Other information you should know is that my workgroup network(the others pc of the networks) have spywares and a lot of stuff(but i cant help it since is my dad's pc and he wont let me touch), im wondering if those spywares are coming throught the net to my PC.
Earlier right when i installed Spybot S&D it found and destroyed 2(worms?) Win32.
The main problem i have is Kavo.exe,tavo.exe,2.exe,tt.exe keep getting in my pc no matter how many times i delete them >_<, and i dont navigate in bad webpages, or anything like that, i even use 3 antispywares(2 have 24/7 security, the other one just scan):
-Spybot S&D
-Spyware Terminator
-Malewarebytes Antispyware
———–
I dont have antivirus also, havent had for a while. Thinking about downloading AVG FREE now.
This is my clean hijack this:
Logfile of HijackThis v1.99.1
Scan saved at 8:14:55 PM, on 6/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
D:\hijackthis_sfx\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.live.com/1rewlsup/WinInstaller
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
As you can see there appears the kavo and tavo x_x. I can manage to delete them with my antispyware but the main problem is that they just keep appearing in my pc, and i dont even navigate throught bad sites :x.
EDIT: i just scanned with Spyware Terminator and found/clean this:
Threat Files
: C:\WINDOWS\system32\kavo.exe
: C:\WINDOWS\system32\kavo0.dll
They will come back after i reboot or so i can say, i wish you help me to make it stop appearing in my pc.
Thanks in advance!~.
————————–
EDIT2: i realized that everytime i double click(to open) there is a .dll(i think is bad) called xfa.dll that is my Temp folder.
