What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Malware?

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Ok this is gonna be hard to explain, i stupidly installed an aplet after my AVG said it was clear, and my spybot recognised many trojans among other things flying at my PC.

After a system restore (yea, pointless) on my startbar i could pretty much only acess the "Set programs Acess and Defaults" as the rest had been removed (so i cant access my computer, run, search etc to post a hijackthis scan) I've managed to get the All Programs bar back since but every startup it still tries to edit my registry, change my default web page etc.

My AVG recognises:
Trojan horse generic_C.HFB
Trojan horse generic_C.HEZ
Trojan horse SHeur.BROU
Trojan horse SHeur.BROU

and my spybot:
Smitfraud-C.MSVPS
Zlob.Downloader.BS
Virtumonde.dll
(this is after removing all the first carp** that came my way)

Can any1 help guide me through this please? :(

EDIT:
I have a slave harddrive hooked up also, but any scans since the infection by my AVG have turned up nothing so far
oh, and my CCcleaner keeps removing stuff from the temporary internet files but its there on reboot even if i go tools>internet options> delete files, delete cookies, clear history, havent run it on the registry because of being a tad afraid

2nd EDIT:
Currently copying the logs by hand from my infected PC to paste on this PC so u can get em n i dont get anything else infected :/, my PC runs through this 1 for its internet :(, if ne1 reads this, ne faster way? :s

Logfile of HijackThis v1.99.1
Scan saved at 13:27: VIRUS ALERT!, on 07/07/2008
Platform: Windows XP SP3 (WinNT 5.02.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogin.exe
C:\WINDOWS\System32\services.exe
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\nvsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Razer\Laschesis\razerhid.exe
C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE
C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Razer\Laschesis\OSD.exe
C:\Program Files\Razer\Laschesis\razertra.exe
C:\Program Files\Razer\Laschesis\razerofa.exe
C:\Program Files\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {3BA3028F-FD37-46BF-AD27-733734684F06} - C:\WINDOWS\system32\wvUnnnKc.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4923DCF6-55BA-4D90-BC42-ECB35043673E} - C:\WINDOWS\system32\cbXnnnMD.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: QXK Olive - {8663655C-F6D4-4520-859E-67008902A889} - C:\WINDOWS\kgqfweltmrg.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] c:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Laschesis\razerhid.exe
O4 - HKLM\..\Run: [Sitecom WL-117 WLan_Utility] "C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE"
O4 - HKLM\..\Run: [AutoEJCD_0ACE2031] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE /VID=0ACE /PID=2031
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
06 - HKCU\Software\Policies\Microsoft\Restricitions present
09 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
09 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
09 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
09 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
09 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
09 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unkown file in Winsock LSP: C:\Windows\system32\nvappfilter.dll
O10 - Unkown file in Winsock LSP: C:\Windows\system32\nvappfilter.dll
O10 - Unkown file in Winsock LSP: C:\Windows\system32\nvappfilter.dll
O10 - Unkown file in Winsock LSP: C:\Windows\system32\nvappfilter.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: wvUnnnKc - C:\WINDOWS\SYSTEM32\wvUnnnKc.dll
O21 - SSODL: axrfgvek - {F7FB75E0-C988-44C5-8A20-18C0B8BB69DA} - C:\WINDOWS\axrfgvek.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 Watchdog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvAppFlt.exe
O23 - Service: Forceware IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



Written out by hand since i dont wanna infect my other PC. As im sure there will be other requests to put logs on here, whats the best way to do it without infecting my other PC? :/


another quick edit for when someone gets round to this:

The trojans and possibly even Zlob and Virtumonde seem to have vanished by AVG + spybot + CC cleaner (unless they hiding) Spybot only picks up the Smitfraud constantly, but the clock still has "VIRUS ALERT" stamped all over it (all scans/changes were performed, the computer rebooted and then the hijackthis was run, which is the scan u see above)

Sitecom WL-117 WLan_Utility = wireless internet device i use
Razer Lachesis = my mouse
Post #2
[external image: Posted Image]


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3
thx LDTate, i jus got back from work so will do first thing in the morn so i dont make any mistakes. But, as i wrote in the first post, how can i post the logs here without possibly infecting my other PC? Short version: infected PC gets internet through clean PC, would USB transfer of a notepad file risk dragging it over?
Post #4

thx LDTate, i jus got back from work so will do first thing in the morn so i dont make any mistakes.

But, as i wrote in the first post, how can i post the logs here without possibly infecting my other PC?

Short version: infected PC gets internet through clean PC, would USB transfer of a notepad file risk dragging it over?

That's the only way I can think of. Guess you don't have much choice unless you want to wipe it and re-install.
Post #5
had to get infected PC online to update the malware :/, so posting from the machine Malwarebytes' Anti-Malware 1.20 Database version: 933 Windows 5.1.2600 Service Pack 3 15:31:04 09/07/2008 mbam-log-7-9-2008 (15-31-04).txt Scan type: Quick Scan Objects scanned: 40622 Time elapsed: 2 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 2 Registry Keys Infected: 95 Registry Values Infected: 1 Registry Data Items Infected: 11 Folders Infected: 2 Files Infected: 18 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\wvUnnnKc.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\kgqfweltmrg.dll (Trojan.FakeAlert) -> Unloaded module successfully. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{3ba3028f-fd37-46bf-ad27-733734684f06} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ba3028f-fd37-46bf-ad27-733734684f06} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvunnnkc (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{101900f3-7aeb-4e3b-b4cc-dcb483b3b92f} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{9c7e91a9-0001-4c4e-bcc2-a56bc8329049} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{a59c4135-df7a-4666-8129-478376867b3c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8663655c-f6d4-4520-859e-67008902a889} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8663655c-f6d4-4520-859e-67008902a889} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f70c9bf7-63da-40cc-a57c-b874b07259e0} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{7f62b052-bbd3-476f-a8d5-aea51d86367a} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{03abad49-125e-47bd-9962-b29896b45bc4} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{047b3eb2-aee8-46eb-9667-45e20bd64e64} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{06c759ca-67a2-4b64-be05-6e5bb46dba8c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0b86d659-94b2-42f0-9e3c-e886f7db94a3} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0d297fbe-ee35-4038-8945-8ceb1ec136c4} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0fce59ae-77cc-4daa-a993-4d1205685acd} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{144e1c3a-feaf-43cd-aaa9-00ec34ace0f4} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{18267fc8-d479-4a68-b689-14c1e47283e1} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1a44bc5d-288f-4cac-a4e9-e026df35b70b} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1c6a08fb-8e07-43cf-993b-2e9b34981274} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{213fa8d9-dbc8-4d51-a0d7-2a30b3ecd1d2} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{24607c09-b587-43f3-8b6d-dfca44adea48} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2af0f7ac-3d1c-4ba9-aca9-64a3a536adca} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2b82c1aa-b66c-4d74-932c-96f5f26284da} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2f4b1dfe-8ade-4162-9b8b-997f3044722b} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{36d7b92d-bcf3-4550-8b88-c49cff1890f1} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3b1558c1-7c8c-496b-8cb4-5e558954d036} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3cbba643-34c5-42f2-967d-6cdb95d80bcc} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3cf824d2-83bb-493c-9208-b8b05b938a72} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3d15abac-4147-4246-ba25-0885dddd077a} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3e733378-096d-40ac-af0f-2f81435a76ae} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3f7d18f9-d321-4637-81b8-9dff05f61278} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{400ea84a-4c84-46d3-a842-6e54dc9a5d1c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{494507ac-38d2-4397-85fb-7e8d1446da60} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4cb51dff-6399-45cf-b962-57971141f6ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4ee6c7c7-6ed5-4156-8d2c-2bf00080e796} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{51cd57d6-0f5f-474b-8ee8-941a9f25cb26} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{52b4508c-a4d9-455a-8488-3748468fd14f} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{53affda9-a513-4c82-a505-ab2ebb595796} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5a66c6c1-c209-4120-a3ee-31a4567b597c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5ae98a25-4e28-4be4-8fab-40a86f9c24da} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5cd91e33-0321-446d-9509-f7b0d4db2a1a} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5def1d54-6163-4a55-9cc1-bd04b7851493} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5fca74f7-2b88-4e75-b402-275b60faced6} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{62d4d05d-d949-4b92-9063-e6060152090e} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6e32079e-f52d-41cc-9007-bdb7f7f014b7} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6f576c5c-32cd-4857-80b2-800865805a3c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{73d96e15-5281-4e52-b5a1-38b83774cad2} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{73dd686c-8a32-4fbf-8c30-cdfcf553cabd} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{782a1652-1ae1-4e5b-bb20-6b6cd8968630} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{789a8250-b975-4c16-9dc2-0a967d87cfd0} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7bae70cd-931e-4201-966b-c640171aa2c9} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{86fb1ff6-4fb9-4202-8696-9cabe3960855} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{89b064b0-01cd-4ab8-9b9e-17cc33bf9efa} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8e4d73f2-a6b1-48cf-ba57-ea79da0bca52} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9307d78e-d0b0-4ee4-8134-6047d95a9025} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{98bee2de-7776-43a7-8526-2905456c6f7d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9c97ecc7-e30f-4188-9c17-782837a0893c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9ff34251-d340-46b0-ac48-6689d5870c8c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a12b6e25-e52b-4963-bdd5-bed3cef33969} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a16b9744-cb7e-4d99-8289-a944b4229d96} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4b97265-56e4-4102-b993-82957ae945f7} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a6f9e6e5-60f1-46d4-b140-25d8d834cd2d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a8c69c93-b2fc-4b4a-b416-fb450ed3dbbd} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{afdc58cb-cecb-4e25-b8c8-b6737db4c1c6} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b193c6fa-1b97-4a0a-902d-f2a4058830d0} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b5443be0-82af-4e56-ad5e-fc701a7c61ab} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b756533f-ceda-4c64-92c9-6dd93fc49200} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{bb46caef-532b-4442-b5c1-3b7e7bc063fe} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{bf8b8127-c410-4e9e-8128-e59954b17bf9} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c4a9ba16-697e-422a-b432-c8fb47838ec5} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c5530a1f-2d02-4711-b958-0d3d9a6a6cf2} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cb1727ee-d70c-4299-8538-08349b66e0f6} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cbe37a32-9d37-493d-ab30-ce82653f5a32} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cc2653c8-c820-4a99-a110-8d337b839d3e} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cd4d0e5a-b0c4-48d6-8bb4-08ac9d54617d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ce21ba9b-b689-45ad-acfb-84095b6a4088} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d06691e5-f011-45f5-ba38-106067a083c8} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d7d59cb1-37e5-41fb-aa4d-caa89fd529a9} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d7d9986e-5fb2-4bda-a69c-3a73453b9bc5} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{da1be879-e1ec-48ee-a807-04f663677d1f} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{dab36a63-4407-46f7-80e6-53d4d770186b} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{df818d69-a561-4d31-a13a-9df9f430bc9c} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e418b1f5-1cc3-4341-b47f-48f6f4bdc2cb} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e812e0af-f0c7-47e4-86c3-7226491781d2} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e94d8044-0919-4b22-8fe4-bcce7539d9cf} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ecb860a9-f215-414d-bcac-beb39fa6f744} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{eeb6a9e9-0636-4fee-bf01-d90168b8a357} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{f09d4aaa-34c0-4584-a7f3-250098654152} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{f9549ece-5f55-4213-94ec-8ec249db7395} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\nqgpedlr.bxod (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\nqgpedlr.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3ba3028f-fd37-46bf-ad27-733734684f06} (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76477-OEM-0043232-28184) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\wvUnnnKc.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\kgqfweltmrg.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\esrp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\VAV\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Program Files\VAV\vav.ooo (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\WINDOWS\system32\iifdDtRh.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\mrvtdpqe.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\axrfgvek.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Alex K\Application Data\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Alex K\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. Hijackthis scan to follow shortly
Post #6 last edited
Logfile of HijackThis v1.99.1
Scan saved at 15:36:34, on 09/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\Razer\Lachesis\OSD.exe
C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE
C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\Lachesis\razertra.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {3BA3028F-FD37-46BF-AD27-733734684F06} - (no file)
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4923DCF6-55BA-4D90-BC42-ECB35043673E} - C:\WINDOWS\system32\cbXnnnMD.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe
O4 - HKLM\..\Run: [Sitecom WL-117 WLan_Utility] "C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE"
O4 - HKLM\..\Run: [AutoEJCD_0ACE2031] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE /VID=0ACE /PID=2031
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


The PC rebooted real fast and appears to be working as fast as it was when it got built 2 weeks ago… except for on shutdown it actually does shutdown within 30 seconds instead iof the 5 minutes it did when it was just built.

Spybot still notices that 1-2 fiels are trying to change the registry but it blocks them without popping up at me now, also i have control panel etc all back and the VIRUS ALERT message is gone
these 2 files were the 1's that spybot was originally popping up about before i ran the malware, and possibly the 1's its blocking after?

HKEY_CLASSES_ROOT\CLSID\{3ba3028f-fd37-46bf-ad27-733734684f06} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ba3028f-fd37-46bf-ad27-733734684f06} (Trojan.Vundo) -> Delete on reboot.

Would the Malware scanner an ATFcleaner have run checks of my slave harddrive also?


ran malware again, all clear, going to do the same with my AVG, CCleaner and spybot now

If its the last chance i get to say it, many thanks LDTate
Post #7
We're not finished. We have a ways to go.


You need To disable TeaTimer, it can stop our fix.

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts

The best way is to do both, Right click the system tray icon and shut down. This will reset TT's registry snapshot. Then, open spybot in advanced mode and turn it off. When cleaning is done, open Spybot in advanced mode to turn back on.
Once fix is completed in the all clear post!!

Next:

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish
Post #8
Combo fix finished and rebooted within 5 minutes


ComboFix 08-07-08.9 - Alex K 2008-07-09 18:02:06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2657 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\DMnnnXbc.ini
C:\WINDOWS\system32\DMnnnXbc.ini2

.
((((((((((((((((((((((((( Files Created from 2008-06-09 to 2008-07-09 )))))))))))))))))))))))))))))))
.

2008-07-09 15:20 . 2008-07-09 15:20 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-07-09 15:20 . 2008-07-09 15:20 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-09 15:20 . 2008-07-09 15:20 d——– C:\Documents and Settings\Alex K\Application Data\Malwarebytes
2008-07-09 15:20 . 2008-07-07 17:35 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-09 15:20 . 2008-07-07 17:35 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-07-07 04:12 . 2008-07-07 04:58 405 –a—— C:\WINDOWS\wininit.ini
2008-07-07 03:47 . 2008-07-07 03:47 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-07-07 03:39 . 2008-07-07 03:39 d——– C:\Program Files\Yahoo!
2008-07-07 03:39 . 2008-07-07 03:39 d——– C:\Program Files\CCleaner
2008-07-07 03:01 . 2008-07-07 03:25 d——– C:\WINDOWS\privacy_danger(2)
2008-07-07 02:03 . 2008-07-07 02:03 1,160 –a—— C:\WINDOWS\mozver.dat
2008-07-07 02:02 . 2008-07-07 02:02 0 –a—— C:\WINDOWS\nsreg.dat
2008-07-04 04:23 . 2008-07-05 21:06 d——– C:\Documents and Settings\Alex K\Application Data\dvdcss
2008-07-04 03:12 . 2008-07-04 03:12 d——– C:\Documents and Settings\Alex K\Application Data\vlc
2008-07-04 02:52 . 2008-07-04 02:52 d——– C:\WINDOWS\Applian FLV Player
2008-07-04 02:45 . 2008-07-04 02:45 d——– C:\otherWinRAR
2008-07-01 22:15 . 2008-07-01 22:15 d——– C:\temp
2008-07-01 22:15 . 2008-07-01 22:15 108,144 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2008-07-01 22:14 . 2008-07-01 22:14 d——– C:\Documents and Settings\All Users\Application Data\Media Center Programs
2008-07-01 20:52 . 2008-07-07 01:22 d——– C:\WINDOWS\system32\drivers\Avg
2008-07-01 20:52 . 2008-07-01 20:52 96,520 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-01 20:52 . 2008-07-01 20:52 75,272 –a—— C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-01 20:52 . 2008-07-01 20:52 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-07-01 20:01 . 2008-07-01 20:01 d——– C:\Program Files\Sitecom Europe BV
2008-07-01 20:01 . 2004-07-05 22:38 233,472 –a—— C:\WINDOWS\system32\drivers\ZD1211U.sys
2008-07-01 20:01 . 2004-01-14 10:25 81,920 –a—— C:\WINDOWS\system32\ZDPN50.DLL
2008-07-01 20:01 . 2004-04-28 15:32 81,920 –a—— C:\WINDOWS\system32\ZDBRGDLL.DLL
2008-07-01 20:01 . 2001-08-17 12:56 44,032 –a—— C:\WINDOWS\system32\devcon.exe
2008-07-01 20:01 . 2004-03-23 15:38 28,672 –a—— C:\WINDOWS\system32\InsDrvZD.dll
2008-07-01 20:01 . 2004-06-30 12:54 19,200 –a—— C:\WINDOWS\system32\ZDBRGSYS.SYS
2008-07-01 20:01 . 2004-01-14 10:30 17,151 –a—— C:\WINDOWS\system32\ZDPNDIS5.SYS
2008-07-01 19:53 . 2008-07-01 19:53 d——– C:\Program Files\AutoInstall
2008-06-30 14:19 . 2008-07-07 12:54 d–h—– C:\$AVG8.VAULT$
2008-06-30 02:54 . 2008-06-30 02:54 d——– C:\tps
2008-06-29 23:30 . 2008-06-30 16:01 d——– C:\Work
2008-06-29 23:30 . 2008-07-06 09:33 d——– C:\Other
2008-06-29 23:30 . 2008-07-01 22:01 d——– C:\Games
2008-06-29 20:22 . 2008-03-14 10:47 442,368 –a—— C:\WINDOWS\system32\nvunrm.exe
2008-06-29 20:22 . 2007-12-07 16:12 5,836 –a—— C:\WINDOWS\system32\nvnrm.nvu
2008-06-29 16:19 . 2008-06-29 16:19 d——– C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-06-29 01:25 . 2007-06-15 08:52 143,256 -ra—— C:\WINDOWS\system32\drivers\mv61xx.sys
2008-06-29 00:23 . 2008-03-25 11:46 9,216 –a—— C:\WINDOWS\system32\bdco1ins.dll
2008-06-28 23:09 . 2008-06-29 20:44 d——– C:\Program Files\Spybot - Search & Destroy
2008-06-28 23:09 . 2008-07-09 15:46 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-28 22:45 . 2008-06-28 22:45 d——– C:\Program Files\AVG
2008-06-28 22:45 . 2008-07-01 20:52 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-06-28 22:45 . 2008-06-30 02:49 d——– C:\Documents and Settings\Alex K\Application Data\AVGTOOLBAR
2008-06-28 21:33 . 2008-06-28 21:33 d—s—- C:\Documents and Settings\Alex K\UserData
2008-06-28 21:33 . 2008-04-14 13:00 1,135,616 –a—— C:\WINDOWS\system32\wuaueng.dll
2008-06-28 21:33 . 2008-04-14 13:00 430,592 –a—— C:\WINDOWS\system32\wuapi.dll
2008-06-28 21:33 . 2008-04-14 13:00 162,304 –a—— C:\WINDOWS\system32\wuaucpl.cpl
2008-06-28 21:33 . 2008-04-14 13:00 120,320 –a—— C:\WINDOWS\system32\wuweb.dll
2008-06-28 21:33 . 2008-04-14 13:00 112,640 –a—— C:\WINDOWS\system32\wucltui.dll
2008-06-28 21:33 . 2008-04-14 13:00 111,104 –a—— C:\WINDOWS\system32\wuauclt.exe
2008-06-28 21:33 . 2008-04-14 13:00 66,560 –a—— C:\WINDOWS\system32\cdm.dll
2008-06-28 21:33 . 2007-07-30 19:18 33,624 –a—— C:\WINDOWS\system32\wups.dll
2008-06-28 21:33 . 2007-07-30 19:18 33,624 –a–c— C:\WINDOWS\system32\dllcache\wups.dll
2008-06-28 21:21 . 2008-07-07 14:57 d——– C:\Documents and Settings\Administrator
2008-06-28 21:21 . 2008-06-29 16:53 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2008-06-28 19:53 . 2008-06-28 19:53 d—-c— C:\WINDOWS\system32\DRVSTORE
2008-06-28 19:53 . 2008-06-28 19:53 d——– C:\Program Files\Razer
2008-06-28 19:53 . 2008-06-28 19:53 d——– C:\Program Files\DIFX
2008-06-28 19:53 . 2008-06-28 19:53 d——– C:\Documents and Settings\All Users\Application Data\Razer
2008-06-28 19:53 . 2007-08-08 09:51 249,856 –a—— C:\WINDOWS\system32\Lachesis.cpl
2008-06-28 19:53 . 2008-04-14 13:00 36,864 –a—— C:\WINDOWS\system32\drivers\hidclass.sys
2008-06-28 19:53 . 2008-04-14 13:00 24,960 –a—— C:\WINDOWS\system32\drivers\hidparse.sys
2008-06-28 19:53 . 2005-12-21 11:23 14,592 –a—— C:\WINDOWS\system32\drivers\Usbicp.sys
2008-06-28 19:53 . 2007-08-08 11:04 12,032 –a—— C:\WINDOWS\system32\drivers\Lachesis.sys
2008-06-28 19:53 . 2008-04-14 13:00 10,368 –a—— C:\WINDOWS\system32\drivers\hidusb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 20:59 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-28 04:29 ——— d—–w C:\Program Files\THQ
2008-06-28 04:15 ——— d—–w C:\Program Files\Marvell
2008-06-28 04:11 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-06-28 04:11 ——— d—–w C:\Program Files\Analog Devices
2008-06-28 04:05 ——— d—–w C:\Program Files\NVIDIA Corporation
2008-06-28 04:04 ——— d—–w C:\Documents and Settings\Alex K\Application Data\InstallShield
2008-06-28 03:57 ——— d—–w C:\Program Files\microsoft frontpage
2008-06-16 15:34 446,464 —-a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-04-14 05:42 74,752 —-a-w C:\WINDOWS\system32\storprop.dll
2008-04-14 05:42 74,240 —-a-w C:\WINDOWS\system32\usbui.dll
2008-04-14 05:41 21,504 —-a-w C:\WINDOWS\system32\hidserv.dll
2008-04-14 04:42 23,552 —-a-w C:\WINDOWS\system32\wdmaud.drv
2008-04-14 04:41 4,096 —-a-w C:\WINDOWS\system32\ksuser.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 14:34 868352]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-06-18 17:46 13533184]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-06-18 17:46 86016]
"Lachesis"="C:\Program Files\Razer\Lachesis\razerhid.exe" [2007-09-12 11:52 172032]
"Sitecom WL-117 WLan_Utility"="C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE" [2005-06-03 16:37 3416064]
"AutoEJCD_0ACE2031"="C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE" [2004-08-11 19:02 40960]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-01 20:52 1177368]
"nwiz"="nwiz.exe" [2008-06-18 17:46 1657376 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Other\\MaDmIRC1\\mirc.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\BugReport\\BugReport.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Games\\Supreme Commander\\Supreme Commander\\bin\\SupremeCommander.exe"=
"C:\\Games\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"=

R0 mv61xx;mv61xx;C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-06-15 08:52]
R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-25 20:01]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-01 20:52]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-01 20:52]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-01 20:52]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-01 20:52]
R3 LachesisFltr;Lachesis Mouse Driver;C:\WINDOWS\system32\drivers\Lachesis.sys [2007-08-08 11:04]
S3 Asushwio;Asushwio;D:\BIN\Asushwio.sys []
S3 ZD1211U(Sitecom);Sitecom Wireless Network USB Adapter 54G WL-117(Sitecom);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-07-05 22:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4513e8ac-46a1-11dd-a40b-001fc6010ba1}]
\Shell\AutoRun\command - G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4f99f42-44cc-11dd-afdb-806d6172696f}]
\Shell\AutoRun\command - D:\Setup.exe

.
- - - - ORPHANS REMOVED - - - -

BHO-{3BA3028F-FD37-46BF-AD27-733734684F06} - (no file)
BHO-{4923DCF6-55BA-4D90-BC42-ECB35043673E} - C:\WINDOWS\system32\cbXnnnMD.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-09 18:04:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Razer\Lachesis\OSD.exe
C:\Program Files\Razer\Lachesis\razertra.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-09 18:05:13 - machine was rebooted [Alex K]
ComboFix-quarantined-files.txt 2008-07-09 17:05:10

Pre-Run: 463,528,988,672 bytes free
Post-Run: 463,470,567,424 bytes free

174






————————————————————————————————————————————————————————————————-



Logfile of HijackThis v1.99.1
Scan saved at 18:06:09, on 09/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE
C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Razer\Lachesis\OSD.exe
C:\Program Files\Razer\Lachesis\razertra.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe
O4 - HKLM\..\Run: [Sitecom WL-117 WLan_Utility] "C:\Program Files\Sitecom Europe BV\Sitecom WL-117 Utility\SitecomUSB.EXE"
O4 - HKLM\..\Run: [AutoEJCD_0ACE2031] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2031\AutoEJCD.EXE /VID=0ACE /PID=2031
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



Between clicking the start> turnoff computer button, and the 3 options on screen (reboot, turn off, switch user) it still takes 5 minutes as it did when first installed, cud this jus be to do with faulty installing i guess?

Thx again =)
Post #9
Do this and see if it helps.

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    • [external image: Posted Image]
    Here's my usual all clean post

    Log looks good :D


    You need to create a new Clean restore point.

    Note: This will remove all previous Restore Points

    Turn off System Restore:

    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Check Turn off System Restore.
    Click Apply, and then click OK.

    Restart your computer, turn it back on.

    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Remove the Check Turn off System Restore.
    Click Apply, and then click OK.

    Double-click My Computer.
    Click the Tools menu, and then click Folder Options.
    Click the View tab.
    Check "Hide file extensions for known file types."
    Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
    Check "Hide protected operating system files."
    Click Apply, and then click OK.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Post #10 last edited
Many thanks LDTate :D, very quick and i know you must be overloaded, so THANK YOU! the hidden files and folders were already back at those settings when i rebooted heh and just turned system restore back on and made a new point since its all clear, after rebooting With the virus' / trojans etc do i need to change any of my passwords? - Only had a couple of forum passwords auto savwed in the machine but dunno what the computer keeps hold of Thanks :)
Post #11
It never hurts to change passwords every now and then. Just write them down somewhere so if you forget…. Great job :thumbup: You're more then welcome. Glad we were able to help Peace be with you :wavey:
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI