What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Could you help me check my log?

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

There's a lot of virus, malware, adware, spyware in my pc. Just name it its there. For the past few days i have been scanning my com using various antiviruscans and spyware removers like mcafee,avast, avg, spybot search and destroy and spyware blaster but it still failed to remove those pest.

I've done what you requested me to do.

Here is the report of the AVG scan:
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 6:47:47 AM 12/3/2007

+ Scan result:



HKU\S-1-5-21-1960408961-413027322-1801674531-1004\Software\Microsoft\Internet Explorer\MenuExt\Add A Page Note -> Adware.CommonName : Ignored.
HKU\S-1-5-21-1960408961-413027322-1801674531-1004\Software\Microsoft\Internet Explorer\MenuExt\Bookmark This Page -> Adware.CommonName : Ignored.
HKU\S-1-5-21-1960408961-413027322-1801674531-1004\Software\Microsoft\Internet Explorer\MenuExt\Email This Link -> Adware.CommonName : Ignored.
C:\System Volume Information\_restore{693B11E9-9585-48AF-A6DA-CF368B69DC96}\RP710\A0067423.exe -> Downloader.Tiny.id : Ignored.
C:\System Volume Information\_restore{693B11E9-9585-48AF-A6DA-CF368B69DC96}\RP710\A0067421.exe -> Hijacker.VB.dn : Ignored.
C:\Program Files\Common Files\arc7.exe -> Hijacker.VB.ip : Ignored.
C:\Documents and Settings\user\Cookies\user@singtel.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored.
C:\Documents and Settings\user\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Ignored.
C:\Documents and Settings\user\Cookies\user@hitbox[2].txt -> TrackingCookie.Hitbox : Ignored.
C:\Documents and Settings\user\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Msn : Ignored.
C:\Documents and Settings\user\Cookies\user@revsci[2].txt -> TrackingCookie.Revsci : Ignored.
:mozilla.18:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.19:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.20:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.21:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.22:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.23:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.24:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.25:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3d8tnm0t.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.


::Report end

Here is the log for hijack this:Logfile of HijackThis v1.99.1
Scan saved at 6:52:22 AM, on 12/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {65B11CDC-8CA5-441E-A3EB-78DFAB07073C} - C:\WINDOWS\SYSTEM32\DDABA.DLL (file missing)
O2 - BHO: (no name) - {9B4868E3-767E-4A1C-A792-3CC451BA8CAC} - C:\WINDOWS\system32\iifdefc.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3900 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEP.EXE /FU "C:\WINDOWS\TEMP\E_S8A.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe"
O4 - HKLM\..\Run: [Windows Drive Source] rwmsp.exe
O4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Program Files\Stop-the-Pop-Up Lite\stopthepop.exe" -minimized
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\system32\spooIsv.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Blue Frog] C:\Program Files\Blue Security\bluefrog.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {070CA17A-4BD2-4612-83B4-32B1B9159B47} (ULiveCtrl Control) - http://uc.sina.com.cn/download/live/weblive2.4.0.0.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: iifdefc - iifdefc.dll (file missing)
O20 - Winlogon Notify: mfrdcumt - mfrdcumt.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Windows System Viewer (wsvsvc) - Unknown owner - C:\WINDOWS\system\usrsvc.exe (file missing)

Could you help me please. Thank you.
Post #2
Sorry for the delay


Lets run combofix.exe
Download it from one of the links below:
Note:
It is important that it is saved directly to your desktop
http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/combofix.exe

Double click combofix.exe & follow the prompts.
When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI