1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Yellow Triangle Trojan

Discussion in 'Virus & Other Malware Removal' started by captainclean, Oct 21, 2009.

Thread Status:
Not open for further replies.
Advertisement
  1. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    i have been getting a yellow triangle appearing in my toolbar the last few months. it stays for a couple of minutes then disappears. while it is there the other toolbar icons do not display their names when i hover over them.
    i have not left-clicked the triangle at all.
    the only malware detected by AVG recently was a false positive trojan.
    i enclose a picture of the toolbar complete with yellow triangle.

    what will happen if i leave it ?
    also is it safe to use the Combifix program as i have read several reports that it may contain rootkits ?

    here is a hijackthis log from today:

    Logfile of HijackThis v1.99.1
    Scan saved at 13:49:36, on 21/10/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\a-squared Free\a2service.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Eraser\eraser.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\AVG\AVG8\avgui.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\system32\dlbtcoms.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Documents and Settings\charles.DJ7H5S1J\Local Settings\Application

    Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\charles.DJ7H5S1J\Local Settings\Application

    Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\charles.DJ7H5S1J\Local Settings\Application

    Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\charles.DJ7H5S1J\Local Settings\Application

    Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
    C:\Documents and Settings\charles.DJ7H5S1J\Local Settings\Application

    Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

    http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL

    = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

    http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

    http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page =

    http://www.euro.dell.com/countries/uk/enu/gen/default.htm
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

    http://go.microsoft.com/fwlink/?LinkId=74005
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter -

    {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program

    Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection -

    {53707962-6F74-2D53-2644-206D7942484F} -

    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -

    C:\WINDOWS\system32\dla\tfswshx.dll
    O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} -

    C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog

    Devices\Core\smax4pnp.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

    Files\Java\j2re1.4.2_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [IntelMeM] "C:\Program Files\Intel\Modem Event

    Monitor\IntelMEM.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo

    AIO Printer 922\dlbtbmgr.exe"
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program

    Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [DLBTCATS] rundll32

    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDL

    [email protected]
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone

    Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32

    v3\ScreenPrint32.exe -startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &

    Destroy\TeaTimer.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

    {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
    O17 -

    HKLM\System\CCS\Services\Tcpip\..\{8C7C153F-7D8C-4D42-9B08-639CA395

    F385}: NameServer = 195.92.195.91 195.92.195.90
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

    C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH -

    C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner -

    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file

    missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. -

    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. -

    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

    Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program

    Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

    C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    thanks for your help

    cc
     

    Attached Files:

  2. Sponsor

  3. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    Welcome to TSG :)

    [​IMG] Please download Malwarebytes' Anti-Malware from Here.



    Double Click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.

    Extra Note:



    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.
     
  4. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    hey sjpritch25 thanks for taking the time to help me !!

    i ran the MBAM program... it came up clean:

    Malwarebytes' Anti-Malware 1.41
    Database version: 2775
    Windows 5.1.2600 Service Pack 3

    24/10/2009 11:13:32
    mbam-log-2009-10-24 (11-13-32).txt

    Scan type: Quick Scan
    Objects scanned: 26439
    Time elapsed: 14 minute(s), 3 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    the yellow triangle appeared for 2 minutes

    thanks again

    cc
     
  5. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    We need to see some additional information about what is happening in your machine.
    Please perform the following scan:
    • Download DDS by sUBs from one of the following links. Save it to your desktop.
    • Double click on the DDS icon, allow it to run.
    • A small box will open, with an explanation about the tool.
    • When done, DDS will open two (2) logs
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop.
    • The instructions here ask you to attach the Attach.txt.
      [​IMG]
    • Instead of attaching, please copy/past both logs into your next reply.
    • Close the program window, and delete the program from your desktop.
    Please note: You may have to disable any script protection running if the scan fails to run.
    After downloading the tool, disconnect from the internet and disable all antivirus protection.
    Run the scan, enable your A/V and reconnect to the internet.
    Information on A/V control HERE
     
  6. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    hi sjpritch25....sorry i could not respond sooner :eek:

    here are the 2 logs you asked for:


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-10-24.04)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 07/10/2006 13:42:08
    System Uptime: 26/10/2009 12:28:04 (1 hours ago)

    Motherboard: Dell Computer Corp. | | 0TC666
    Processor: Intel(R) Celeron(R) CPU 2.66GHz | Microprocessor |

    2660/533mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 34 GiB total, 18.679 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP314: 10/10/2009 18:18:38 - System Checkpoint
    RP315: 12/10/2009 14:00:37 - Removed Ad-Aware 2007
    RP316: 13/10/2009 20:12:42 - Installed SUPERAntiSpyware Free Edition
    RP317: 17/10/2009 12:54:11 - System Checkpoint
    RP318: 18/10/2009 14:47:52 - System Checkpoint
    RP319: 19/10/2009 14:03:50 - Avg8 Update
    RP320: 25/10/2009 10:30:10 - System Checkpoint

    ==== Installed Programs ======================

    2 Pic
    a-squared Free 3.5
    ABBYY FineReader 5.0 Sprint Plus
    Adobe Download Manager 2.2 (Remove Only)
    Adobe Flash Player 10 Plugin
    Adobe Reader 7.1.0
    Adobe Shockwave Player
    Agent Ransack Version 1.7.3
    Arcade Chess
    Assassin SE
    AVG Free 8.5
    CCleaner (remove only)
    Dell Driver Reset Tool
    Dell Media Experience
    Dell Media Experience Update
    Dell Photo AIO Printer 922
    Dell Picture Studio v3.0
    Dell System Restore
    DellSupport
    Disk Investigator v1.3
    Dr SpeedTouch
    Eraser
    File Recover 6.2
    Flickr Uploadr 2.5.0.15
    FotoSketcher - Version 1.81
    G15A922EN
    Google Chrome
    HijackThis 1.99.1
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows XP (KB954550-v5)
    Image Resizer Powertoy for Windows XP
    Index.dat Suite
    Intel(R) 537EP V9x DF PCI Modem
    Intel(R) Extreme Graphics 2 Driver
    Intel(R) PRO Network Adapters and Drivers
    Intel(R) PROSet for Wired Connections
    Internet Explorer Default Page
    Jasc Paint Shop Photo Album 5
    Jasc Paint Shop Pro Studio, Dell Editon
    Java 2 Runtime Environment, SE v1.4.2_03
    Karen's Cookie Viewer
    Learn2 Player (Uninstall Only)
    Malwarebytes' Anti-Malware
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Standard Edition 2003
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works 7.0
    MjM Free Photo Recovery
    Modem Event Monitor
    Modem Helper
    Modem On Hold
    Mozilla Firefox (3.0.14)
    MSN
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    My Way Search Assistant
    Neo's SafeKeys 2008
    PC Inspector File Recovery
    PhotoFiltre
    Picasa 2
    Pinball Collection Vol II
    PowerDVD 5.5
    PrimoPDF
    Print Gallery
    QuickTime
    ScreenPrint32 v3.5
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Silent-Bob 1.8
    Sonic DLA
    Sonic RecordNow Audio
    Sonic RecordNow Copy
    Sonic RecordNow Data
    Sonic Update Manager
    Sophos Anti-Rootkit 1.3.1
    SpeedTouch USB Software
    Spybot - Search & Destroy
    Spybot - Search & Destroy 1.4
    SUPERAntiSpyware Free Edition
    Tiscali Internet
    Unlocker 1.8.5
    Update for Windows Internet Explorer 8 (KB971930)
    Viewpoint Media Player
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    Wanadoo Europe Installer
    Wanadoo Search Toolbar
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows XP Service Pack 3
    xp-AntiSpy 3.97-3
    Yahoo! Install Manager
    Yahoo! Toolbar
    ZoneAlarm
    ZoneAlarm Spy Blocker

    ==== Event Viewer Messages From Past Week ========

    21/10/2009 11:15:36, error: Service Control Manager [7009] - Timeout (30000

    milliseconds) waiting for the TrueVector Internet Monitor service to connect.
    21/10/2009 11:15:36, error: Service Control Manager [7009] - Timeout (30000

    milliseconds) waiting for the Fax service to connect.
    21/10/2009 11:15:36, error: Service Control Manager [7000] - The TrueVector

    Internet Monitor service failed to start due to the following error: The service did

    not respond to the start or control request in a timely fashion.
    21/10/2009 11:15:36, error: Service Control Manager [7000] - The Fax service failed

    to start due to the following error: The service did not respond to the start or

    control request in a timely fashion.
    20/10/2009 13:15:04, error: Service Control Manager [7022] - The AVG8 E-mail

    Scanner service hung on starting.
    20/10/2009 08:51:01, error: Service Control Manager [7009] - Timeout (30000

    milliseconds) waiting for the AVG8 E-mail Scanner service to connect.
    20/10/2009 08:51:01, error: Service Control Manager [7000] - The AVG8 E-mail

    Scanner service failed to start due to the following error: The service did not

    respond to the start or control request in a timely fashion.

    ==== End Of File ===========================



    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@



    DDS (Ver_09-10-24.04) - NTFSx86
    Run by charles at 13:03:37.39 on 26/10/2009
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.21 [GMT 0:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

    {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\a-squared Free\a2service.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Eraser\eraser.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\AVG\AVG8\avgui.exe
    C:\Documents and Settings\charles.DJ7H5S1J\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uSearchAssistant = about:blank
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} -

    c:\progra~1\spybot~1\SDHelper.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
    TB: Wanadoo: {8b68564d-53fd-4293-b80c-993a9f3988ee} - c:\progra~1\wanadoo\wsbar\WSBar.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Eraser] c:\program files\eraser\eraser.exe -hide
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    mRun: [SoundMAXPnP] "c:\program files\analog devices\core\smax4pnp.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\java\j2re1.4.2_03\bin\jusched.exe"
    mRun: [IntelMeM] "c:\program files\intel\modem event monitor\IntelMEM.exe"
    mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
    mRun: [Dell Photo AIO Printer 922] "c:\program files\dell photo aio printer 922\dlbtbmgr.exe"
    mRun: [SpeedTouch USB Diagnostics] "c:\program files\thomson\speedtouch usb\Dragdiag.exe" /icon
    mRun: [igfxtray] c:\windows\system32\igfxtray.exe
    mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
    mRun: [igfxpers] c:\windows\system32\igfxpers.exe
    mRun: [DLBTCATS] rundll32

    c:\windows\system32\spool\drivers\w32x86\3\DLBTtime.dll,[email protected]
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
    mRun: [ScreenPrint32] c:\program files\screenprint32 v3\ScreenPrint32.exe -startup
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} -

    c:\progra~1\spybot~1\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -

    hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

    hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} -

    hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Notify: avgrsstarter - avgrsstx.dll
    Notify: igfxcui - igfxdev.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program

    files\superantispyware\SASSEH.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\charle~1.dj7\applic~1\mozilla\firefox\profiles\vf5icwlo.default\
    FF - prefs.js: browser.startup.homepage - www.google.ca
    FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\charles.dj7h5s1j\local settings\application

    data\google\update\1.2.183.7\npGoogleOneClick8.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\np32dsw.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\NPAdbESD.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npnul32.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\NPOFFICE.DLL
    FF - plugin: c:\progra~1\mozill~1\plugins\nppdf32.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin2.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin3.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin4.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin5.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin6.dll
    FF - plugin: c:\progra~1\mozill~1\plugins\npqtplugin7.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
    FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-27 335240]
    R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-27 108552]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-15 9968]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-15 74480]
    R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2009-8-31 18816]
    R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-3-29 908056]
    R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-3-29 297752]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\ed.tmp --> c:\windows\system32\ED.tmp [?]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-15 7408]

    =============== Created Last 30 ================

    2009-10-13 19:14:20 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
    2009-10-13 19:12:47 0 d-----w- c:\program files\SUPERAntiSpyware
    2009-10-13 19:12:46 0 d-----w- c:\docume~1\charle~1.dj7\applic~1\SUPERAntiSpyware.com
    2009-10-13 19:10:24 0 d-----w- c:\program files\common files\Wise Installation Wizard

    ==================== Find3M ====================

    2009-10-26 13:04:05 105191456 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2009-10-26 08:21:52 1233404 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2009-10-21 12:49:36 6794 ----a-w- c:\program files\hijackthis.log
    2009-10-17 16:03:20 286720 ------w- c:\windows\Setup1.exe
    2009-09-10 13:54:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-10 13:53:50 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-19 11:46:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-08-14 17:52:01 160203 ----a-w- c:\windows\MjM Free Photo Recovery Uninstaller.exe
    2009-08-05 09:01:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-08-05 09:01:48 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll
    2006-11-22 10:32:25 0 ----a-w- c:\program files\common files\err.log
    2005-02-16 10:06:00 218112 ----a-w- c:\program files\HijackThis.exe
    2008-09-13 08:37:24 32768 --sha-w- c:\windows\system32\config\systemprofile\local

    settings\history\history.ie5\mshist012008091320080914\index.dat

    ============= FINISH: 13:05:44.82 ===============


    thanks for taking the time to check them

    cc
     
  7. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    your definitions for malwarebytes are fairly old. Please update and run another quick scan. I don't see anything in your log.
     
  8. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    hi again sjpritch25

    here is the new MBAM log.... thanks for taking the time to read it ;)

    Malwarebytes' Anti-Malware 1.41
    Database version: 3040
    Windows 5.1.2600 Service Pack 3

    27/10/2009 14:32:36
    mbam-log-2009-10-27 (14-32-36).txt

    Scan type: Quick Scan
    Objects scanned: 123032
    Time elapsed: 36 minute(s), 16 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    cc
     
  9. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    how is everything running?
     
  10. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    hi sjpritch25

    the yellow triangle has not reappeared for a day or so. i am taking precautions against keyloggers when paying for stuff online.... maybe i should just carry on as usual but be vigilant.
    Thanks again for your help. If any new symptoms develop i will get in touch.

    cc

    PS i love the Halloween banner !!
     
  11. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    well use a computer for a few more days and give me an update.
     
  12. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    thanks for that sjpritch25

    the YT reappeared briefly yesterday. I upgraded AVG to the latest version... it found several revsci tracking cookies.

    cc
     
  13. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    how is everything now?
     
  14. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    hi sjpritch25

    the computer is a bit slow. it froze completely half an hour ago when i was loading Chrome...even the Task Manager wouldn't work.

    the yellow triangle appears most days after about 20 minutes online.

    cc
     
  15. sjpritch25

    sjpritch25 Malware Specialist

    Joined:
    Sep 8, 2005
    Messages:
    9,113
    Navigate to Add/Remove programs and remove the following
    xp-AntiSpy 3.97-3

    Let me know if you still receive that yellow triangle. Thanks
     
  16. captainclean

    captainclean Thread Starter

    Joined:
    Jul 26, 2005
    Messages:
    120
    hi sjpritch25... i have done as you suggested. the YT came on before i started.
    i will see if that is the end of it.

    is xp antispy a bad product ? i know that "xp antispyware" is malware ... is it the same thing as xp antispy ?

    thanks so much for your help

    cc
     
  17. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/870356