What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] gomyhit virus problems

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My brothers computer has a virus now, from what I can tell it is the "Gomyhit" virus which seems to be pretty nasty. After an avg and a superantispyware scan it still seems to have a few problems, the most obvious of which is an error message that appears upon logging in on any username

"Windows cannot find 'C:\WINDOWS\shell.exe'. Make sure you typed the name correctly, and then try again… "


I am just home for the weekend from school so any help would be appreciated as the rest of my family is somewhat computer illiterate.

Here is the Hjt log:

Logfile of HijackThis v1.99.1
Scan saved at 2:53:18 PM, on 1/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\anvshell.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe
C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE…h3Jzg6frwFv6Y+h
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/&s=Hd0VmgdoNhJgkZDt-Q2_GNZEfsA
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {414D3191-A0C8-4CF7-A243-C71D243B7665} - C:\Program Files\WindowsUpdate\hokew83122.dll (file missing)
O2 - BHO: (no name) - {4EE9F659-D14C-4814-B396-564858202167} - C:\Program Files\WindowsUpdate\hokew4444.dll (file missing)
O2 - BHO: (no name) - {93DBF74D-66A9-192A-892E-39E671815CC4} - C:\WINDOWS\system32\xdsgyfk.dll
O2 - BHO: (no name) - {94DB8642-66A0-1C2A-8928-38E679F35CC5} - C:\WINDOWS\system32\xdsgyfk.dll
O2 - BHO: (no name) - {97a90b73-9c1d-4da7-b49f-a01d64dfbfe5} - C:\WINDOWS\system32\uhpfoec.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {E1759A31-E627-4758-9562-6899DF36C9C2} - C:\WINDOWS\system32\fccddeb.dll (file missing)
O2 - BHO: (no name) - {ED5D93EC-A003-4328-A7B8-05D02AF919F9} - C:\WINDOWS\system32\gebcc.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [VirusProtectPro 3.3] "C:\Program Files\VirusProtectPro 3.3\VirusProtectPro 3.3.exe" /h
O4 - Global Startup: Instant Update Reminder.lnk = ?
O4 - Global Startup: U.S. Robotics Internet Call Notification.lnk = C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100914577623
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://download.shockwave.com/pub/otoy/OTOYAX.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccddeb - fccddeb.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Documents and Settings\Tyler\Desktop\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nvmootven - NVIDIA Corporation - (no file)
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #2
Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.




Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
Post #3
The above steps have been completed… here are the new log files.


SmitFraudFix v2.274

Scan done at 10:50:54.98, Sat 01/26/2008
Run from C:\Documents and Settings\TylerTwo\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

10.18.250.4 ad.doubleclick.net
10.18.250.4 ad.fastclick.net
10.18.250.4 ads.fastclick.net
10.18.250.4 ar.atwola.com
10.18.250.4 atdmt.com
10.18.250.4 avp.ch
10.18.250.4 avp.com
10.18.250.4 avp.ru
10.18.250.4 awaps.net
10.18.250.4 banner.fastclick.net
10.18.250.4 banners.fastclick.net
10.18.250.4 ca.com
10.18.250.4 click.atdmt.com
10.18.250.4 clicks.atdmt.com
10.18.250.4 customer.symantec.com
10.18.250.4 dispatch.mcafee.com
10.18.250.4 download.mcafee.com
10.18.250.4 downloads-us1.kaspersky-labs.com
10.18.250.4 downloads-us2.kaspersky-labs.com
10.18.250.4 downloads-us3.kaspersky-labs.com
10.18.250.4 downloads1.kaspersky-labs.com
10.18.250.4 downloads2.kaspersky-labs.com
10.18.250.4 downloads3.kaspersky-labs.com
10.18.250.4 downloads4.kaspersky-labs.com
10.18.250.4 engine.awaps.net
10.18.250.4 f-secure.com
10.18.250.4 fastclick.net
10.18.250.4 ftp.avp.ch
10.18.250.4 ftp.downloads1.kaspersky-labs.com
10.18.250.4 ftp.downloads2.kaspersky-labs.com
10.18.250.4 ftp.downloads3.kaspersky-labs.com
10.18.250.4 ftp.f-secure.com
10.18.250.4 ftp.kasperskylab.ru
10.18.250.4 ftp.sophos.com
10.18.250.4 ids.kaspersky-labs.com
10.18.250.4 kaspersky-labs.com
10.18.250.4 kaspersky.com
10.18.250.4 liveupdate.symantec.com
10.18.250.4 liveupdate.symantecliveupdate.com
10.18.250.4 mast.mcafee.com
10.18.250.4 mcafee.com
10.18.250.4 media.fastclick.net
10.18.250.4 my-etrust.com
10.18.250.4 nai.com
10.18.250.4 networkassociates.com
10.18.250.4 norton.com
10.18.250.4 phx.corporate-ir.net
10.18.250.4 rads.mcafee.com
10.18.250.4 secure.nai.com
10.18.250.4 securityresponse.symantec.com
10.18.250.4 service1.symantec.com
10.18.250.4 sophos.com
10.18.250.4 spd.atdmt.com
10.18.250.4 symantec.com
10.18.250.4 trendmicro.com
10.18.250.4 update.symantec.com
10.18.250.4 updates.symantec.com
10.18.250.4 updates1.kaspersky-labs.com
10.18.250.4 updates2.kaspersky-labs.com
10.18.250.4 updates3.kaspersky-labs.com
10.18.250.4 updates4.kaspersky-labs.com
10.18.250.4 updates5.kaspersky-labs.com
10.18.250.4 us.mcafee.com
10.18.250.4 vil.nai.com
10.18.250.4 viruslist.com
10.18.250.4 viruslist.ru
10.18.250.4 virusscan.jotti.org
10.18.250.4 virustotal.com
10.18.250.4 www.avp.ch
10.18.250.4 www.avp.com
10.18.250.4 www.avp.ru
10.18.250.4 www.awaps.net
10.18.250.4 www.ca.com
10.18.250.4 www.f-secure.com
10.18.250.4 www.fastclick.net
10.18.250.4 www.grisoft.com
10.18.250.4 www.kaspersky-labs.com
10.18.250.4 www.kaspersky.com
10.18.250.4 www.kaspersky.ru
10.18.250.4 www.mcafee.com
10.18.250.4 www.my-etrust.com
10.18.250.4 www.nai.com
10.18.250.4 www.networkassociates.com
10.18.250.4 www.sophos.com
10.18.250.4 www.symantec.com
10.18.250.4 www.trendmicro.com
10.18.250.4 www.viruslist.com
10.18.250.4 www.viruslist.ru
10.18.250.4 www.virustotal.com

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{8AE1CB88-C677-4B8D-A500-CFE9A4BB7F90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8AE1CB88-C677-4B8D-A500-CFE9A4BB7F90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{8AE1CB88-C677-4B8D-A500-CFE9A4BB7F90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End








Deckard's System Scanner v20071014.68
Run by [removed] on 2008-01-26 10:57:07
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
107: 2008-01-26 16:57:14 UTC - RP767 - Deckard's System Scanner Restore Point
106: 2008-01-25 19:06:29 UTC - RP766 - Software Distribution Service 3.0
105: 2008-01-25 18:54:12 UTC - RP765 - Software Distribution Service 3.0
104: 2008-01-24 23:47:15 UTC - RP764 - Removed Windows Media Encoder 9 Series
103: 2008-01-24 23:46:28 UTC - RP763 - Removed Windows Live Sign-in Assistant


– First Restore Point –
1: 2008-01-07 01:25:12 UTC - RP661 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as TylerTwo.exe) ——————————————–

Logfile of HijackThis v1.99.1
Scan saved at 10:57:48 AM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\anvshell.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe
C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\TylerTwo\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\TylerTwo.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/&s;=Hd0VmgdoNhJgkZDt-Q2_GNZEfsA
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {414D3191-A0C8-4CF7-A243-C71D243B7665} - C:\Program Files\WindowsUpdate\hokew83122.dll (file missing)
O2 - BHO: (no name) - {4EE9F659-D14C-4814-B396-564858202167} - C:\Program Files\WindowsUpdate\hokew4444.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - Global Startup: Instant Update Reminder.lnk = ?
O4 - Global Startup: U.S. Robotics Internet Call Notification.lnk = C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100914577623
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://download.shockwave.com/pub/otoy/OTOYAX.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fccddeb - fccddeb.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Documents and Settings\Tyler\Desktop\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nvmootven - NVIDIA Corporation - (no file)
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe


– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 ANVIOCTL - c:\windows\system32\drivers\anvioctl.sys
Post #4
Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: (no name) - {414D3191-A0C8-4CF7-A243-C71D243B7665} - C:\Program Files\WindowsUpdate\hokew83122.dll (file missing)
O2 - BHO: (no name) - {4EE9F659-D14C-4814-B396-564858202167} - C:\Program Files\WindowsUpdate\hokew4444.dll (file missing)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLaunc…iveLauncher.cab
O20 - Winlogon Notify: fccddeb - fccddeb.dll (file missing)
O23 - Service: Nvmootven - NVIDIA Corporation - (no file)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    C:\Documents and Settings\Tyler\ntuser.dat
C:\WINDOWS\system32\ccbeg.ini2
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\WINDOWS\QW50aG9ueSBXZXNjb2F0
C:\WINDOWS\F?nts
C:\WINDOWS\system32\mr9
C:\WINDOWS\system32\aj2
C:\Program Files\?ecurity
C:\WINDOWS\system32\ardCo01
C:\Program Files\?ecurity
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    purity
  • Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Backup Your Registry with ERUNT
  • Please use the following link and scroll down to ERUNT and download it.
    http://aumha.org/freeware/freeware.php
  • For version with the Installer:
    Use the setup program to install ERUNT on your computer
  • For the zipped version:
    Unzip all the files into a folder of your choice.
Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe




Now we need to fix your problems by making a .reg file. Copy the code below into a Notepad file. Name the file as fix.reg, change the "Save as Type" to "All files" and save it on the desktop.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
00


Then double click on the fix.reg file, when it prompts to merge click "Yes".



Reboot and post a new DSS log
Post #5
I ran through all the above steps however I didn't save the OTMoveIt2 list of moved files. If there is a way for me to pull that up in a log let me know and I'll get that information to you.


Here is the DSS log




Deckard's System Scanner v20071014.68
Run by [removed] on 2008-01-26 19:56:09
Computer is in Normal Mode.
——————————————————————————–



– HijackThis (run as TylerTwo.exe) ——————————————–

Logfile of HijackThis v1.99.1
Scan saved at 7:56:15 PM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\anvshell.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe
C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\TylerTwo\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\TylerTwo.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/&s=Hd0VmgdoNhJgkZDt-Q2_GNZEfsA
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Instant Update Reminder.lnk = ?
O4 - Global Startup: U.S. Robotics Internet Call Notification.lnk = C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100914577623
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://download.shockwave.com/pub/otoy/OTOYAX.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Documents and Settings\Tyler\Desktop\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nvmootven - NVIDIA Corporation - (no file)
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe


– Files created between 2007-12-26 and 2008-01-26 —————————–

2008-01-26 11:54:27 0 d——– C:\Program Files\Warcraft III
2008-01-26 11:50:20 0 d——– C:\Documents and Settings\TylerTwo\Application Data\Ventrilo
2008-01-26 10:51:02 1554 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-25 23:10:49 0 d——– C:\VundoFix Backups
2008-01-25 15:32:54 0 d——– C:\Documents and Settings\TylerTwo\Application Data\SUPERAntiSpyware.com
2008-01-25 13:45:36 0 d——– C:\Documents and Settings\TylerTwo\Application Data\Macromedia
2008-01-25 13:44:39 0 d——– C:\Documents and Settings\TylerTwo\Application Data\Talkback
2008-01-25 13:44:19 0 d——– C:\Documents and Settings\TylerTwo\Application Data\Mozilla
2008-01-25 12:46:08 0 d——– C:\Documents and Settings\TylerTwo\Application Data\Google
2008-01-24 17:50:46 0 d——– C:\Documents and Settings\TylerTwo\Application Data\AVG7
2008-01-24 17:49:56 0 d——– C:\Documents and Settings\TylerTwo\Application Data\Identities
2008-01-24 17:48:59 0 d–h—– C:\Documents and Settings\TylerTwo\Templates
2008-01-24 17:48:59 0 dr——- C:\Documents and Settings\TylerTwo\Start Menu
2008-01-24 17:48:59 0 dr-h—– C:\Documents and Settings\TylerTwo\SendTo
2008-01-24 17:48:59 0 dr-h—– C:\Documents and Settings\TylerTwo\Recent
2008-01-24 17:48:59 0 d–h—– C:\Documents and Settings\TylerTwo\PrintHood
2008-01-24 17:48:59 0 d–h—– C:\Documents and Settings\TylerTwo\NetHood
2008-01-24 17:48:59 0 dr——- C:\Documents and Settings\TylerTwo\My Documents
2008-01-24 17:48:59 0 d–h—– C:\Documents and Settings\TylerTwo\Local Settings
2008-01-24 17:48:59 0 dr——- C:\Documents and Settings\TylerTwo\Favorites
2008-01-24 17:48:59 0 d——– C:\Documents and Settings\TylerTwo\Desktop
2008-01-24 17:48:59 0 d—s—- C:\Documents and Settings\TylerTwo\Cookies
2008-01-24 17:48:59 0 dr-h—– C:\Documents and Settings\TylerTwo\Application Data
2008-01-24 17:48:58 1310720 –ah—– C:\Documents and Settings\TylerTwo\NTUSER.DAT
2008-01-24 17:36:11 0 d——– C:\Documents and Settings\test\Application Data\AVG7
2008-01-24 17:35:35 0 d——– C:\Documents and Settings\test\Application Data\Identities
2008-01-24 17:35:08 0 d–h—– C:\Documents and Settings\test\Templates
2008-01-24 17:35:08 0 dr——- C:\Documents and Settings\test\Start Menu
2008-01-24 17:35:08 0 dr-h—– C:\Documents and Settings\test\SendTo
2008-01-24 17:35:08 0 dr-h—– C:\Documents and Settings\test\Recent
2008-01-24 17:35:08 0 d–h—– C:\Documents and Settings\test\PrintHood
2008-01-24 17:35:08 786432 –ah—– C:\Documents and Settings\test\NTUSER.DAT
2008-01-24 17:35:08 0 d–h—– C:\Documents and Settings\test\NetHood
2008-01-24 17:35:08 0 dr——- C:\Documents and Settings\test\My Documents
2008-01-24 17:35:08 0 d–h—– C:\Documents and Settings\test\Local Settings
2008-01-24 17:35:08 0 dr——- C:\Documents and Settings\test\Favorites
2008-01-24 17:35:08 0 d——– C:\Documents and Settings\test\Desktop
2008-01-24 17:35:08 0 d—s—- C:\Documents and Settings\test\Cookies
2008-01-24 17:35:08 0 dr-h—– C:\Documents and Settings\test\Application Data
2008-01-24 17:35:08 0 d—s—- C:\Documents and Settings\test\Application Data\Microsoft
2008-01-23 20:22:26 0 dr-h—– C:\$VAULT$.AVG
2008-01-23 20:22:03 0 d——– C:\Documents and Settings\Tyler\Application Data\AVG7
2008-01-23 20:21:50 0 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-23 20:21:22 0 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-23 20:21:22 0 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-23 20:17:34 0 d——– C:\WINDOWS\pss
2008-01-23 19:39:07 0 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-23 19:38:45 0 d——– C:\Program Files\SUPERAntiSpyware
2008-01-23 19:38:45 0 d——– C:\Documents and Settings\Tyler\Application Data\SUPERAntiSpyware.com
2008-01-23 19:24:38 50688 –a—— C:\ATF-Cleaner.exe
Post #6
Hello

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.



Also tell me how your PC is running
Post #7
The computer is running fine except that AVG will not allow me to open up the control center. I can open up the test center and run scans but there is no way to update the definitions… I'm going to update the superantivirus now and run a full scan then post the results. Is it safe to uninstall AVG and reinstall, or should I wait until posting another set of logs for you to see?
Post #8
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/27/2008 at 04:17 PM

Application Version : 3.9.1008

Core Rules Database Version : 3389
Trace Rules Database Version: 1383

Scan type : Complete Scan
Total Scan Time : 00:35:37

Memory items scanned : 335
Memory threats detected : 0
Registry items scanned : 4427
Registry threats detected : 0
File items scanned : 37190
File threats detected : 36

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP752\A0073797.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP755\A0075860.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0075939.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0076944.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0077945.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080040.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080041.VBS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080094.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080099.VBS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP757\A0080247.VBS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP757\A0080248.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP766\A0084079.EXE

Adware.Search2Find
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP753\A0075615.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0075884.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080175.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080176.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080178.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080179.LNK

Malware.Ultimate Defender
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP753\A0075625.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080029.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080095.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP757\A0080242.EXE

Adware.WebBuying Assistant-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP755\A0075849.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0075933.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0076926.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0077937.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0079979.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080137.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080218.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP757\A0080246.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP757\A0080252.EXE

Malware.LocusSoftware Inc-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\A0080096.EXE

Unclassified.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP756\SNAPSHOT\MFEX-1.DAT
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP766\A0084078.DLL

Adware.ClickSpring
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP757\A0080253.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{652DE849-DAD7-4595-B758-648C0A14C565}\RP766\A0084077.DLL
Post #9
Your logs are clean ! We need to do a few things

Is it safe to uninstall AVG and reinstall

Yes this is safe to do

  • Make sure you have an Internet Connection.
  • Double-click OTMoveIt2.exe to run it.
  • Click on the CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here



Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com/products/acrobat/readstep2.html



Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
Post #10
Can't thank you enough for all the help… thank you for being so prompt. Thought it would take the better part of a week to get this done :). Is there a reference somewhere to learn how to read the hijack this logs, or any literature for learning how to remove malware? Thanks again for all the help.
Post #11
Hello

Is there a reference somewhere to learn how to read the hijack this logs, or any literature for learning how to remove malware?

I would recommend you be very careful using HijackThis yourself. Here is some good information if you wish to learn more about it

http://aumha.org/a/hjttutor.php
http://www.bleepingcomputer.com/tutorials/tutorial42.html

You can also join the WTT classroom if you want

http://forums.whatthetech.com/What_the_Tec…oom_t80368.html

Let me know if you have any more questions
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI