1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

popups,slow puter,fake warnings

Discussion in 'Virus & Other Malware Removal' started by ronbzl, Nov 9, 2007.

Thread Status:
Not open for further replies.
  1. ronbzl

    ronbzl Thread Starter

    Joined:
    Nov 9, 2007
    Messages:
    1
    ive been having all of these problems and i ran hijack and it reads as follow
    Logfile of HijackThis v1.99.1
    Scan saved at 12:02:22 PM, on 11/9/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINNT\system32\slserv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINNT\System32\hkcmd.exe
    C:\WINNT\SM1BG.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINNT\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINNT\system32\lxfndjuu.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
    O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [9802c83f] rundll32.exe "C:\WINNT\system32\ixqrdgeu.dll",b
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194324373609
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1194324485609
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DomainService - Unknown owner - C:\WINNT\system32\obajsocd.exe (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe

    i also used the combo fix reads as follows
    ComboFix 07-11-08.1 - Owner 2007-11-07 22:12:41.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.166 [GMT -6:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point
    .

    Unable to gain System Privileges

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Temp\1cb
    C:\Temp\1cb\syscheck.log
    C:\temp\tn3
    C:\WINNT\system32\a1
    C:\WINNT\system32\drivers\core.cache.dsk
    C:\WINNT\system32\drivers\core.sys
    C:\WINNT\system32\g2
    C:\WINNT\system32\g2\caws83122.exe
    C:\WINNT\system32\pac.txt
    C:\WINNT\system32\r2
    C:\WINNT\system32\r2\wr31drs.exe
    C:\WINNT\system32\ssttu.dll
    C:\WINNT\system32\uttss.bak1
    C:\WINNT\system32\uttss.ini
    C:\WINNT\system32\uttss.tmp
    C:\WINNT\system32\v8
    C:\WINNT\system32\v8\taldrvr11.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_CORE
    -------\core


    ((((((((((((((((((((((((( Files Created from 2007-10-08 to 2007-11-08 )))))))))))))))))))))))))))))))
    .

    2007-11-07 22:09 51,200 --a------ C:\WINNT\NirCmd.exe
    2007-11-07 22:08 <DIR> d-------- C:\VundoFix Backups
    2007-11-07 18:30 <DIR> d-------- C:\Documents and Settings\Owner\Shared
    2007-11-07 18:30 <DIR> d-------- C:\Documents and Settings\Owner\Incomplete
    2007-11-07 18:30 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\LimeWire
    2007-11-07 18:25 <DIR> d-------- C:\Program Files\LimeWire
    2007-11-07 11:42 <DIR> d-------- C:\Program Files\MySpace
    2007-11-07 11:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\MySpace
    2007-11-07 01:20 <DIR> d-------- C:\WINNT\system32\Mz02r
    2007-11-07 01:20 <DIR> d-------- C:\Temp\mZOr
    2007-11-07 01:20 <DIR> d-------- C:\Temp
    2007-11-07 01:20 308,024 --a------ C:\Temp\ocli.exe
    2007-11-07 01:20 35,840 --a------ C:\WINNT\mrofinu572.exe
    2007-11-07 01:20 35,840 --a------ C:\WINNT\mrofinu1000106.exe
    2007-11-07 01:20 35,328 --a------ C:\WINNT\system32\khfghfg.dll
    2007-11-06 23:50 <DIR> d-------- C:\Program Files\DivX
    2007-11-06 21:53 <DIR> d-------- C:\WINNT\Sun
    2007-11-06 15:35 685,816 --a------ C:\WINNT\system32\drivers\sptd.sys
    2007-11-06 08:12 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Yahoo!
    2007-11-06 01:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ahead
    2007-11-06 01:05 <DIR> d-------- C:\Program Files\Nero
    2007-11-06 01:05 <DIR> d-------- C:\Program Files\Common Files\Ahead
    2007-11-06 01:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2007-11-06 00:40 128,896 --------- C:\WINNT\system32\dllcache\fltmgr.sys
    2007-11-06 00:40 23,040 --------- C:\WINNT\system32\dllcache\fltmc.exe
    2007-11-06 00:40 16,896 --------- C:\WINNT\system32\dllcache\fltlib.dll
    2007-11-06 00:37 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Azureus
    2007-11-06 00:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
    2007-11-06 00:34 582,656 --------- C:\WINNT\system32\dllcache\rpcrt4.dll
    2007-11-06 00:18 <DIR> d--h----- C:\WINNT\msdownld.tmp
    2007-11-06 00:09 <DIR> d-------- C:\Program Files\Windows Defender
    2007-11-05 23:27 <DIR> d-------- C:\WINNT\provisioning
    2007-11-05 23:27 <DIR> d-------- C:\WINNT\peernet
    2007-11-05 23:25 <DIR> d-------- C:\WINNT\ServicePackFiles
    2007-11-05 23:16 <DIR> d-------- C:\WINNT\EHome
    2007-11-05 23:15 1,082,368 --a------ C:\WINNT\system32\esent.dll
    2007-11-05 23:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2007-11-05 23:07 11,776 --a------ C:\WINNT\system32\spnpinst.exe
    2007-11-05 23:07 4,569 --a------ C:\WINNT\system32\secupd.dat
    2007-11-05 23:04 <DIR> d-------- C:\Program Files\Yahoo!
    2007-11-05 23:00 <DIR> d-------- C:\Program Files\CCleaner
    2007-11-05 22:57 <DIR> d-------- C:\Program Files\Alwil Software
    2007-11-05 22:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-11-05 22:51 <DIR> d--h----- C:\WINNT\$hf_mig$
    2007-11-05 22:51 <DIR> d-------- C:\Program Files\Lavasoft
    2007-11-05 22:51 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Lavasoft
    2007-11-05 22:51 22,752 --a------ C:\WINNT\system32\spupdsvc.exe
    2007-11-05 22:50 <DIR> d-------- C:\WINNT\system32\bits
    2007-11-05 22:49 351,232 --a------ C:\WINNT\system32\winhttp.dll
    2007-11-05 22:49 18,944 --a------ C:\WINNT\system32\qmgrprxy.dll
    2007-11-05 22:49 8,192 --a------ C:\WINNT\system32\bitsprx2.dll
    2007-11-05 22:49 7,168 --a------ C:\WINNT\system32\bitsprx3.dll
    2007-11-05 22:48 271,224 --a------ C:\WINNT\system32\mucltui.dll
    2007-11-05 22:46 <DIR> d--hs---- C:\Documents and Settings\Owner\UserData
    2007-11-05 22:46 549,720 --a------ C:\WINNT\system32\wuapi.dll
    2007-11-05 22:46 325,976 --a------ C:\WINNT\system32\wucltui.dll
    2007-11-05 22:46 43,352 --a------ C:\WINNT\system32\wups2.dll
    2007-11-05 22:46 33,624 --a------ C:\WINNT\system32\wups.dll
    2007-11-05 22:45 <DIR> d-------- C:\WINNT\system32\config\systemprofile\Application Data\Symantec
    2007-11-05 22:44 <DIR> d-------- C:\Program Files\Program Shortcuts
    2007-11-05 22:39 221,184 --a------ C:\WINNT\system32\wmpns.dll
    2007-11-05 22:29 614,912 --a------ C:\WINNT\system32\h323msp.dll
    2007-11-05 22:29 331,264 --a------ C:\WINNT\system32\ipnathlp.dll
    2007-11-05 22:29 40,960 --a------ C:\WINNT\system32\mf3216.dll
    2007-11-05 22:29 40,960 --------- C:\WINNT\system32\dllcache\evtgprov.dll
    2007-10-19 18:56 1,044,480 --a------ C:\WINNT\system32\libdivx.dll
    2007-10-19 18:56 200,704 --a------ C:\WINNT\system32\ssldivx.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-08 00:28 --------- d-----w C:\Program Files\Java
    2007-11-07 23:50 --------- d-----w C:\Program Files\Common Files\Real
    2007-11-06 04:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2007-11-06 04:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-11-06 04:20 --------- d-----w C:\Program Files\Gateway
    2007-11-06 04:20 --------- d-----w C:\Program Files\Common Files\InstallShield
    2007-10-25 17:05 94,416 ----a-w C:\WINNT\system32\drivers\aswmon2.sys
    2007-10-25 17:05 93,264 ----a-w C:\WINNT\system32\drivers\aswmon.sys
    2007-10-25 17:03 23,152 ----a-w C:\WINNT\system32\drivers\aswRdr.sys
    2007-10-25 17:01 42,912 ----a-w C:\WINNT\system32\drivers\aswTdi.sys
    2007-10-25 16:58 26,624 ----a-w C:\WINNT\system32\drivers\aavmker4.sys
    2007-10-25 16:24 815,480 ----a-w C:\WINNT\system32\aswBoot.exe
    2007-10-25 16:14 95,608 ----a-w C:\WINNT\system32\AVASTSS.scr
    2007-08-21 06:15 683,520 ----a-w C:\WINNT\system32\inetcomm.dll
    2007-08-21 06:15 683,520 ------w C:\WINNT\system32\dllcache\inetcomm.dll
    2007-08-20 21:34 3,584,512 ------w C:\WINNT\system32\dllcache\mshtml.dll
    2007-08-20 10:04 824,832 ------w C:\WINNT\system32\dllcache\wininet.dll
    2007-08-20 10:04 671,232 ------w C:\WINNT\system32\dllcache\mstime.dll
    2007-08-20 10:04 63,488 ------w C:\WINNT\system32\dllcache\icardie.dll
    2007-08-20 10:04 6,058,496 ------w C:\WINNT\system32\dllcache\ieframe.dll
    2007-08-20 10:04 52,224 ------w C:\WINNT\system32\dllcache\msfeedsbs.dll
    2007-08-20 10:04 477,696 ------w C:\WINNT\system32\dllcache\mshtmled.dll
    2007-08-20 10:04 459,264 ------w C:\WINNT\system32\dllcache\msfeeds.dll
    2007-08-20 10:04 44,544 ------w C:\WINNT\system32\dllcache\iernonce.dll
    2007-08-20 10:04 384,512 ------w C:\WINNT\system32\dllcache\iedkcs32.dll
    2007-08-20 10:04 383,488 ------w C:\WINNT\system32\dllcache\ieapfltr.dll
    2007-08-20 10:04 27,648 ------w C:\WINNT\system32\dllcache\jsproxy.dll
    2007-08-20 10:04 267,776 ------w C:\WINNT\system32\dllcache\iertutil.dll
    2007-08-20 10:04 232,960 ------w C:\WINNT\system32\dllcache\webcheck.dll
    2007-08-20 10:04 230,400 ------w C:\WINNT\system32\dllcache\ieaksie.dll
    2007-08-20 10:04 214,528 ------w C:\WINNT\system32\dllcache\dxtrans.dll
    2007-08-20 10:04 193,024 ------w C:\WINNT\system32\dllcache\msrating.dll
    2007-08-20 10:04 153,088 ------w C:\WINNT\system32\dllcache\ieakeng.dll
    2007-08-20 10:04 132,608 ------w C:\WINNT\system32\dllcache\extmgr.dll
    2007-08-20 10:04 124,928 ------w C:\WINNT\system32\dllcache\advpack.dll
    2007-08-20 10:04 105,984 ------w C:\WINNT\system32\dllcache\url.dll
    2007-08-20 10:04 102,400 ------w C:\WINNT\system32\dllcache\occache.dll
    2007-08-20 10:04 1,152,000 ------w C:\WINNT\system32\dllcache\urlmon.dll
    2007-08-17 10:21 625,152 ------w C:\WINNT\system32\dllcache\iexplore.exe
    2007-08-17 10:20 63,488 ------w C:\WINNT\system32\dllcache\ie4uinit.exe
    2007-08-17 10:20 13,824 ------w C:\WINNT\system32\dllcache\ieudinit.exe
    2007-08-17 07:34 161,792 ------w C:\WINNT\system32\dllcache\ieakui.dll
    2003-08-27 20:19 36,963 ----a-r C:\Program Files\Common Files\SM1updtr.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C1DD717-53B2-485E-A17B-C9977C205E10}]
    2007-11-07 01:20 35328 --a------ C:\WINNT\system32\khfghfg.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D750C1A-08AD-46F4-A3F3-F8A01B85A982}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="C:\WINNT\System32\igfxtray.exe" [2003-07-10 04:25]
    "HotKeysCmds"="C:\WINNT\System32\hkcmd.exe" [2003-07-10 04:13]
    "SM1BG"="C:\WINNT\SM1BG.EXE" [2003-08-27 14:20]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 10:20]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 01:56]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04]
    "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{1C1DD717-53B2-485E-A17B-C9977C205E10}"= C:\WINNT\system32\khfghfg.dll [2007-11-07 01:20 35328]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfghfg]
    khfghfg.dll 2007-11-07 01:20 35328 C:\WINNT\system32\khfghfg.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages"= msv1_0 C:\WINNT\system32\ssttu.dll


    .
    Contents of the 'Scheduled Tasks' folder
    "2007-11-06 04:44:42 C:\WINNT\Tasks\ISP signup reminder 2.job"
    - C:\WINNT\System32\OOBE\oobebaln.exe
    "2007-11-06 04:44:43 C:\WINNT\Tasks\ISP signup reminder 3.job"
    - C:\WINNT\System32\OOBE\oobebaln.exe
    "2007-11-08 04:27:13 C:\WINNT\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    .
    **************************************************************************

    catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-07 22:25:23
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-11-07 22:29:49 - machine was rebooted
    .
    --- E O F ---
    and a smitfraud
    SmitFraudFix v2.250

    Scan done at 11:26:31.79, Fri 11/09/2007
    Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    »»»»»»»»»»»»»»»»»»»»»»»» DNS



    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End
    help me please and thank you
     
  2. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Hi, Welcome to TSG!!


    Please download ATF Cleaner by Atribune.
    This program is for XP and Windows 2000 only

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.

    Click Exit on the Main menu to close the program.



    Download and scan with SUPERAntiSpyware Free for Home Users
    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
    • Under "Configuration and Preferences", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Scan for tracking cookies.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive.
    • On the right, under "Complete Scan", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    • Make sure everything has a checkmark next to it and click "Next".
    • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Please copy and paste the Scan Log results in your next reply with a new hijackthis log.
    • Click Close to exit the program.
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/649849

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice