1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

downloadable cleaner

Discussion in 'Virus & Other Malware Removal' started by mudvayne37, Apr 17, 2004.

Thread Status:
Not open for further replies.
Page 1 of 2
Advertisement
  1. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    Pent3 WinXP Pro 160mb RAM 2 HDs 1. 10GB 2. 30GB Broadband

    I have been getting an error when I boot my computer that reads "Could not initialize installation. File size expected # File Size Returned Different #." I have ran Symantec Antivirus and removed the trogan virus but I am still gettin this error. I dont know if Hijack This will help but here is my log file.


    Logfile of HijackThis v1.97.7
    Scan saved at 2:27:57 PM, on 4/17/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe
    C:\Program Files\Common Files\CMEII\CMESys.exe
    C:\WINDOWS\System32\SK6200dm.exe
    C:\WINDOWS\System32\Atiptaxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exe
    C:\Program Files\Common Files\GMT\GMT.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\WINDOWS\explorer.exe
    C:\PROGRA~1\DAP\DAP.EXE
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [DM_Server] C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe /onreboot
    O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
    O4 - HKLM\..\Run: [Hot Key Kbd 2690 Daemon] SK6200dm.exe
    O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
    O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
    O4 - Startup: Check For Dope Wars Updates.lnk = C:\Program Files\Dopewars\WiseUpdt.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downl...b?1079919784996
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downl...922/wmv9VCM.CAB
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/threatinfo/virusinfo/webscan.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...8012.3115509259
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/...ash/swflash.cab

    Thank You In Advance For Any Help.

    Pay no attention to my other replys in this thread... I was getting used to the forum and I kept making mistakes so I fixed it.
     
    mudvayne37, Apr 17, 2004
    #1
  3. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Hi and welcome. First thing is to not post in a thread that is almost a year old ;) You'll be overlooked, not to mention, the thread was already marked resolved.

    I'll split you into your own thread.
     
    ~Candy~, Apr 17, 2004
    #2
  4. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    Sorry about that. Usually boards get upset with people posting threads about the same thing after it had been made a thread already. Also the solution that helped that guy was what i was looking for and other then just copying the whole thread i decided to just bring it back.
     
    mudvayne37, Apr 17, 2004
    #3
  5. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    Also just to make sure I dont look like to much of a moron I am going to state my problem again. I get an error when I boot my computer that says "Could not initialize installation. File size expected # File Size Returned Different #.
     
    mudvayne37, Apr 17, 2004
    #4
  6. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    ~Candy~, Apr 17, 2004
    #5
  7. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    I just downloaded BitDefender. Im running the scan right now. I have a question... Whats an I/O Error?
     
    mudvayne37, Apr 17, 2004
    #6
  8. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Input/Output error.
     
    ~Candy~, Apr 17, 2004
    #7
  9. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    hmmmm... just spent the last hour running the virus scan and it made it about half way through and asked me if i wanted to update and i clicked yes and the scan stopped and it restarted. I completely forgot to update it before i started. It did find one virus that i saw before it shutdown and it said it found it, then it said it couldnt remove it, then it said it moved it. After I ran the Symantec virus scan alot of my programs wouldnt work anymore and i had to reinstall them. All of that on top of this error have me wondering if it would just be a good idea to debug, format, and just start over. And have my network cable unplugged until i install the virus scan. And then as soon as I connect to the internet I will update the virus definitions. That should block anything that i have backed up to disk thats infected right?
     
    mudvayne37, Apr 17, 2004
    #8
  10. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    One more question... Is it even worth it for me to run Hijack This in this situation?
     
    mudvayne37, Apr 17, 2004
    #9
  11. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    You need to turn system restore off too. A hijack this log probably wouldn't hurt. Can you check the log for the name of the virus?

    If a format and reinstall is an option for you, I've found sometimes, you have more hair leftover in the end ;)
     
    ~Candy~, Apr 17, 2004
    #10
  12. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    Temporary Internet Files\Content.IE5\4F9JIQ7D\install026[1].exe=>(Upx) Infected Trojan.SecondThought.C

    Thats the virus file. As for DFFR, Its an option... Im just wondering if it would cause more hairloss trying to fix this, or reinstalling all of my programs and running the possibility of not backing up something im going to miss. I know I have most of this backed up but if I start backing it up now I fear that its going to be pointless if its infected because it wont run right anyway.

    There should be a virus programmer tied up in a corner somewhere at all times that you can go and beat the crap out of when things like this happen. I know it would make me feel alot better.
     
    mudvayne37, Apr 17, 2004
    #11
  13. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Go ahead and post a hijack this log, one of the security gurus will look at it.
     
    ~Candy~, Apr 17, 2004
    #12
  14. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    The details of my problem are in the post titled "Downloadable Cleaner" but here is my HJT log.

    Logfile of HijackThis v1.97.7
    Scan saved at 2:27:57 PM, on 4/17/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe
    C:\Program Files\Common Files\CMEII\CMESys.exe
    C:\WINDOWS\System32\SK6200dm.exe
    C:\WINDOWS\System32\Atiptaxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exe
    C:\Program Files\Common Files\GMT\GMT.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\WINDOWS\explorer.exe
    C:\PROGRA~1\DAP\DAP.EXE
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [DM_Server] C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe /onreboot
    O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
    O4 - HKLM\..\Run: [Hot Key Kbd 2690 Daemon] SK6200dm.exe
    O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
    O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
    O4 - Startup: Check For Dope Wars Updates.lnk = C:\Program Files\Dopewars\WiseUpdt.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downl...-a3de-373c3e5552fc/msSecAdv.cab?1079919784996
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...pple.com/mickey/us/win/QuickTimeInstaller.exe
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/threatinfo/virusinfo/webscan.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38012.3115509259
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    mudvayne37, Apr 17, 2004
    #13
  15. mudvayne37

    mudvayne37 Thread Starter

    Joined:
    Apr 17, 2004
    Messages:
    56
    I posted it as a new topic. Thank You for your help so far.
     
    mudvayne37, Apr 17, 2004
    #14
  16. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Let me merge this one with the other one, it is always best to keep things in the same thread ;)
     
    ~Candy~, Apr 17, 2004
    #15

  17. Sponsor

Page 1 of 2
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/221255

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice