What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

STSCOD.SYS

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

Apparently my system had to recover from a "serious error". WHY?

I would guess that trying to remove the malware resulted in your system crashing. Unfortunately that can happen as the slime writers that create this junk aren't overly keen on making it easy to remove.

Please reassure my trust.

As far as trust is concerned, there isn't a lot I can say. Whether you follow my advice or take the PC to a shop you are in the same boat. PC's crash and operating systems fail and the potential for disaster is ever present each time you boot your PC regardless of whether it's infected or not.
If you are wise you back-up everything of any importance rather than rely on your computer's continuing good health to keep things safe. If you are wiser still, you back things up twice - if it's that important, do you want just one second chance to recover it?

This in no way comprimises my gratitude for your help.

I don't take your comment as a sleight, but there's nothing I can do to make you trust me or anyone else you get help from online or off. Even if I lived next door and you'd known me for years, I could still fry your system as could the complete stranger in the local computer store - the only difference is i'd be doing it for free!
A system crash is just your computer's why of saying that something went wrong. It's not the end of your machine, but just that particular bootup. XP is pretty stable, but earlier versions of Windows spent a lot of time in reboots because something went wrong with the software.


Run another Kaspersky scan - it doesn't remove anything, so it shouldn't cause any ill effects - and we'll take it from there. I don't know if CF got the slime or if it just through it's teddy out the pram and crashed your system.
Post #17 last edited
Easy, I agree with all you points. I regretted sending my comments in my last reply as soon as i had posted them. Thanks again! One thing, I am moving flats tommorrow and my computer ( this one) is going to be in storage for a while. If I don't post for a while thanks for all your help. It is a very nice thing to do. Here is the kapersky report, Slime is still there…i think? ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Saturday, August 16, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, August 16, 2008 10:21:13 Records in database: 1098189 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 102057 Threat name: 16 Infected objects: 17 Suspicious objects: 0 Duration of the scan: 04:02:53 File name / Threat name / Threats count C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_38-1.exe.vir Infected: not-a-virus:AdWare.Win32.NewDotNet 1 C:\QooBox\Quarantine\C\WINDOWS\system32\atpsck.exe.vir Infected: not-a-virus:AdWare.Win32.AlexaBar.aj 1 C:\QooBox\Quarantine\C\WINDOWS\system32\atsck.exe.vir Infected: not-a-virus:AdWare.Win32.AlexaBar.ah 1 C:\QooBox\Quarantine\C\WINDOWS\system32\atsxyzd.sys.vir Infected: Trojan.Win32.DNSChanger.gum 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ceswxfst.sys.vir Infected: Trojan-Clicker.Win32.VB.bjv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\cexwxfst.sys.vir Infected: Trojan-Clicker.Win32.VB.bfl 1 C:\QooBox\Quarantine\C\WINDOWS\system32\cfexfst.sys.vir Infected: Trojan-Clicker.Win32.VB.blp 1 C:\QooBox\Quarantine\C\WINDOWS\system32\Indt2.sys.vir Infected: Trojan-Clicker.Win32.VB.bdq 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nftscpd.sys.vir Infected: Trojan.Win32.Delf.dbc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nxtscpd.sys.vir Infected: Trojan.Win32.Delf.dbc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\otaxyzd.sys.vir Infected: Trojan.Win32.DNSChanger.fzq 1 C:\QooBox\Quarantine\C\WINDOWS\system32\stsycod.sys.vir Infected: Trojan.Win32.Delf.djd 1 C:\QooBox\Quarantine\C\WINDOWS\system32\swand.sys.vir Infected: Trojan.Win32.DNSChanger.ews 1 C:\QooBox\Quarantine\C\WINDOWS\system32\sxwand.sys.vir Infected: Trojan.Win32.DNSChanger.ffj 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xfst.sys.vir Infected: Trojan-Clicker.Win32.VB.bcq 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xwxfst.sys.vir Infected: Trojan-Clicker.Win32.VB.bcg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\yaxcnxd.sys.vir Infected: Trojan.Win32.DNSChanger.fgv 1 The selected area was scanned.
Post #18

I regretted sending my comments in my last reply as soon as i had posted them.

Nothing wrong with being attached to your PC.

Slime is still there…i think?

Nah, look at the file paths - they all start C:\QooBox\Quarantine. If you compare the two Kaspersky logs you'll see that the same detections occur in each, but the second scan shows that CF has removed the targeted files to it's Quarantine folder. Why the crash occurred I don't know, but the malicious files were dealt with anyway.

At this point in time i'd say that the machine was looking better. Once you get round to unpacking it i'd like one last online scan as I don't like to see a PC crash, particularly as CF doesn't have that effect very often in my experience and i'd like to be sure that it was a one-off. Run through the following and post accordingly when you get the chance, and that should be just about that, apart from perhaps just a little tidying up of leftovers in the registry:

Run the following online scan: Panda ActiveScan.
  • Although the scan will work with Firefox, i'd go with IE as that's been the first choice with Panda for some time.
  • Click Scan your PC now.
  • Click Scan Now - it isn't necessary to register.
  • Accept the download when the warning appears.
  • Panda will update and then scan without further user involvement.
  • Once the scan has completed a report page will be displayed.
  • If anything has been detected, click the Export to: link and save the file, Activescan.txt, somewhere handy.
Copy and paste the result of the above scan into your next reply along with a fresh HJT log AND a description of how your PC is running.
Post #19
Hello,

Here is the Panda scan

;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2008-08-17 11:35:40
PROTECTIONS: 2
MALWARE: 17
SUSPECTS: 3
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
PC Tools AntiVirus 2.0.3.35 2.0.3.35 Yes Yes
AVG 7.5.526 7.5.526 No No
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00063168 spyware/dluca Spyware No 1 Yes No hkey_current_user\software\program info
00117819 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_38-1.exe.vir
00117819 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP583\A0072108.exe
00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\NetworkService\Cookies\system@findwhat[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Thomas Michael\Cookies\thomas michael@xiti[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\NetworkService\Cookies\[removed][2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[ad.yieldmanager.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Thomas Michael\Cookies\thomas michael@serving-sys[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Thomas Michael\Cookies\thomas [removed]-sys[2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\unwb8efw.default\cookies.txt[.advertising.com/]
00216065 Cookie/Screensavers TrackingCookie No 0 Yes No C:\Documents and Settings\Thomas Michael\Cookies\thomas [removed][1].txt
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP591\A0073910.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP583\A0072157.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\WINDOWS\PSEXESVC.EXE
02164907 Generic Malware Virus/Trojan No 0 Yes No C:\Program Files\DIGStream\digstream.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP588\A0073557.sys
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP583\A0072113.sys
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\WINDOWS\system32\drivers\Combo-Fix.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\cexwxfst.sys.vir
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\Indt2.sys.vir
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\xfst.sys.vir
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\xwxfst.sys.vir
03173472 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP557\A0070646.exe
03472461 Trj/DNSChanger.NY Virus/Trojan No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\otaxyzd.sys.vir
03472461 Trj/DNSChanger.NY Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP591\A0073898.sys
03472469 Adware/AccesMembre Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\cfexfst.sys.vir
03472469 Adware/AccesMembre Adware No 0 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP588\A0073552.sys
03484297 Adware/Alexa-Toolbar Adware No 0 Yes No C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP591\A0073893.exe
03484297 Adware/Alexa-Toolbar Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\atsck.exe.vir
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location 
;===============================================================================
=================================================================================
===================
No C:\Documents and Settings\Thomas Michael\Desktop\ComboFix.exe 
No C:\i386\GTDownDE_87.ocx 
No C:\QooBox\Quarantine\C\WINDOWS\system32\ceswxfst.sys.vir 
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description 
;===============================================================================
=================================================================================
===================
108742 MEDIUM MS06-006 
;===============================================================================
=================================================================================
===================



and here is the Hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 11:38, on 2008-08-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.seekgoouk.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Belkin Wireless USB Utility.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?3f9d11ad2f08459cb4c16fcfa43af7c1
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?3f9d11ad2f08459cb4c16fcfa43af7c1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\WINDOWS\PSEXESVC.EXE
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE (file missing)

OK - while the scan was running, admittedly I was using Itunes at the same time as the scan - so it was probably because of that, my computer crashed. Then when I rebooted it, it took some time to get to the windows startup screen. Also, there is a problem with my AVG Virus scan - the virus scan, resident shield and something else is not functioning. Everytime I try to open it, it either crashes immeadiately or when i try to look into the matter further.

I have a laptop - so i will be able to respond to the posts on that ( also I might need some help with it as well) but as for my computer - unless I can get one of my parents to follow your instructions - it is going to be a little while before i can sort it out.

Thank you very much for all your help!

regards,

Tom
Post #20
There's a file that may be of some interest to sUBs, so i've asked and once I get an answer to that we'll tidy up and you'll be done. If I don't get an reply in the next 24 hours, i'll post the last of the fix anyway and you can find something better to do with your free time.
Post #21
I'd say that the PC was looking OK - just a couple of leftovers to deal with:

Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k


CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I suggest you uninstall and reinstall AVG and see if that solves the issue. You might like to install the latest version - AVG 8.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Your log doesn't appear to show a third-party software firewall installed - if you have one, and i've missed it, please ignore this.
If you are relying the firewall that comes with Service Pack 2, then you need to install one. While the SP2 firewall is better than nothing, it doesn't monitor outgoing traffic, so anything malicious on your computer can 'phone home' at will.
If you are using a wireless router that comes with a NAT hardware firewall, this also doesn't monitor outgoing connections.

There are a few free firewalls available.
Comodo Firewall Pro, available here.
PC Tools Firewall Plus, available here.
Online Armor Free, available here.

It is important to note that you should only have one firewall installed at a time, but you can download them all to your Desktop and install each in turn to see which one you prefer.

Understanding and Using Firewalls: http://www.bleepingcomputer.com/tutorials/tutorial60.html

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I want you to run your PC as normal for a few days and when you are happy that everything is fine, do the following:

Go to Start > Run, enter the following into the textbox and click OK: combofix /u
This will uninstall Combofix and do a little housework besides.

Create a new Restore Point - this will give a clean one should you need it in the future.
A tutorial for System Restore is available here.

The reason for waiting is that if removing the malware has caused a problem, which it occasionally does, you can put your PC back to how it was before the fix. This will re-install the malware, but an infected PC is better than an expensive paperweight!

Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

You'll need to start a fresh thread if the lappy is still causing problems.
Post #22
easy, Once again, I would like to begin by saying thank you very much for all you help! I, literally, do not know what i would have done without you! haha When I get my PC back or get back to my PC, which ever comes first, I will do the things you have suggested. I know that you said to start a new thread for my laptop concerns, which I have done ( noone has replied yet) I guess you don't get lucky twice in a row eh. However, I have recently purchased a refurbished IBM thinkpad X31, other than the information that was in the link you gave, do you have any quick advice about things i should have on it or just good practice to keep it safe without putting so much stuff on that it slows the computer? If not, do not worry…..thanks again! regards tom
Post #23
The level of security you run is proportional to the risks you put the PC at. If you surf Amazon and eBay and other legitimate sites, never file share or download software without a 100% guarantee of cleanliness, you need to worry less about the computer than if you like to walk the dark side.

I run AVG, http://free.grisoft.com/doc/downloads-prod…s/frt/0?prd=aff, on one lappy and AntiVir, http://www.free-av.com/, on another - two free AVs. AntiVir is less resource hungry than AVG, so if your computer has a wussy processor you may find this one leaves something for you to use - AVG is suffering from a bloat issue which slows down performance. I use Comodo free firewall, http://www.personalfirewall.comodo.com/dow…d_firewall.html, on one and PC Tools, http://www.pctools.com/firewall/], on the other because they work and I don't have to spend time wondering what I need to configure or learn about it. The difference is caused by one lappy running XP and the other Vista - compatibility issues at the time of installation. There may be better free ones, but I stick with what I know as i'm lazy. Neither goes anywhere that should infect it, so that's all I have security-wise. I have McAfee's Site Advisor, http://www.siteadvisor.com/, installed on Firefox to give me an idea of the sites I may be visiting before I get there too.

My Desktop has Nod32 AV because I have been known to chase malware and I prefer something butch-er just in case. I use the same free firewall by Comodo. The one extra I run is WinPatrol, http://www.winpatrol.com/, as an added layer of protection and that's about that.

Each added program eats system resources, so you need to balance security with the need for some sort of response this side of Christmas from your PC. There are other options, either replacements or additions to what I have, but what I have works and i've avoided malware for a year or three this way. You can never guarantee things because malware writers are one step ahead of those that seek to block what they create, as cure always follows infection, but that's PC ownership for you.

Keep Windows Update on it's toes - I have mine set to notify when there's something to get - update your AV as often as you can and don't go where you can't be certain you're going to be safe and don't download and install what you can't guarantee is legit and you shouldn't do too badly - crossing fingers always helps!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI