What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Ive tried everything i know to do and still cant get rid of a few nasties. Advice please.

Logfile of HijackThis v1.99.1
Scan saved at 9:56:36 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\HP_Owner\Desktop\HiJackThis_v2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
Post #2
Hello and Welcome to the forum.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Post a new HijackThis Log.
Post #3
Logfile of HijackThis v1.99.1
Scan saved at 10:26:59 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\rqrsssq.dll
O2 - BHO: (no name) - {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF} - C:\WINDOWS\system32\ddcyx.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\system32\ddcyx.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: rqrsssq - C:\WINDOWS\SYSTEM32\rqrsssq.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
Post #4
* Download VirtumundoBegone, place it on your desktop.

Doubleclick VirtumundoBeGone.exe to start the tool.
Follow the instructions on the screen.
Don't worry if you'll get a Blue screen with an error in it - this is normal.
After reboot,

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present (some entries won't be present anymore):

O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\rqrsssq.dll
O2 - BHO: (no name) - {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF} - C:\WINDOWS\system32\ddcyx.dll
O20 - Winlogon Notify: ddcyx - C:\WINDOWS\system32\ddcyx.dll
O20 - Winlogon Notify: rqrsssq - C:\WINDOWS\SYSTEM32\rqrsssq.dll

* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Delete these files if listed:
C:\WINDOWS\system32\rqrsssq.dll
C:\WINDOWS\system32\ddcyx.dll


Empty Recycle Bin

Reboot

Post the contents of the log VBG.TXT which present on your desktop together with a new HijackThis log in your next reply.
Post #5
Logfile of HijackThis v1.99.1
Scan saved at 11:02:32 PM, on 5/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\Spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe



[05/19/2007, 22:39:12] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\HP_Owner\Desktop\VirtumundoBeGone.exe" )
[05/19/2007, 22:39:20] - Detected System Information:
[05/19/2007, 22:39:20] - Windows Version: 5.1.2600, Service Pack 2
[05/19/2007, 22:39:20] - Current Username: HP_Owner (Admin)
[05/19/2007, 22:39:20] - Windows is in NORMAL mode.
[05/19/2007, 22:39:20] - Searching for Browser Helper Objects:
[05/19/2007, 22:39:20] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[05/19/2007, 22:39:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:20] - Checking for HKLM\…\Winlogon\Notify\NppBho
[05/19/2007, 22:39:20] - Key not found: HKLM\…\Winlogon\Notify\NppBho, continuing.
[05/19/2007, 22:39:20] - BHO 2: {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} ()
[05/19/2007, 22:39:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:20] - Checking for HKLM\…\Winlogon\Notify\rqrsssq
[05/19/2007, 22:39:20] - Found: HKLM\…\Winlogon\Notify\rqrsssq - This is probably Virtumundo.
[05/19/2007, 22:39:20] - Assigning {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} MSEvents Object
[05/19/2007, 22:39:20] - BHO list has been changed! Starting over…
[05/19/2007, 22:39:21] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[05/19/2007, 22:39:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:21] - Checking for HKLM\…\Winlogon\Notify\NppBho
[05/19/2007, 22:39:21] - Key not found: HKLM\…\Winlogon\Notify\NppBho, continuing.
[05/19/2007, 22:39:21] - BHO 2: {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} (MSEvents Object)
[05/19/2007, 22:39:21] - ALERT: Found MSEvents Object!
[05/19/2007, 22:39:21] - BHO 3: {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF} ()
[05/19/2007, 22:39:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:21] - Checking for HKLM\…\Winlogon\Notify\ddcyx
[05/19/2007, 22:39:21] - Found: HKLM\…\Winlogon\Notify\ddcyx - This is probably Virtumundo.
[05/19/2007, 22:39:21] - Assigning {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF} MSEvents Object
[05/19/2007, 22:39:21] - BHO list has been changed! Starting over…
[05/19/2007, 22:39:21] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[05/19/2007, 22:39:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:21] - Checking for HKLM\…\Winlogon\Notify\NppBho
[05/19/2007, 22:39:21] - Key not found: HKLM\…\Winlogon\Notify\NppBho, continuing.
[05/19/2007, 22:39:21] - BHO 2: {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} (MSEvents Object)
[05/19/2007, 22:39:21] - ALERT: Found MSEvents Object!
[05/19/2007, 22:39:21] - BHO 3: {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF} (MSEvents Object)
[05/19/2007, 22:39:21] - ALERT: Found MSEvents Object!
[05/19/2007, 22:39:21] - Finished Searching Browser Helper Objects
[05/19/2007, 22:39:21] - *** Detected MSEvents Object
[05/19/2007, 22:39:21] - Trying to remove MSEvents Object…
[05/19/2007, 22:39:22] - Terminating Process: IEXPLORE.EXE
[05/19/2007, 22:39:23] - Terminating Process: RUNDLL32.EXE
[05/19/2007, 22:39:24] - Disabling Automatic Shell Restart
[05/19/2007, 22:39:24] - Terminating Process: EXPLORER.EXE
[05/19/2007, 22:39:25] - Suspending the NT Session Manager System Service
[05/19/2007, 22:39:25] - Terminating Windows NT Logon/Logoff Manager
[05/19/2007, 22:39:26] - Re-enabling Automatic Shell Restart
[05/19/2007, 22:39:26] - File to disable: C:\WINDOWS\system32\rqrsssq.dll
[05/19/2007, 22:39:26] - Renaming C:\WINDOWS\system32\rqrsssq.dll -> C:\WINDOWS\system32\rqrsssq.dll.vir
[05/19/2007, 22:39:26] - File successfully renamed!
[05/19/2007, 22:39:26] - Removing HKLM\…\Browser Helper Objects\{3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5}
[05/19/2007, 22:39:26] - Removing HKCR\CLSID\{3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5}
[05/19/2007, 22:39:26] - Adding Kill Bit for ActiveX for GUID: {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5}
[05/19/2007, 22:39:26] - Deleting ATLEvents/MSEvents Registry entries
[05/19/2007, 22:39:26] - Removing HKLM\…\Winlogon\Notify\rqrsssq
[05/19/2007, 22:39:26] - Searching for Browser Helper Objects:
[05/19/2007, 22:39:26] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[05/19/2007, 22:39:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:26] - Checking for HKLM\…\Winlogon\Notify\NppBho
[05/19/2007, 22:39:26] - Key not found: HKLM\…\Winlogon\Notify\NppBho, continuing.
[05/19/2007, 22:39:26] - BHO 2: {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF} (MSEvents Object)
[05/19/2007, 22:39:26] - ALERT: Found MSEvents Object!
[05/19/2007, 22:39:26] - Finished Searching Browser Helper Objects
[05/19/2007, 22:39:27] - *** Detected MSEvents Object
[05/19/2007, 22:39:27] - Trying to remove MSEvents Object…
[05/19/2007, 22:39:28] - Terminating Process: IEXPLORE.EXE
[05/19/2007, 22:39:28] - Terminating Process: RUNDLL32.EXE
[05/19/2007, 22:39:28] - Disabling Automatic Shell Restart
[05/19/2007, 22:39:28] - Terminating Process: EXPLORER.EXE
[05/19/2007, 22:39:28] - Suspending the NT Session Manager System Service
[05/19/2007, 22:39:28] - Terminating Windows NT Logon/Logoff Manager
[05/19/2007, 22:39:28] - Re-enabling Automatic Shell Restart
[05/19/2007, 22:39:28] - File to disable: C:\WINDOWS\system32\ddcyx.dll
[05/19/2007, 22:39:28] - Renaming C:\WINDOWS\system32\ddcyx.dll -> C:\WINDOWS\system32\ddcyx.dll.vir
[05/19/2007, 22:39:28] - File successfully renamed!
[05/19/2007, 22:39:28] - Removing HKLM\…\Browser Helper Objects\{ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF}
[05/19/2007, 22:39:28] - Removing HKCR\CLSID\{ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF}
[05/19/2007, 22:39:29] - Adding Kill Bit for ActiveX for GUID: {ABEBDBD7-6B91-4DD4-8C45-93CA0C84A1CF}
[05/19/2007, 22:39:29] - Deleting ATLEvents/MSEvents Registry entries
[05/19/2007, 22:39:29] - Removing HKLM\…\Winlogon\Notify\ddcyx
[05/19/2007, 22:39:29] - Searching for Browser Helper Objects:
[05/19/2007, 22:39:29] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[05/19/2007, 22:39:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/19/2007, 22:39:29] - Checking for HKLM\…\Winlogon\Notify\NppBho
[05/19/2007, 22:39:29] - Key not found: HKLM\…\Winlogon\Notify\NppBho, continuing.
[05/19/2007, 22:39:29] - Finished Searching Browser Helper Objects
[05/19/2007, 22:39:29] - Finishing up…
[05/19/2007, 22:39:29] - A restart is needed.
[05/19/2007, 22:40:36] - Attempting to Restart via STOP error (Blue Screen!)
Post #7
You can remove any programs I had you install. Use Add/Remove Programs to remove if listed there otherwise just delete them and empty recycle bin.

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.


Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

Only run one Anti-Virus and Firewall program.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware


Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #8
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI