What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Antivirus XP 2008

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I got a Trojan.Blusod through a file "Antivirus XP 2008". It was detected by NIS 2008 and blocked. After a full system scan I saw in the NIS 1008 Activity log that it has been blocked and fully removed three times.
The problem I got is that the screen wallpaper disappeared, I get a white screen and when I restart the computer, the screen is blue with the "Antivirus XP 2008 window" and the agreement window to run this program. I was closing this agreement window with Windows Task Manager but the Antivirus XP 2008 window would not close. After the full system scan and another scan with Registry Booster 2, I rebooted and everything was the same, but when I closed through Windows Task Manager the "Agreement window", this time both windows disappear: "Antivirus XP 2008" and the "Agreement window". I still have the white screen.

When I go to Display, I am missing to tabs: Desktop and Screensaver.

Before the Registry Booster 2 scan, when trying to follow the instructions from NIS 2008, I think I deleted a registry entry which I did not have to delete. I was supposed to delete:
HKEY_CURRENT_USER\Software\Sysinternals\Bluescreen Screen Saver\"EULAAccepted" = "1"

and I deleted something like the following (but I don´t know exactly because I forgot to write it):
HKEY_CURRENT_USER\Software\Sysinternals\Bluescreen Screen Saver\"EULAAccepted" = 0x00001

My OS is Windows XP sp 3 (in spanish). I don´t know much about computers and would appreciate your help.
I enclose the HijackThis log I made for this post:

Quote
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:49, on 14/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\archivos de programa\archivos comunes\logishrd\lvmvfm\LVPrcSrv.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Archivos de programa\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Archivos de programa\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Archivos de programa\Apoint\Apoint.exe
C:\Archivos de programa\Apoint\Apntex.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSvcHst.exe
C:\Archivos de programa\Archivos comunes\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\lphccehj0e94g.exe
C:\Archivos de programa\Digital Line Detect\DLG.exe
C:\Archivos de programa\Siemens\Gigaset USB Adapter 108\Gcc.exe
C:\Archivos de programa\Siemens\Gigaset USB Adapter 108\OdHost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Archivos de programa\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = jeison.deusto.es:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\system32\pavdr.exe,C:\WINDOWS\system32\userinit.exe,
O1 - Hosts: HP9BA7D8 HP001A4B9BA7D8
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Archivos de programa\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Archivos de programa\Archivos comunes\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de programa\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {BE0B3C0A-A3E9-F3AA-6F74-8EFF74FBA698} - (no file)
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Archivos de programa\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de programa\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Archivos de programa\Archivos comunes\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [Apoint] C:\Archivos de programa\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Archivos de programa\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Archivos de programa\Archivos comunes\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [lphccehj0e94g] C:\WINDOWS\system32\lphccehj0e94g.exe
O4 - HKLM\..\Run: [inrhc9ehj0e94g] C:\Documents and Settings\Unai Zubiete\Configuración local\Temp\.tt8.tmp.exe /CR=4C48D3ADAF4F8B2C41C2C26D6D35B8062AA6EC8727E772C157CC6383618C2FB7024C30030820B
79DC418DB839C692587ACB8C79308CD713BE5F51B239028593B7E62B0DD22A2855B637B91B2977125
729FE842
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Archivos de programa\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Archivos de programa\Siemens\Gigaset USB Adapter 108\Gcc.exe
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Archivos de programa\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Agregar entrada - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Archivos de programa\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Agregar entrada en Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Archivos de programa\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Coches - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\exio3-pillamusica\entrar.html (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Selección inteligente de HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Archivos de programa\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120301855231
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1218186304203
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E70876A-85AF-4A53-8C98-FE54DF141090}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F818F3C-9367-4C53-AF94-63D1867CC7BC}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Archivos de programa\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Programador de LiveUpdate automático (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Archivos de programa\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Archivos de programa\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Archivos de programa\Archivos comunes\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Archivos de programa\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSvcHst.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\archivos de programa\archivos comunes\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Archivos de programa\Archivos comunes\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\Pacsptisvr.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Unknown owner - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\Sptisrv.exe (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\CCPD-LC\symlcsvc.exe

–
End of file - 13042 bytes
Unquote


I also kept a copy of the scan result which I enclose in case it is of some use:
Quote
Scan Stats:
Scan Time: 5373 seconds
Scan Options:
Scan Targets: C:
Counts:
Total items scanned: 311.977
- Files & Directories: 308.785
- Registry Entries: 428
- Processes & Start-up Items: 2.242
- Network & Browser Items: 516
- Other: 5

Total security risks detected: 1
Total items resolved: 1
Total items that require attention: 0

Resolved Threats:
Trojan.Blusod
Virus ID: 17634
Type: Anomaly
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
State: Fully Resolved
———–
34 Registry Entries
HKEY_USERS\S-1-5-19\Control Panel\Desktop->SCRNSAVE.EXE - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-1006\Control Panel\Desktop->SCRNSAVE.EXE - Repaired
HKEY_USERS\S-1-5-20\Control Panel\Desktop->SCRNSAVE.EXE - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-500\Control Panel\Desktop->SCRNSAVE.EXE - Repaired
HKEY_USERS\.DEFAULT\Control Panel\Desktop->SCRNSAVE.EXE - Repaired
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispBackgroundPage:0 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-1006\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispBackgroundPage:0 - Repaired
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispBackgroundPage:0 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-500\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispBackgroundPage:0 - Repaired
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispBackgroundPage:0 - Repaired
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispScrSavPage:0 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-1006\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispScrSavPage:0 - Repaired
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispScrSavPage:0 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-500\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispScrSavPage:0 - Repaired
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System->NoDispScrSavPage:0 - Repaired
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore->DisableSR:0 - Repaired
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr->Start:0 - Repaired
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr->ImagePath:\SystemRoot\system32\DRIVERS\sr.sys - Repaired
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters->FirstRun:0 - Repaired
HKEY_USERS\S-1-5-19\Control Panel\Colors->Background:0 0 255 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-1006\Control Panel\Colors->Background:0 0 255 - Repaired
HKEY_USERS\S-1-5-20\Control Panel\Colors->Background:0 0 255 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-500\Control Panel\Colors->Background:0 0 255 - Repaired
HKEY_USERS\.DEFAULT\Control Panel\Colors->Background:0 0 255 - Repaired
HKEY_USERS\S-1-5-19\Control Panel\Desktop->ScreenSaveActive:1 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-1006\Control Panel\Desktop->ScreenSaveActive:1 - Repaired
HKEY_USERS\S-1-5-20\Control Panel\Desktop->ScreenSaveActive:1 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-500\Control Panel\Desktop->ScreenSaveActive:1 - Repaired
HKEY_USERS\.DEFAULT\Control Panel\Desktop->ScreenSaveActive:1 - Repaired
HKEY_USERS\S-1-5-19\Control Panel\Desktop->TileWallpaper:0 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-1006\Control Panel\Desktop->TileWallpaper:0 - Repaired
HKEY_USERS\S-1-5-20\Control Panel\Desktop->TileWallpaper:0 - Repaired
HKEY_USERS\S-1-5-21-1489292550-1608868790-3501184780-500\Control Panel\Desktop->TileWallpaper:0 - Repaired
HKEY_USERS\.DEFAULT\Control Panel\Desktop->TileWallpaper:0 - Repaired
3 Files
c:\windows\system32\phccehj0e94g.bmp - Deleted
c:\documents and settings\unai zubiete\configuración local\temp\.tt11.tmp - Deleted
c:\documents and settings\unai zubiete\configuración local\temp\.tt12.tmp - Deleted




Unresolved Threats:
Unquote

Thank you for your prompt reply.

Begoña
Post #2
Hello

Now we need to reconfigure Windows XP to show hidden files:
Double-click the My Computer icon on the Windows desktop.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.


  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:

    • C:\WINDOWS\system32\pavdr.exe
  • Click on the Upload button
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.
Post #3
Thank you for the quick reply. I get an error message when I try to scan: ERROR: Can't find upload file! My OS is in spanish, I don´t know if this is the reason. Begoña
Post #4
Try this

Please download FileLook by jpshortstuff from one of these mirrors:
Link 1
Link 2
  • Double-click FileLook.exe to run it.
  • Ensure that the BBCode Ouput checkbox is checked.
  • Copy the content of the following codebox into the main textfield:

    C:\WINDOWS\system32\pavdr.exe
  • Click the FileLook button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found at C:\fl_log.txt
Post #5
FileLook.exe v1.0 by jpshortstuff
Log created at 21:31:27 on 14/09/2008

==============================
FileLook - pavdr.exe

Unable to find file.

==============================

=EOF=
Post #6
Hello

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
Post #7
I will have to postpone all this until tomorrow. I need to print and this laptop is not connected to the printer. My desktop is in the bedroom and my husband is already sleeping. But one question: I have SP 3 installed but I only have the original Windows XP CD and the CD for SP2. SP 3 was installed through Windows update. What CD should I use for installing the Recovery Console? Thank you, Begoña
Post #11
Hi, I am back but exactly at the same stage I was last night. I tried to install the Windows XP Recovery Console with my XP CD and running "D:\i386\winnt32.exe /cmdcons" but it says that Quote the installation cannot proceed because the version of Windows installed in the computer is a more recent version than the CD. Warning: if you decide to eliminate the more recent version of Windows that it is installed in your pc, you will not be able to recover the files and settings. Unquote Something like that because I am translating from spanish. I tried to use the SP2 CD but then I think it said that it didn´t have the files? "i386" The way I do it: once I have logged in I insert the CD go to start, run and write "D:\i386\winnt32.exe /cmdcons". Is it correct? I am having too many problems. This laptop belonged to my son and he has bought a new one, so he passed this one on to me. I´ve tried to change things without doing a clean install but there are things with his name others with mine, so I wonder if it would not be better to do a clean install and start from 0. I know it will take a long time, but at least everything will look, at least, better. I get many blue screens if I leave the computer for a while and, everytime is a different problem. When I touch a key I can go back to what I was doing. I also had problems with NIS2008 as if I had not registered it. Despite I had internet connection, it will say that was unable to contact the server. I had to leave so after a few hours, when I restarted the pc, NIS was back to normal. Then it detected another trojan (Trojan.Peacomm.D). This is getting worse and worse. Now and once more before, I went to Control Panel - Display and I saw that I had the two tabs that were missing after the trojan: "Desktop & ScreenSaver". At the desktop is selected the file "phccehj0e94g" and at the Screensaver "none" but in the list is included "blphccehj0e94g". The .exe file for this is located at: C:\windows\system32\lphccehj0e94g.exe, with a black icon. I tried to delete it but it is not accesible. I have downloaded from the Microsoft website the file:"Windows XP-KB310994-SP2-Home-BootDisk-ESN.exe" (I couldn´t find the SP3 BOOT DISK). I´ve also downloaded the "Windows XP-KB936929-SP3-x86-ENU.exe", just in case. What can I do? Thank you, Begoña
Post #15
I've closed all open windows and disable NIS firewall and antispyware. I've run comboFix.exe. A little window with "green lights" the same as when you connect the computer and nothing else. I didn't get the first ComboFix blue screen or anything. I am on the other computer since I don't dare to touch anything. Do you think is working? Or did something go wrong? Begoña

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI