Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93104 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

HijackThis Log Please Help


  • Please log in to reply
23 replies to this topic

#1 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 29 October 2007 - 11:26 PM

Hi, thank you for taking the time to look at my log. I have been having trouble in the following areas: 1. I am being hijacked repeatedly 2. Pop-Ups are popping up on my computer even when I am not online. 3. The background to my desktop will not display correctly, and after using Spybot S&D all that shows up is a blank white screen along with my icons. This is my log file, Please take a look. Logfile of HijackThis v1.99.1 Scan saved at 10:12:10 PM, on 10/29/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\Program Files\hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O20 - Winlogon Notify: cbxxy - C:\WINDOWS\System32\cbxxy.dll O20 - Winlogon Notify: fccdd - C:\WINDOWS\System32\fccdd.dll O20 - Winlogon Notify: hggfc - C:\WINDOWS\System32\hggfc.dll O20 - Winlogon Notify: iifda - C:\WINDOWS\System32\iifda.dll O20 - Winlogon Notify: khfgd - C:\WINDOWS\System32\khfgd.dll O20 - Winlogon Notify: khfgf - C:\WINDOWS\System32\khfgf.dll (file missing) O20 - Winlogon Notify: mljgeeb - C:\WINDOWS\SYSTEM32\mljgeeb.dll O20 - Winlogon Notify: nnnnljj - C:\WINDOWS\SYSTEM32\nnnnljj.dll O20 - Winlogon Notify: rqrpm - C:\WINDOWS\System32\rqrpm.dll O20 - Winlogon Notify: urqom - C:\WINDOWS\System32\urqom.dll O20 - Winlogon Notify: ursst - C:\WINDOWS\System32\ursst.dll O20 - Winlogon Notify: vtspm - C:\WINDOWS\System32\vtspm.dll O20 - Winlogon Notify: wvwts - C:\WINDOWS\System32\wvwts.dll O21 - SSODL: syscore - {CE020092-AAB5-4D12-AA21-B7F63F51E174} - C:\WINDOWS\syscore.dll O21 - SSODL: mssql - {82040551-9E90-458F-8E9E-29E1DA5B66C7} - C:\WINDOWS\mssql.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

    Advertisements

Register to Remove


#2 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 30 October 2007 - 07:59 AM

Hi and welcome to the forums. :) I'm Markka and I will be helping you with your malware issues. I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by teachers of Malware Removal University. Please be patient. :)

#3 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 31 October 2007 - 08:26 AM

Hello :)

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall!
____________________

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free...mitfraudFix.exe

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.
_______________________

Looking over your log, it seems you don't have any evidence of an anti-virus software.

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.
__________________

Post:
- A fresh HijackThis log
- Contents of C:\ComboFix.txt
- Contents of C:\Rapport.txt

#4 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 01 November 2007 - 12:27 AM

Here are the logs you requested. Thank you for the tips you suggested about the anti-virus software. I have McAfee but I have yet to install it.

Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 11:17:40 PM, on 10/31/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O20 - Winlogon Notify: cbxxy - C:\WINDOWS\System32\cbxxy.dll
O20 - Winlogon Notify: fccdd - C:\WINDOWS\System32\fccdd.dll
O20 - Winlogon Notify: hggfc - C:\WINDOWS\System32\hggfc.dll
O20 - Winlogon Notify: khfgd - C:\WINDOWS\System32\khfgd.dll
O20 - Winlogon Notify: khfgf - C:\WINDOWS\System32\khfgf.dll (file missing)
O20 - Winlogon Notify: nnnnljj - C:\WINDOWS\SYSTEM32\nnnnljj.dll
O20 - Winlogon Notify: rqrpm - C:\WINDOWS\System32\rqrpm.dll
O20 - Winlogon Notify: urqom - C:\WINDOWS\System32\urqom.dll
O20 - Winlogon Notify: vtspm - C:\WINDOWS\System32\vtspm.dll
O20 - Winlogon Notify: wvwts - C:\WINDOWS\System32\wvwts.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Combofix log:

ComboFix 07-11-01.1 - Tai 2007-10-31 23:02:48.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.285 [GMT -8:00]
Running from: F:\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\Tai\Application Data\installer_en[1].exe
C:\Documents and Settings\Tai\Desktop\Error Cleaner.url
C:\Documents and Settings\Tai\Desktop\Privacy Protector.url
C:\Documents and Settings\Tai\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Tai\err.log
C:\Documents and Settings\Tai\Favorites\Error Cleaner.url
C:\Documents and Settings\Tai\Favorites\Privacy Protector.url
C:\Documents and Settings\Tai\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Tai\ResErrors.log
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll
C:\Program Files\Insider
C:\Program Files\Insider\Insider.exe
C:\Program Files\Insider\UnInstall.exe
C:\Program Files\ISM2
C:\Program Files\ISM2\dictionary.gz
C:\Program Files\ISM2\targets.gz
C:\Program Files\Words
C:\Program Files\Words\list.txt
C:\Program Files\Words\script.txt
C:\Redemption.ECF
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\xOe
C:\Temp\xOe\tOasF.log
C:\WINDOWS\b147.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files.\xpreload.ocx
C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N99M2908NetInstaller.exe
C:\WINDOWS\main_uninstaller.exe
C:\WINDOWS\msmdev.dll
C:\WINDOWS\msmhost.dll
C:\WINDOWS\mssql.dll
C:\WINDOWS\nsduo.dll
C:\WINDOWS\privacy_danger
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\syscore.dll
C:\WINDOWS\system32\adfii.bak1
C:\WINDOWS\system32\adfii.ini
C:\WINDOWS\system32\cfggh.bak1
C:\WINDOWS\system32\cfggh.ini
C:\WINDOWS\system32\ddccf.bak1
C:\WINDOWS\system32\ddccf.ini
C:\WINDOWS\system32\dgfhk.bak1
C:\WINDOWS\system32\dgfhk.bak2
C:\WINDOWS\system32\dgfhk.ini
C:\WINDOWS\system32\fgfhk.bak1
C:\WINDOWS\system32\fgfhk.ini
C:\WINDOWS\system32\hggdccb.dll
C:\WINDOWS\system32\hhhjl.bak1
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\iifda.dll
C:\WINDOWS\system32\kkjjl.bak1
C:\WINDOWS\system32\kkjjl.bak2
C:\WINDOWS\system32\ljjkk.dll
C:\WINDOWS\system32\mljgeeb.dll
C:\WINDOWS\system32\moqru.bak1
C:\WINDOWS\system32\moqru.tmp
C:\WINDOWS\system32\mprqr.bak1
C:\WINDOWS\system32\mprqr.bak2
C:\WINDOWS\system32\mprqr.ini
C:\WINDOWS\system32\mprqr.ini2
C:\WINDOWS\system32\mprqr.tmp
C:\WINDOWS\system32\opnlklj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhi.dll
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\stwvw.bak1
C:\WINDOWS\system32\stwvw.ini
C:\WINDOWS\system32\stwvw.tmp
C:\WINDOWS\system32\sulimo.dat
C:\WINDOWS\system32\tssru.ini
C:\WINDOWS\system32\ursst.dll
C:\WINDOWS\system32\vMW02a
C:\WINDOWS\system32\vMW02a\vMW02a1065.exe
C:\WINDOWS\system32\yxxbc.bak1
C:\WINDOWS\system32\yxxbc.ini
C:\WINDOWS\tsitra572.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPN


((((((((((((((((((((((((( Files Created from 2007-10-01 to 2007-11-01 )))))))))))))))))))))))))))))))
.

2007-10-31 23:02 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 22:13 <DIR> d-------- C:\Documents and Settings\Tai\Application Data\U3
2007-10-21 20:36 <DIR> d-------- C:\Program Files\New Folder
2007-10-21 16:40 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-21 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-21 14:31 <DIR> d-------- C:\Program Files\Google
2007-10-21 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-10-13 16:53 83,008 --a------ C:\WINDOWS\system32\fcvqsbmt.dll
2007-10-05 21:56 <DIR> d-------- C:\Program Files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2154-11-18 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2154-11-18 18:12 --------- d-----w C:\Program Files\Connection Wizard
2154-11-18 17:53 --------- d-----w C:\Program Files\Yahoo!
2007-10-22 17:42 --------- d-----w C:\Program Files\SecurePCCleaner
2007-10-22 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-22 00:59 --------- d-----w C:\Documents and Settings\Tai\Application Data\MSN6
2007-10-11 16:49 --------- d-----w C:\Program Files\LexmarkX83
2007-10-01 11:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-23 06:24 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-16 16:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot
2007-09-12 15:01 --------- d-----w C:\Program Files\MSN Messenger
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 22:44]
"CountrySelection"="pctptt.exe" [2001-03-22 02:08 C:\WINDOWS\system32\pctptt.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ActiveDesktop"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxxy]
C:\WINDOWS\System32\cbxxy.dll 2007-09-29 22:19 283232 C:\WINDOWS\system32\cbxxy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdd]
C:\WINDOWS\System32\fccdd.dll 2007-09-30 13:13 283232 C:\WINDOWS\system32\fccdd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfc]
C:\WINDOWS\System32\hggfc.dll 2007-09-29 11:12 283232 C:\WINDOWS\system32\hggfc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgd]
C:\WINDOWS\System32\khfgd.dll 2007-09-28 19:27 283232 C:\WINDOWS\system32\khfgd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgf]
C:\WINDOWS\System32\khfgf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnljj]
nnnnljj.dll 2007-09-26 12:28 23552 C:\WINDOWS\system32\nnnnljj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpm]
C:\WINDOWS\System32\rqrpm.dll 2007-09-27 21:27 283232 C:\WINDOWS\system32\rqrpm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqom]
C:\WINDOWS\System32\urqom.dll 2007-09-26 14:54 283744 C:\WINDOWS\system32\urqom.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtspm]
C:\WINDOWS\System32\vtspm.dll 2007-09-28 14:48 283232 C:\WINDOWS\system32\vtspm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvwts]
C:\WINDOWS\System32\wvwts.dll 2007-09-28 06:08 283232 C:\WINDOWS\system32\wvwts.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

R2 Pctspk;W2k PCtel speaker phone;C:\WINDOWS\system32\pctspk.exe
R3 SiS630;SiS630;C:\WINDOWS\System32\DRIVERS\sis630p.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys
S3 Ip6FwHlp;IPv6 Internet Connection Firewall;C:\WINDOWS\System32\svchost.exe -k netsvcs

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-31 23:06:19
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-10-31 23:07:36 - machine was rebooted
.
--- E O F ---


Rapport:

SmitFraudFix v2.246

Scan done at 23:12:26.87, Wed 10/31/2007
Run from C:\Documents and Settings\Tai\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tai


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tai\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Tai\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: SiS 900 PCI Fast Ethernet Adapter
DNS Server Search Order: 192.168.0.1
DNS Server Search Order: 205.171.3.65

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3BCF5D96-10ED-480A-A53F-D6476C805ADA}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B569F630-BAA8-4F02-AA15-D6B3C882A23A}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3BCF5D96-10ED-480A-A53F-D6476C805ADA}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B569F630-BAA8-4F02-AA15-D6B3C882A23A}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3BCF5D96-10ED-480A-A53F-D6476C805ADA}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B569F630-BAA8-4F02-AA15-D6B3C882A23A}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.65


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

#5 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 01 November 2007 - 08:49 AM

Hello :)

Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows except HijackThis and press fix checked.

O20 - Winlogon Notify: cbxxy - C:\WINDOWS\System32\cbxxy.dll
O20 - Winlogon Notify: fccdd - C:\WINDOWS\System32\fccdd.dll
O20 - Winlogon Notify: hggfc - C:\WINDOWS\System32\hggfc.dll
O20 - Winlogon Notify: khfgd - C:\WINDOWS\System32\khfgd.dll
O20 - Winlogon Notify: khfgf - C:\WINDOWS\System32\khfgf.dll (file missing)
O20 - Winlogon Notify: nnnnljj - C:\WINDOWS\SYSTEM32\nnnnljj.dll
O20 - Winlogon Notify: rqrpm - C:\WINDOWS\System32\rqrpm.dll
O20 - Winlogon Notify: urqom - C:\WINDOWS\System32\urqom.dll
O20 - Winlogon Notify: vtspm - C:\WINDOWS\System32\vtspm.dll
O20 - Winlogon Notify: wvwts - C:\WINDOWS\System32\wvwts.dll

________________

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\System32\fccdd.dll
C:\WINDOWS\System32\hggfc.dll
C:\WINDOWS\System32\khfgd.dll
C:\WINDOWS\System32\khfgf.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\WINDOWS\System32\rqrpm.dll
C:\WINDOWS\System32\urqom.dll
C:\WINDOWS\System32\vtspm.dll
C:\WINDOWS\system32\fcvqsbmt.dll
C:\WINDOWS\System32\cbxxy.dll
C:\WINDOWS\System32\wvwts.dll

Folder::
C:\Program Files\SecurePCCleaner


Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.

#6 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 01 November 2007 - 03:39 PM

Combofix Log

ComboFix 07-11-01.1 - Tai 2007-11-01 14:28:39.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.297 [GMT -8:00]
Running from: F:\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tai\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\System32\cbxxy.dll
C:\WINDOWS\System32\fccdd.dll
C:\WINDOWS\System32\fcvqsbmt.dll
C:\WINDOWS\System32\hggfc.dll
C:\WINDOWS\System32\khfgd.dll
C:\WINDOWS\System32\khfgf.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\WINDOWS\System32\rqrpm.dll
C:\WINDOWS\System32\urqom.dll
C:\WINDOWS\System32\vtspm.dll
C:\WINDOWS\System32\wvwts.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\SecurePCCleaner
C:\Program Files\SecurePCCleaner\UGDCcw.exe_tobedeleted
C:\WINDOWS\System32\cbxxy.dll
C:\WINDOWS\System32\fccdd.dll
C:\WINDOWS\System32\fcvqsbmt.dll
C:\WINDOWS\System32\hggfc.dll
C:\WINDOWS\System32\khfgd.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\WINDOWS\System32\rqrpm.dll
C:\WINDOWS\System32\urqom.dll
C:\WINDOWS\System32\vtspm.dll
C:\WINDOWS\System32\wvwts.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-01 to 2007-11-01 )))))))))))))))))))))))))))))))
.

2007-10-31 23:12 440 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-31 23:11 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-31 23:11 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-31 23:11 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-31 23:11 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-31 23:11 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-31 23:02 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 22:13 <DIR> d-------- C:\Documents and Settings\Tai\Application Data\U3
2007-10-21 20:36 <DIR> d-------- C:\Program Files\New Folder
2007-10-21 16:40 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-21 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-21 14:31 <DIR> d-------- C:\Program Files\Google
2007-10-21 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-10-05 21:56 <DIR> d-------- C:\Program Files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2154-11-18 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2154-11-18 18:12 --------- d-----w C:\Program Files\Connection Wizard
2154-11-18 17:53 --------- d-----w C:\Program Files\Yahoo!
2007-10-22 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-22 00:59 --------- d-----w C:\Documents and Settings\Tai\Application Data\MSN6
2007-10-11 16:49 --------- d-----w C:\Program Files\LexmarkX83
2007-10-01 11:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-23 06:24 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-16 16:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot
2007-09-12 15:01 --------- d-----w C:\Program Files\MSN Messenger
.

((((((((((((((((((((((((((((( snapshot@2007-10-31_23.06.32.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-01 07:02:44 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat
+ 2007-11-01 22:28:32 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat
- 2007-10-30 06:15:12 52,968 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-01 07:07:11 52,968 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-10-30 06:15:12 380,680 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-01 07:07:11 380,680 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 22:44]
"CountrySelection"="pctptt.exe" [2001-03-22 02:08 C:\WINDOWS\system32\pctptt.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ActiveDesktop"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

R3 SiS630;SiS630;C:\WINDOWS\System32\DRIVERS\sis630p.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 14:32:09
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-11-01 14:33:21 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-31 23:07
.
--- E O F ---




Hijackthis log


Logfile of HijackThis v1.99.1
Scan saved at 2:33:58 PM, on 11/1/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Thanks again

#7 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 02 November 2007 - 02:00 PM

Hello :)

Looking over your log, it seems you don't have any evidence of an anti-virus software.

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.


;)
__________________

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
____________________

Please download ATF-cleaner and save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

    If you use Firefox browser:

  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser:

  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
_____________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      Posted Image
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.


Post a fresh HijackThis log & AVG Anti-Spyware's report.

#8 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 05 November 2007 - 04:50 PM

I will repost

Edited by Josh503, 05 November 2007 - 05:05 PM.


#9 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 06 November 2007 - 01:50 PM

HijackThis Log


Logfile of HijackThis v1.99.1
Scan saved at 12:45:07 PM, on 11/6/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe



---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:38:57 PM 11/6/2007

+ Scan result:



C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149453.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149454.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154352.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154353.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0148878.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0148879.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0153782.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0153783.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137259.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137260.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153743.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153744.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP148\A0077762.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP149\A0079763.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP149\A0087765.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP149\A0095774.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP150\A0103790.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0123006.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP171\A0157629.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Program Files\Common Files\Companion Wizard\WapCHK.dll.vir -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP146\A0073508.DLL -> Adware.FunWeb : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Error during cleaning.
HKU\S-1-5-21-1409082233-1580818891-1343024091-1004\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0148882.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149456.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149457.exe -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149458.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149460.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149461.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149463.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149464.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149468.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149472.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149473.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149475.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149476.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0153786.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154355.exe -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154357.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154358.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154360.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154361.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154365.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154369.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154370.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154372.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154373.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154382.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154383.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0123008.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137250.exe -> Adware.ZQuest : Cleaned with backup (quarantined).
C:\Documents and Settings\Tai\My Documents\My Downloads\installdrivecleanerstart.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137273.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153746.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0123012.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0122959.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149357.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149358.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154259.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149459.exe -> Trojan.Holax.E : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154356.exe -> Trojan.Holax.E : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137257.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137258.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149356.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153742.vbs -> Trojan.Small : Cleaned with backup (quarantined).


::Report end

#10 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 07 November 2007 - 08:10 AM

Hello :)

Kaspersky online scanner works only with Internet Explorer!

Please run an online scanner with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:

    o Scan using the following Anti-Virus database:

    + Extended (If available otherwise Standard)

    o Scan Options:

    + Scan Archives
    + Scan Mail Bases

  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Post a fresh HijackThis log & Kaspersky's report.

    Advertisements

Register to Remove


#11 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 08 November 2007 - 12:40 AM

I am working on a computer that does not have internet capabilities at the moment. This computer is badly infected, and does not run normally/efficiently and is not on the internet

#12 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 08 November 2007 - 08:29 AM

Hello :)

OK, then we need to run this scanner:

Please Download Dr.Web CureIt and save it to your desktop.

Run a scan with Dr.Web CureIt
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, you should now mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found Posted Image
  • If so, click it and then click the next icon right below and select Move incurable
  • After the scan, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Post the Cure-it report and a fresh HijackThis log


#13 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 08 November 2007 - 04:56 PM

Here's the latest Logfile of HijackThis v1.99.1 Scan saved at 2:22:40 PM, on 11/8/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\hijackthis\HijackThis.exe O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe DrWeb: 30898830.FIL;C:\$VAULT$.AVG;Trojan.Rond;Deleted.; 30898880.FIL;C:\$VAULT$.AVG;Trojan.Rond;Deleted.; 30898940.FIL;C:\$VAULT$.AVG;Adware.Msm;Incurable.Moved.; 30899020.FIL;C:\$VAULT$.AVG;Trojan.DownLoader.31817;Deleted.; 30899641.FIL;C:\$VAULT$.AVG;Trojan.Virtumod.206;Deleted.; 30900172.FIL;C:\$VAULT$.AVG;Trojan.DownLoader.24715;Deleted.; 46248511.FIL;C:\$VAULT$.AVG;Trojan.StartPage.19993;Deleted.; LostRun.exe;C:\Documents and Settings\Administrator\DoctorWeb\Quarantine;BackDoor.Graybird.origin;Incurable.Moved.; lxas2kpm.dll;C:\Documents and Settings\Administrator\DoctorWeb\Quarantine;Trojan.Flashfxp.origin;Incurable.Moved.; Process.exe;C:\Documents and Settings\Administrator\DoctorWeb\Quarantine;Tool.Prockill;Incurable.Moved.; Process.exe;C:\Documents and Settings\Tai\Desktop\SmitfraudFix;Tool.Prockill;Incurable.Moved.; restart.exe;C:\Documents and Settings\Tai\Desktop\SmitfraudFix;Tool.ShutDown.11;Incurable.Moved.; setup.exe;C:\Program Files\Common Files\AOL\Backup\ACS\Current\Suite;Probably BACKDOOR.Trojan;Incurable.Moved.; WebColps.dll;C:\Program Files\Common Files\Logitech\WebColct;Adware.Altnet;Incurable.Moved.; backup-20071022-183859-108-Reboot.exe;C:\Program Files\hijackthis\backups;Trojan.Reboter;Deleted.; riched20.dll;C:\Program Files\MSN Messenger;Adware.Msearch;Incurable.Moved.; modem_common.js;C:\Program Files\Qwest\QuickCare\agentcommon\inc;Probably SCRIPT.Virus;Incurable.Moved.; sma_common.js;C:\Program Files\Qwest\QuickCare\agentui\snapins\preferences;Probably SCRIPT.Virus;Incurable.Moved.; sprtsync.dll;C:\Program Files\Qwest\QuickCare\bin;Probably DLOADER.Trojan;Incurable.Moved.; installer_en[1].exe.vir;C:\qoobox\Quarantine\C\Documents and Settings\Tai\Application Data;Trojan.Fakealert.311;Deleted.; main_uninstaller.exe.vir;C:\qoobox\Quarantine\C\WINDOWS;Adware.Mygeek;Incurable.Moved.; msmdev.dll.vir;C:\qoobox\Quarantine\C\WINDOWS;Adware.Msm;Incurable.Moved.; msmhost.dll.vir;C:\qoobox\Quarantine\C\WINDOWS;Adware.Msm;Incurable.Moved.; UWA7P_0001_N99M2908NetInstaller.exe.vir;C:\qoobox\Quarantine\C\WINDOWS\Downloaded Program Files;Trojan.DownLoader.10963;Deleted.; sulimo.dat.vir;C:\qoobox\Quarantine\C\WINDOWS\system32;Trojan.Proxy.1739;Deleted.; Thanks,

#14 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 09 November 2007 - 01:44 PM

Hello :)

Navigate to here: (Using windows explorer; windows key +e)

C:\Documents and Settings\Administrator\DoctorWeb\Quarantine

Check this file setup.exe and move it to here: C:\Program Files\Common Files\AOL\Backup\ACS\Current\Suite

Check this file WebColps.dll and move it to here: C:\Program Files\Common Files\Logitech\WebColct

Delete these folders: (Using windows explorer; windows key +e)

C:\qoobox
C:\Program Files\hijackthis\backups

Empty this folder: (Using windows explorer; windows key +e)

C:\Documents and Settings\Administrator\DoctorWeb\Quarantine
_____________________

Disable system restore:
  • Right click on my computer icon
  • Choose properties
  • Click on system restore tab
  • Select Turn off System Restore
  • Click apply and click OK
  • Reboot!
Enable system restore:
  • Right click on my computer icon
  • Choose properties
  • Click on system restore tab
  • un-check Turn off System Restore
  • Click apply and click OK
  • Reboot!
____________________

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 3 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u3...allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Read the License Agreement and then check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.
Post a fresh HijackThis log.

#15 Josh503

Josh503

    New Member

  • New Member
  • Pip
  • 12 posts

Posted 10 November 2007 - 02:39 AM

The folder C:\Documents and settings\administrator\doctorweb\quarantine does not contain setup.exe therefore I can not move it to the specified folder. While I was waiting for you to reply to my last post I was running and Ad-Aware Scan and I deleted what came up with the results, however I'm not sure if this had something to do with it. These folders are here shall I continue deleting them without moving the setup.exe file?? C:\qoobox C:\program files\hijackthis\backups C:\Documents and Settings\Administrator\DoctorWeb\Quarantine

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users