E63FE8C.tmp
C:\WINDOWS\Temp\CSF13D11D2-E763-4C45-885E-17C502F308E7.tmp
C:\WINDOWS\Temp\CSF2DFA18B-988B-49A6-9314-BF85AD3AAC97.tmp
C:\WINDOWS\Temp\CSF33BE123-8433-4C46-B97F-87DAEFF0E502.tmp
C:\WINDOWS\Temp\CSF4419DC1-600A-4EAC-AE59-41EAA008A3BA.tmp
C:\WINDOWS\Temp\CSF5638B09-2CCD-4D11-80A2-604717CC481D.tmp
C:\WINDOWS\Temp\CSF6023305-A9F0-47BA-8624-96F27F6C7E2A.tmp
C:\WINDOWS\Temp\CSF6419184-D52A-41D2-96CE-3D6C7C433031.tmp
C:\WINDOWS\Temp\CSF894E149-1571-460E-AA5A-5DB9A5A7458D.tmp
C:\WINDOWS\Temp\CSF9E970F6-0CCA-4CA8-9E6C-3EE326465EF2.tmp
C:\WINDOWS\Temp\CSFC0B9E6F-A40E-47AF-A429-8C6B1BEC6018.tmp
C:\WINDOWS\Temp\CSFF948103-775F-4738-9543-B4E238CD1138.tmp

Finished




Logfile of HijackThis v1.99.1
Scan saved at 20:02:04, on 20/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\PAStiSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telewest.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.blueyonder.co.uk:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\system32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\Windows\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168978190000
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Indexings Services - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\systen32.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows Login (len) - Unknown owner - C:\Windows\System32\lmss.exe" -service (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
Post #15
Do you use this PC for any financial use?

Download Avenger by Swandog, and unzip it to your desktop or somewhere you can find it. (Do not run it yet).
http://swandog46.geekstogo.com/avenger.zip

Note: The Avenger must be run from a user account with administrator privileges,

and ONLY works on Windows 2000 and XP, and only on 32-bit versions!
If yours is a 64 bit version, do not use it, let me know.


Open a Notepad file by clicking Start > Run and typing Notepad.exe in the box, click OK.

Click Format, and ensure Word Wrap is unchecked.

Copy and Paste all the text inside the box below into Notepad.

Now save the file as RemoveFiles.txt in a location where you can find it.


Files to delete:
C:\Program Files\170B53C8\E04B3535.DLL
C:\Program Files\34E219B0\E04B3535.DLL
C:\Program Files\Common Files\System\MS170B53.DLL
C:\Program Files\Common Files\System\MS34E219.DLL
C:\WINDOWS\system32\jbloader.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\systen32.exe
C:\Windows\System32\lmss.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\system.exe
C:\WINDOWS\Temp\$_2341235.TMP
C:\WINDOWS\Temp\CS05138679-9882-4964-8C50-F20D7B70BB94.tmp
C:\WINDOWS\Temp\CS051B9E13-AAD8-49A8-9BA1-60BFC6CCBDC4.tmp
C:\WINDOWS\Temp\CS06813FB3-A204-4502-97D9-487D36C7D009.tmp
C:\WINDOWS\Temp\CS0951A9D7-57BB-4858-904E-A209D82F982D.tmp
C:\WINDOWS\Temp\CS095EE195-95AE-4AD8-AE9F-011AC1DAFF2F.tmp
C:\WINDOWS\Temp\CS0B6B94E0-E889-4340-B7D6-B55606898C1F.tmp
C:\WINDOWS\Temp\CS0CBFE934-7604-401C-A5B0-AF1C003F6C20.tmp
C:\WINDOWS\Temp\CS0D5F571C-8EA9-4D6C-B8E6-580822A43768.tmp
C:\WINDOWS\Temp\CS0D65026B-1060-41E4-BF50-50741BA464FF.tmp
C:\WINDOWS\Temp\CS0E5AA6F3-877F-4ACA-AE95-C58597B52DC2.tmp
C:\WINDOWS\Temp\CS0EA2347A-AC6B-45E1-A5FC-5085F867232F.tmp
C:\WINDOWS\Temp\CS0F6B0134-BE92-4CC5-BAB0-41143CA9023C.tmp
C:\WINDOWS\Temp\CS13F57101-E024-428D-8EEA-7A992BC28A4A.tmp
C:\WINDOWS\Temp\CS142BEA95-FA50-4D92-B176-C58B3B1B8105.tmp
C:\WINDOWS\Temp\CS145975E7-6B3A-4A97-9D7F-C7010FF0C2C4.tmp
C:\WINDOWS\Temp\CS172B25AF-0997-4060-8E3B-A3A37A91C3EF.tmp
C:\WINDOWS\Temp\CS19B83A48-8B83-4282-AA11-DD5AFCE42180.tmp
C:\WINDOWS\Temp\CS1B067A3B-A263-49BD-8F8C-E816459E0134.tmp
C:\WINDOWS\Temp\CS1BF971F9-2AE8-43C5-A117-28C16A4F3D3D.tmp
C:\WINDOWS\Temp\CS1DA38A27-9BEA-4A6E-BA10-27D94F48F2A6.tmp
C:\WINDOWS\Temp\CS2077A63D-BF93-425A-A5B6-15D0FF96248C.tmp
C:\WINDOWS\Temp\CS2127F2C8-20AA-45AA-8973-FA5F4479DF5D.tmp
C:\WINDOWS\Temp\CS22F0D8A7-3D5B-4ECE-9836-4F45E9C553FD.tmp
C:\WINDOWS\Temp\CS2626DBED-6768-47D2-9307-2B63385A2921.tmp
C:\WINDOWS\Temp\CS26ECE443-8A36-4D41-A203-C7FD17A4FFE4.tmp
C:\WINDOWS\Temp\CS2710392D-9DFE-4B32-BAD7-85D7CDB9BF63.tmp
C:\WINDOWS\Temp\CS27353C71-811D-4DEC-9CEA-718D95F1CAFE.tmp
C:\WINDOWS\Temp\CS2778350E-5293-4EAB-A5A1-D9CF3DFA8849.tmp
C:\WINDOWS\Temp\CS2920807B-79D9-4B46-BB50-FF8ABC297382.tmp
C:\WINDOWS\Temp\CS2D2E0B95-1347-4E06-AC5E-D22D3F92590B.tmp
C:\WINDOWS\Temp\CS2EEAF57A-1018-403A-8C7E-B72D7DC74F85.tmp
C:\WINDOWS\Temp\CS2F6F8EC1-EA97-4B6B-BC33-B658FC3A9B97.tmp
C:\WINDOWS\Temp\CS300BC720-8570-4ADC-AA92-29793921CECC.tmp
C:\WINDOWS\Temp\CS30340340-D745-4E16-823D-9384C8B8A7FB.tmp
C:\WINDOWS\Temp\CS33E66D18-0A45-4124-AFFC-C1D19CCD9B67.tmp
C:\WINDOWS\Temp\CS34D156FA-9245-40B6-BBE6-5DDE8584C7F1.tmp
C:\WINDOWS\Temp\CS3625E80C-B85A-446E-A4F1-BD4E35C6413F.tmp
C:\WINDOWS\Temp\CS39C9B17C-73FA-4714-A664-1A0166C04105.tmp
C:\WINDOWS\Temp\CS3A7D3A43-69D6-4772-B1F5-6131587DB48C.tmp
C:\WINDOWS\Temp\CS3ACA11AA-FC84-486C-A31D-252E5FF3B0EB.tmp
C:\WINDOWS\Temp\CS3B637F69-7705-43CB-88E8-8C15CB9E3340.tmp
C:\WINDOWS\Temp\CS3B8FCA83-5FCC-4468-9A99-A0F9BC39DF1D.tmp
C:\WINDOWS\Temp\CS3BE30051-543E-4931-896A-A14FE471C428.tmp
C:\WINDOWS\Temp\CS3C44FE52-C0F0-4BD5-A41D-1F0D599D9AEC.tmp
C:\WINDOWS\Temp\CS42CD4C45-326F-4C92-A8F8-8D773B63A449.tmp
C:\WINDOWS\Temp\CS446DBF36-6900-4E13-B775-ABB9FC9C8A3E.tmp
C:\WINDOWS\Temp\CS44E6B734-A7B5-464E-AD41-B8A03DCA0A6F.tmp
C:\WINDOWS\Temp\CS4634D9A0-2001-47BD-BA5F-32BA766FCE05.tmp
C:\WINDOWS\Temp\CS46653EC4-9E96-4EB7-B814-92C1EFDDBA99.tmp
C:\WINDOWS\Temp\CS4B1C95AD-B04E-4C82-992A-B7E4B50ABB00.tmp
C:\WINDOWS\Temp\CS4B677B52-2E18-43AF-AD84-3481C15407A5.tmp
C:\WINDOWS\Temp\CS4E742C7E-7F03-49DD-AC62-44CC036D71A1.tmp
C:\WINDOWS\Temp\CS4F29FDB2-3AA2-40F1-A2A7-91624F23F396.tmp
C:\WINDOWS\Temp\CS4F9C972F-4BFE-438B-8F13-B9B9A6A26C34.tmp
C:\WINDOWS\Temp\CS4FE6D498-E869-40B8-9B37-6C6A2E0D00D7.tmp
C:\WINDOWS\Temp\CS50C271BA-9F89-43E0-A1B8-D2760C015C60.tmp
C:\WINDOWS\Temp\CS516BFCAD-3798-4B30-8CD3-9C310EE3D418.tmp
C:\WINDOWS\Temp\CS53391823-791D-4DBE-AA57-AA10FFF188F7.tmp
C:\WINDOWS\Temp\CS55A4E10D-3F88-4A00-9986-F3EA843CA379.tmp
C:\WINDOWS\Temp\CS5BAFA236-5440-4B62-93B8-DA0DA40B9258.tmp
C:\WINDOWS\Temp\CS5C8FDEFF-F5FA-4919-B2D2-E04725A442AD.tmp
C:\WINDOWS\Temp\CS5D676979-D674-4BC8-B6F9-9B7677237DEE.tmp
C:\WINDOWS\Temp\CS5DF23444-5FAB-4344-B072-C0EAC1B9DBB2.tmp
C:\WINDOWS\Temp\CS62AFE4CC-2EBD-4F14-8E08-165EE1D12E42.tmp
C:\WINDOWS\Temp\CS6396DAB7-80D9-4F45-942A-6ED72CED3DE3.tmp
C:\WINDOWS\Temp\CS66B1964E-8C52-4C5A-A36E-0424D405F822.tmp
C:\WINDOWS\Temp\CS674515B7-F381-4414-AB15-BDB4FB8CF1E2.tmp
C:\WINDOWS\Temp\CS6B56B412-AFEB-41F6-BDD3-A463B0138606.tmp
C:\WINDOWS\Temp\CS6C8BF0D3-4685-432D-BE03-CB676C7C8770.tmp
C:\WINDOWS\Temp\CS6D2340C1-1129-46EE-8EA5-4B17989DC9EC.tmp
C:\WINDOWS\Temp\CS6D577819-67AC-4C22-A7E1-72D9EA327DA2.tmp
C:\WINDOWS\Temp\CS6E07EF3C-8A96-42F1-B46D-835B5899A5FB.tmp
C:\WINDOWS\Temp\CS6F133741-5870-40A6-83FD-E5F8A5D97F09.tmp
C:\WINDOWS\Temp\CS6F18F3C5-F2A4-4D59-AAE8-2475E30BCE71.tmp
C:\WINDOWS\Temp\CS72776A36-51B9-42F2-B271-06CBF5C0DA08.tmp
C:\WINDOWS\Temp\CS72B0A8BA-6A11-4108-AD6E-1DB976234745.tmp
C:\WINDOWS\Temp\CS72B2E7D8-EF76-4DC3-BE62-F9DBF32DBF13.tmp
C:\WINDOWS\Temp\CS731D107E-FD89-46A8-A910-62A72EF230F0.tmp
C:\WINDOWS\Temp\CS74E1C291-7434-464F-85D0-9C696700B2C3.tmp
C:\WINDOWS\Temp\CS74F4C710-F5C4-442D-96EE-F2078F5D9EAE.tmp
C:\WINDOWS\Temp\CS753B00E9-DBBF-4F90-A81E-E84AD7B95EE4.tmp
C:\WINDOWS\Temp\CS75D6EF3C-6B90-4BBA-8C7E-17167C5F8B69.tmp
C:\WINDOWS\Temp\CS75E13F77-E633-4ABD-AC4D-E735C9D03721.tmp
C:\WINDOWS\Temp\CS775AAECE-6BD3-4B0E-A7AE-7B806570A27A.tmp
C:\WINDOWS\Temp\CS77785991-83BA-41C1-81D6-D8655AA72FFB.tmp
C:\WINDOWS\Temp\CS796983BE-7F13-4B83-BB37-52A5E59F6E4D.tmp
C:\WINDOWS\Temp\CS7B4237FA-F630-48FB-BEDE-987298C9D4E1.tmp
C:\WINDOWS\Temp\CS7DDB2B16-6AE8-4906-90E0-829E3016D373.tmp
C:\WINDOWS\Temp\CS7EDEDF1E-46ED-417B-81C8-2DF1BA745A99.tmp
C:\WINDOWS\Temp\CS809583E3-D531-4777-B8F3-9A3CFEABD157.tmp
C:\WINDOWS\Temp\CS81BE8F10-8C60-45C3-9DF0-2D0ED9604A6E.tmp
C:\WINDOWS\Temp\CS820D981C-33AF-4569-A0DE-3A402495F8A1.tmp
C:\WINDOWS\Temp\CS836ABC7A-14B3-4B85-9F45-D06A5240D4B7.tmp
C:\WINDOWS\Temp\CS8484894F-2964-422C-A9D7-76447778CBDF.tmp
C:\WINDOWS\Temp\CS88B135F8-E2F8-4F2B-B6AA-310AFF491E73.tmp
C:\WINDOWS\Temp\CS8AA9C5BD-E49D-405C-A919-622401203250.tmp
C:\WINDOWS\Temp\CS8E6091C3-4838-43ED-B2AF-CC1F6066BD22.tmp
C:\WINDOWS\Temp\CS8FE2E6E1-A961-47D0-9DCA-513B353D77C9.tmp
C:\WINDOWS\Temp\CS94D118CA-2C95-4413-B857-BD9DE858579C.tmp
C:\WINDOWS\Temp\CS95F55F96-081D-469F-8447-B58C7539394B.tmp
C:\WINDOWS\Temp\CS9796EA0F-CB00-4894-AE85-C082C0CF1191.tmp
C:\WINDOWS\Temp\CS99EEBE30-1301-4193-A9D1-4128A55F410B.tmp
C:\WINDOWS\Temp\CS9A16A5C5-9839-4805-A849-6059CE6F9087.tmp
C:\WINDOWS\Temp\CS9B40EC80-8131-4A10-AAE6-C08EAB658C14.tmp
C:\WINDOWS\Temp\CS9CA60394-6BCF-484D-9032-F9530838D4BE.tmp
C:\WINDOWS\Temp\CS9D173DCA-8274-47FA-AF78-147EB4E0994B.tmp
C:\WINDOWS\Temp\CS9E116459-A26A-4676-8079-25E6590DE885.tmp
C:\WINDOWS\Temp\CS9EB4FB7D-D6E8-4753-8A1E-34A811E4CC99.tmp
C:\WINDOWS\Temp\CSA0C98893-1A05-467E-8EED-2530033A46F7.tmp
C:\WINDOWS\Temp\CSA363D9C2-33A4-4A6D-BCD4-94F2B5923A86.tmp
C:\WINDOWS\Temp\CSA3DB9509-304C-48CE-8B8A-6C5638C7795C.tmp
C:\WINDOWS\Temp\CSA59AB564-9182-40BE-984F-99D15E04A3E8.tmp
C:\WINDOWS\Temp\CSA82C2444-9290-436E-A5C3-41943122F556.tmp
C:\WINDOWS\Temp\CSA8377017-6E49-463C-839A-E05273CE6D34.tmp
C:\WINDOWS\Temp\CSAA1F0940-DB7E-4E08-89D4-A71BA3EC5F56.tmp
C:\WINDOWS\Temp\CSAA27197B-0BE3-4431-B4B3-E20509E50ED8.tmp
C:\WINDOWS\Temp\CSAEBF32A4-C31C-4A0B-8941-76F9E60888D9.tmp
C:\WINDOWS\Temp\CSAFCBEAE6-E4AF-406D-AE58-92F14EC99208.tmp
C:\WINDOWS\Temp\CSB04D74E5-2C09-417C-8990-C74F3A13FFDD.tmp
C:\WINDOWS\Temp\CSB270F683-1E56-4AF9-B8F6-810892987986.tmp
C:\WINDOWS\Temp\CSB3126E9E-23BC-4FC0-AF7E-9C6B7B3A9CAE.tmp
C:\WINDOWS\Temp\CSB3858156-F0C9-4646-A457-6BD7544E4C2F.tmp
C:\WINDOWS\Temp\CSB5EC3F64-3052-43F1-BF8C-523D1082EDD6.tmp
C:\WINDOWS\Temp\CSB62D4785-732F-41DC-97D7-B65ACF0BBAEA.tmp
C:\WINDOWS\Temp\CSB6A191F3-DB1F-4CE6-9D4B-0446417B86C8.tmp
C:\WINDOWS\Temp\CSB9A321E7-4852-4CEE-A54F-9F4AED32E594.tmp
C:\WINDOWS\Temp\CSC35651D0-B502-46CA-83FB-1804EED5FC97.tmp
C:\WINDOWS\Temp\CSC45884F0-253B-4A96-AE52-578D02A4E1D6.tmp
C:\WINDOWS\Temp\CSC508ECAC-8943-4457-83C8-3FBDCFBDA2A6.tmp
C:\WINDOWS\Temp\CSC6313797-E1C9-4FE6-9710-CA0D3BF5C5C7.tmp
C:\WINDOWS\Temp\CSC9883FEB-1FB8-4D9C-9D05-41225665E78D.tmp
C:\WINDOWS\Temp\CSCA1F7B19-EBB2-4209-AB65-A2551FBEF6AC.tmp
C:\WINDOWS\Temp\CSCA38CA00-045B-4B33-BADF-600DFA9B253A.tmp
C:\WINDOWS\Temp\CSCBCC9984-BC87-4B29-A819-E117839497A2.tmp
C:\WINDOWS\Temp\CSCBEE332C-583D-4056-B7EF-713DCC91CA0E.tmp
C:\WINDOWS\Temp\CSCE501EEB-720E-4059-93F5-60FD6D2BDEA6.tmp
C:\WINDOWS\Temp\CSD011F6CD-D29E-4383-99A4-45050629483E.tmp
C:\WINDOWS\Temp\CSD137BED0-72E7-437C-B4C0-F80BD2CBCF66.tmp
C:\WINDOWS\Temp\CSD1FCF2B9-9718-42B2-B350-43CA8DA8487E.tmp
C:\WINDOWS\Temp\CSD4A72F4D-20E3-4CA8-A4B0-66E0430A3F8E.tmp
C:\WINDOWS\Temp\CSD51CF0A8-5BCD-4773-89BC-E4A0880B5DD6.tmp
C:\WINDOWS\Temp\CSD85551D6-C163-45B8-862A-AEE38582D2B4.tmp
C:\WINDOWS\Temp\CSD8C38AD5-CDD0-4955-BF29-2C623ABFC8B9.tmp
C:\WINDOWS\Temp\CSDE61865F-D06A-4A05-8FDA-700CA9A0CCEB.tmp
C:\WINDOWS\Temp\CSDEAB130C-9367-4B79-AAE1-E786242908FF.tmp
C:\WINDOWS\Temp\CSDF12870C-4E3E-480F-A944-0A85D552000E.tmp
C:\WINDOWS\Temp\CSE0326903-A3DE-4B93-9737-02107B0D745C.tmp
C:\WINDOWS\Temp\CSE25D41FA-9F7C-48BA-B10E-EB68BFA4DAB7.tmp
C:\WINDOWS\Temp\CSE40F1E48-3A44-4869-AC50-AA23DDD1FBF6.tmp
C:\WINDOWS\Temp\CSE79633EA-9A0E-4D19-A41E-C117BDC15BDD.tmp
C:\WINDOWS\Temp\CSEA9F222A-4F0F-4C0F-9EF8-85B40A3C4D1F.tmp
C:\WINDOWS\Temp\CSEAF7DEC1-ECA3-4AB3-89EE-2AEE3B4F7D3F.tmp
C:\WINDOWS\Temp\CSEB3CE4A1-56F8-45A8-9A90-5E9A5AE372AC.tmp
C:\WINDOWS\Temp\CSEBE8AFBA-5687-491B-9610-C5607CB23239.tmp
C:\WINDOWS\Temp\CSEC70BA0A-C5A9-4410-8288-1FFD26F91924.tmp
C:\WINDOWS\Temp\CSED2CCBD6-3F42-4C07-91A5-9BD72179C01A.tmp
C:\WINDOWS\Temp\CSED633579-BA17-44AF-97BC-3ECA675CD0F4.tmp
C:\WINDOWS\Temp\CSEFBCEEF0-8A1A-4526-BAC1-88C7107EC028.tmp
C:\WINDOWS\Temp\CSEFD4FBC5-58FD-420F-8FB3-DE353E63FE8C.tmp
C:\WINDOWS\Temp\CSF13D11D2-E763-4C45-885E-17C502F308E7.tmp
C:\WINDOWS\Temp\CSF2DFA18B-988B-49A6-9314-BF85AD3AAC97.tmp
C:\WINDOWS\Temp\CSF33BE123-8433-4C46-B97F-87DAEFF0E502.tmp
C:\WINDOWS\Temp\CSF4419DC1-600A-4EAC-AE59-41EAA008A3BA.tmp
C:\WINDOWS\Temp\CSF5638B09-2CCD-4D11-80A2-604717CC481D.tmp
C:\WINDOWS\Temp\CSF6023305-A9F0-47BA-8624-96F27F6C7E2A.tmp
C:\WINDOWS\Temp\CSF6419184-D52A-41D2-96CE-3D6C7C433031.tmp
C:\WINDOWS\Temp\CSF894E149-1571-460E-AA5A-5DB9A5A7458D.tmp
C:\WINDOWS\Temp\CSF9E970F6-0CCA-4CA8-9E6C-3EE326465EF2.tmp
C:\WINDOWS\Temp\CSFC0B9E6F-A40E-47AF-A429-8C6B1BEC6018.tmp
C:\WINDOWS\Temp\CSFF948103-775F-4738-9543-B4E238CD1138.tmp

Folders to delete:
C:\Program Files\170B53C8
C:\Program Files\34E219B0



Start Avenger by double clicking on Avenger.exe.


Check Load script from file:

Click on the folder symbol below and to the right, and browse to RemoveFiles.txt.

Double click it to enter it into Avenger.

Click the green traffic light symbol.

You will be asked if you want to execute the script, answer Yes.

At this point you may get prompts from your protection systems, allow them please.

Avenger will set itself up to run the next time you re-boot, and will prompt you to re-start immediately.

Answer Yes, and allow your computer to re-boot.

Upon re-boot a command window will briefly appear on screen (this is normal).

A Notepad text file will be created C:\avenger.txt.

Copy and Paste it into your next post please, along with a new HJT log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI