1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Help! I Removed Services.exe And Rundll32

Discussion in 'Virus & Other Malware Removal' started by CryoDragoon, May 13, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    101,710
    Please run Kaspersky online virus scan Kaspersky Online Scanner.

    After the updates have downloaded, click on the "Scan Settings" button.
    Choose the "Extended database" for the scan.
    Under "Please select a target to scan", click "My Computer".
    When the scan is finished, Save the results from the scan!

    Note: You have to use Internet Explorer to do the online scan.
     
  2. CryoDragoon

    CryoDragoon Thread Starter

    Joined:
    Oct 29, 2006
    Messages:
    29
    Is it... supposed to be this huge? :eek:


    KASPERSKY ONLINE SCANNER REPORT
    Monday, May 19, 2008 7:13:57 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 19/05/2008
    Kaspersky Anti-Virus database records: 784486
    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true
    Scan Target My Computer
    C:\
    D:\
    E:\
    F:\
    G:\
    Scan Statistics
    Total number of scanned objects 173423
    Number of viruses found 31
    Number of infected objects 83
    Number of suspicious objects 10
    Duration of the scan process 02:17:32

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc11.zip.mwt/istsvc.exe Suspicious: Password-protected-EXE skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc11.zip.mwt ZIP: suspicious - 1 skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc12.zip.mwt/istsvc.exe Suspicious: Password-protected-EXE skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechISTsvc12.zip.mwt ZIP: suspicious - 1 skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechSlotch36.zip.mwt/istsvc.exe Suspicious: Password-protected-EXE skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ISearchTechSlotch36.zip.mwt ZIP: suspicious - 1 skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VcodeceMedia1.zip.mwt/uninst.exe Suspicious: Password-protected-EXE skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VcodeceMedia1.zip.mwt ZIP: suspicious - 1 skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped
    C:\Documents and Settings\Iris\Local Settings\Temporary Internet Files\AntiPhishing\CAE33426-F44F-405C-9719-08FC9932048E.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Geschiedenis\History.IE5\INDEX.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Loek\Local Settings\Temporary Internet Files\AntiPhishing\CAE33426-F44F-405C-9719-08FC9932048E.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Geschiedenis\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Patricia.TIM\Local Settings\Temporary Internet Files\AntiPhishing\CAE33426-F44F-405C-9719-08FC9932048E.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\ipfilter.cache Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\tmp\AZU61807.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\tmp\AZU61808.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\tmp\AZU61809.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\tmp\AZU61810.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\tmp\AZU61811.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Azureus\tmp\AZU61812.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74679217-67bc8581.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74679217-67bc8581.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74679217-67bc8581.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
    C:\Documents and Settings\Tim Bergman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74679217-67bc8581.zip ZIP: infected - 3 skipped
    C:\Documents and Settings\Tim Bergman\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-5-19-2008( 16-2-10 ).LOG Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Cookies\INDEX.DAT Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Feeds\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\pending.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1E9C_C1CE_9CC1_A09F\dfsr.db Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1E9C_C1CE_9CC1_A09F\fsr.log Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1E9C_C1CE_9CC1_A09F\fsrtmp.log Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1E9C_C1CE_9CC1_A09F\tmp.edb Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\real\members.stg Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\shadow\members.stg Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Geschiedenis\History.IE5\INDEX.DAT Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Geschiedenis\History.IE5\MSHist012008051920080520\index.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\hsperfdata_Tim Bergman\1428 Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF1803.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF1813.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF4F03.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF4F10.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF6704.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF6723.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF6A78.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DF6E87.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DFC933.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temp\~DFC943.tmp Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temporary Internet Files\AntiPhishing\CAE33426-F44F-405C-9719-08FC9932048E.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\Mijn documenten\Tim 1\torrent downloads\The Ultimate Guide To Job Interview Answers 2008.zip/The Ultimate Guide To Job Interview Answers 2008.exe Infected: Backdoor.Win32.Prorat.jz skipped
    C:\Documents and Settings\Tim Bergman\Mijn documenten\Tim 1\torrent downloads\The Ultimate Guide To Job Interview Answers 2008.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\Tim Bergman\ntuser.dat Object is locked skipped
    C:\Documents and Settings\Tim Bergman\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Tim Bergman\UserData\index.dat Object is locked skipped
    C:\itouch_crash_info.txt Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\Antispam\Log\Spam.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
    C:\Program Files\Heroes Chronicles\Revolt of the Beastmasters\Beastmaster.exe.old Suspicious: Packed.Win32.PePatch.dk skipped
    C:\Program Files\Heroes Chronicles\The Sword of Frost\Sword.exe.old Suspicious: Packed.Win32.PePatch.dk skipped
    C:\Program Files\HijackThis\backups\backup-20070930-125634-902.dll Infected: not-virus:Hoax.Win32.Renos.kz skipped
    C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
    C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\Program Files\Mozilla Firefox\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Program Files\MSN Messenger\msimg32.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\53420325.htm.mwt Infected: Exploit.HTML.Mht skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76110F20 Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
    C:\Program Files\PeerGuardian2\history.db Object is locked skipped
    C:\QooBox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\f3PSSavr.scr.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lncom_.exe.vir/setup-is201825.exe Infected: Trojan.Win32.Monder.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lncom_.exe.vir CAB: infected - 1 skipped
    C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\sqeilpxm.dll.vir Infected: Trojan.Win32.Monder.di skipped
    C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\wadnwsxq.dll.vir Infected: Trojan.Win32.Monder.dj skipped
    C:\SDFix\backups\backups.zip/backups/fservice.exe Infected: Backdoor.Win32.Prorat.dz skipped
    C:\SDFix\backups\backups.zip/backups/reginv.dll Infected: Backdoor.Win32.Prorat.ae skipped
    C:\SDFix\backups\backups.zip/backups/services.exe Infected: Backdoor.Win32.Prorat.dz skipped
    C:\SDFix\backups\backups.zip/backups/sservice.exe Infected: Backdoor.Win32.Prorat.dz skipped
    C:\SDFix\backups\backups.zip/backups/winkey.dll Infected: Backdoor.Win32.Prorat.bj skipped
    C:\SDFix\backups\backups.zip ZIP: infected - 5 skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000010.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000012.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000013.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000014.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000015.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000016.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000017.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000018.SCR Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000019.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000020.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000021.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000022.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000023.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.aq skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000024.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bh skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000026.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000027.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ax skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000029.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000031.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000032.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000033.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000035.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000036.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000037.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000038.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000039.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000047.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000048.scr Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000051.dll Infected: Trojan.Win32.Monder.di skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP2\A0000053.dll Infected: Trojan.Win32.Monder.dj skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP4\A0001316.exe/setup-is201825.exe Infected: Trojan.Win32.Monder.gen skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP4\A0001316.exe CAB: infected - 1 skipped
    C:\System Volume Information\_restore{20FACB27-B213-45DF-B711-A07B77057628}\RP4\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\SYSTEM32\0e3p2pjq.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped
    C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
    C:\WINDOWS\SYSTEM32\DRIVERS\sptd.sys Object is locked skipped
    C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
    C:\WINDOWS\SYSTEM32\ixyis.exe Infected: Trojan.Win32.DNSChanger.hd skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
    C:\WINDOWS\WIASERVC.LOG Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    Scan process completed.
     
  3. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    101,710
    There are many things already in quarantine or in system restore, which we will be flushing out when we're done.

    For now, please locate and delete these files manually:

    C:\Documents and Settings\Tim Bergman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74679217-67bc8581.zip
    C:\Documents and Settings\Tim Bergman\Mijn documenten\Tim 1\torrent downloads\The Ultimate Guide To Job Interview Answers 2008.zip
    C:\Program Files\Heroes Chronicles\Revolt of the Beastmasters\Beastmaster.exe.old
    C:\Program Files\Heroes Chronicles\The Sword of Frost\Sword.exe.old
    C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
    C:\Program Files\MSN Messenger\msimg32.dll
    C:\Program Files\MSN Messenger\riched20.dll
    C:\WINDOWS\SYSTEM32\0e3p2pjq.ini
    C:\WINDOWS\SYSTEM32\ixyis.exe


    After doing that, please post a new HijackThis log.
     
  4. CryoDragoon

    CryoDragoon Thread Starter

    Joined:
    Oct 29, 2006
    Messages:
    29
    Done... All of them are removed...


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:17:16, on 20-5-2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5296.0000)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Azureus\Azureus.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.defaulthomepage.info
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.0\THGuard.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=040508 serial=DR12WEX-1504397-KTY lang=EN
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Mp4 Player] "C:\Program Files\Mp4 Player\Mp4Player.exe" hmw
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
    O4 - Startup: Sublime Imaging.lnk = C:\Documents and Settings\Tim Bergman\Mijn documenten\Tim\lucid dreaming\sublime\Sublime.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZK
    O8 - Extra context menu item: + &Mass Downloader: download this file - C:\Program Files\Mass Downloader\Add_Url.htm
    O8 - Extra context menu item: + Mass Downloader: download &All files - C:\Program Files\Mass Downloader\Add_All.htm
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.1.74.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120156365790
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135606296968
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    --
    End of file - 11523 bytes
     
  5. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    101,710
    Rescan with HijackThis, close all browser windows except HijackThis, put a check mark beside these entries and click fix checked.

    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZK



    Read here about MegaUpload Toolbar and then decide if you really want to keep it or not:

    http://www.castlecops.com/modules.php?name=CLSID&query=4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C


    How is the computer running now?
     
  6. CryoDragoon

    CryoDragoon Thread Starter

    Joined:
    Oct 29, 2006
    Messages:
    29
    I've removed both hijackthis thingies, as well as the megauploadwhateverthingie...

    And yeah.. My computer's doing fine, actually... I don't think I have any problems with it anymore (not that I can tell, anyways)...
     
  7. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    101,710
    Here are some final instructions for you.

    The following program will remove the tools we've used and their associated files and backups and then it will delete itself.

    Please download OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Make sure you have an Internet Connection.
    • Double-click OTMoveIt.exe to run it. (Vista users, please right-click on OTMoveIt2.exe and select "Run as an Administrator")
    • Click on the CleanUp! button
    • A list of tool components used in the cleanup of malware will be downloaded.
    • If your firewall or real-time protection attempts to block OTMoveIt2 to reach the Internet, please allow the application to do so.
    • Click Yes to begin the cleanup process and remove these components, including this application which will delete itself.
    • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.


    Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

    To turn off system restore, on the Desktop, right click on My Computer and click on Properties.
    Click the System Restore tab.
    Check Turn off System Restore.
    Click Apply and then click OK.

    Restart your computer, turn System Restore back on and create a restore point.

    To create a new restore point, click on Start – All Programs – Accessories – System Tools and then select System Restore.

    In the System Restore wizard, select Create a restore point and click the Next button.

    Type a name for your new restore point then click on Create.


    I also recommend downloading SPYWAREBLASTER for added protection.

    Read here for info on how to tighten your security.


    Delete Temporary Files:

    Go to Start - Run and type in cleanmgr and click OK.
    Let it scan your system for files to remove.
    Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
    Press OK to remove them.


    ***

    You should trim down your start-ups (these show as the 04 entries in your HijackThis log) as there are too many running. You can research them at these sites and if they aren’t required at start-up then you can uncheck them in msconfig via Start - Run - type msconfig click OK and then click on the start-up tab.

    http://castlecops.com/StartupList.html
    http://www.bleepingcomputer.com/startups/
    http://www.windowsstartup.com/wso/index.php
     
  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/711812