October 19, 200817 yr Rigth guys, this is going to be a bit narrow: I don't know what type of Trojan it is, Task Manager won't open. I can't get onto the internet on that computer. The Anti Virus Programme I have (AVG) did not work, may have been unactivated. Can't system restore. I've been into safe mode, but there is no checkpoints. TIA. {see what i did there?} btw before I look like one of those people who feel like announcing they're name at the end of a message. tia = thanks in advance. danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 19, 200817 yr If you have a flash drive download Ad Aware onto it and run it on the PC that is infected. You may have to run it in safe mode.
October 19, 200817 yr Author I did that already, but nothing happened, I checked on the removable disk, everything, the programme did not run. Do you know any hotkeys for system restore? Turns out I cannot find my control panel. danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 19, 200817 yr System restore for a virus is risky, because it may just stay with the PC even after the restore. can you run anything in safe mode at all?
October 20, 200817 yr See if you can run Hijack This or MalwareBytes Anti Malware. I just used it on a friend's computer and it cleaned out pretty much eveything in just the quick scan (I know because I scanned with 3-4 other programs on top of it, and each found nothing or 2 things max). HJT should run. I got it to run on a computer with XP Antivirus 2008, so you should be able to get it to run... Speaking of the XP AntiSpyware virus, could you give us more information? I get that you're locked out of task manager, and your computer is slow...Mine does the same thing, which I should be fixing soon. Do you get popups asking you to download another program? Or anything at all you can tell us that will lead us in the right direction. One more thing - try to do run > msconfig and go to the startup tab, see if there's anything in there that shouldn't be (ie anything you don't know). Don't uncheck it, just write it down and post here. If you can't get it, don't worry, there's more things you can do. [hide=Funny Quotes]So you sucker punched a kid in the back of the head? Good job.What scares me is that you're like 10 years old.-.- im not that freaking youngYou were a couple years ago.It's not racist if its true.Hmm... I wonder how one goes about throwing someone out a window in a mystic fashion :-k The mental image for that is freaking awesome.[/hide]- I dont need to "get a life." I'm a gamer - I have LOTS of lives!
October 21, 200817 yr i so wanted to just reply to this topic with "i have a box of trojans" but alas, i shall post something that might be kinda useful. as urbestfriend stated, hijack this should still run, i ran it on this computer when i had XP antivirus 2008, so a log would be helpful from that. and do you have anything like spybot search and destroy or adaware that might still run? [hide=WOO TEXT! updated Jan 19, 2009 (last quote)] And Evil you mad bastard. You are definately bringing TET back up to it's glory. No doubt about it. Keep it going champ.24,485th to 99 defence on 7-23-08I always forget you're 20 too. I always think you're 25 or something. o.oYa think that I'm insane, Its not sane... its not saneobligitory devart link: http://evil-mumm-ra.deviantart.com/Pogonophobia is the fear of beards.She isn't naked so it's legal.I'm a porn star.[/hide]
October 21, 200817 yr Formating your hard drive is a last resort here, and should fix your problem, as well as deleat anything on it. I don't have allot of suggestions for you, but here is something you can try, if you can get on the internet: http://onecare.live.com/site/en-US/cent ... mscom_msrt Clan Moderator from December 15th 2006- August 20th 2007Founder of: Terran Gamers, formerly known as Militos Deci
October 22, 200817 yr Author Is it normal, to have these wingding type symbols in your startup type in config? danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 24, 200817 yr Author Now I've cleared myself of the Trojans, I still have VIRUS ALERT! in my system tray. Anyone know what this is? What should I do? Is it Malware or Spyware? Also, the all programs list wont open, and task manager won't open either, my computer is being really slow. What should I do to get rid of whatever it is? danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 24, 200817 yr Looks to me like you have either antivirusXP2008 or winantispyware 2009 (did I get the names right?), which are both very hard to get rid of, rogue antiviruses. I'll firstly say that you can first try to do scans with Spybot S&D and Ad-Aware, if you're able to get them on your computer that is. Also, you might want to post a Hijackthis log for us to make sure. I'll now let the way to more tech savvy people than me. One thing you can do as last resort though, would be reinstalling, and I think that if you would've already done it, you would already be out of this problem.
October 24, 200817 yr Author I would reformat, but I lost my OS disk. I've got adaware, and' I'll try to post a HJT log, even though I don't really understand it. danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 24, 200817 yr You don't need to understand it, that's what we're here for. Just run the program, save a log file, and post the contents of that log file here (in hide tags please). HJT is a diagnostic tool to help determine what the infection is, and if you've ran scans, what may have been left over. It is a powerful tool though, so please just save the log file, and don't try to remove things with it. That can lead to disastrous consequences. [hide=Funny Quotes]So you sucker punched a kid in the back of the head? Good job.What scares me is that you're like 10 years old.-.- im not that freaking youngYou were a couple years ago.It's not racist if its true.Hmm... I wonder how one goes about throwing someone out a window in a mystic fashion :-k The mental image for that is freaking awesome.[/hide]- I dont need to "get a life." I'm a gamer - I have LOTS of lives!
October 25, 200817 yr Author Heres a log. [hide=]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:27: VIRUS ALERT!, on 25/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss[Caution: Executable File] C:\WINDOWS\system32\winlogon[Caution: Executable File] C:\WINDOWS\system32\services[Caution: Executable File] C:\WINDOWS\system32\lsass[Caution: Executable File] C:\WINDOWS\system32\svchost[Caution: Executable File] C:\WINDOWS\System32\svchost[Caution: Executable File] C:\WINDOWS\system32\svchost[Caution: Executable File] C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: Executable File] C:\WINDOWS\system32\spoolsv[Caution: Executable File] c:\program files\common files\logishrd\lvmvfm\LVPrcSrv[Caution: Executable File] C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched[Caution: Executable File] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard[Caution: Executable File] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService[Caution: Executable File] C:\WINDOWS\system32\CTsvcCDA[Caution: Executable File] C:\Program Files\Common Files\LightScribe\LSSrvc[Caution: Executable File] C:\Program Files\Analog Devices\SoundMAX\SMAgent[Caution: Executable File] C:\WINDOWS\system32\svchost[Caution: Executable File] C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: Executable File] C:\WINDOWS\Explorer[Caution: Executable File] C:\WINDOWS\system32\wscntfy[Caution: Executable File] C:\WINDOWS\system32\ctfmon[Caution: Executable File] C:\WINDOWS\system32\igfxtray[Caution: Executable File] C:\WINDOWS\system32\hkcmd[Caution: Executable File] C:\WINDOWS\System32\svchost[Caution: Executable File] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP[Caution: Executable File] C:\Program Files\Apoint2K\Apoint[Caution: Executable File] C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: Executable File] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant[Caution: Executable File] C:\Program Files\Hp\HP Software Update\HPWuSchd2[Caution: Executable File] C:\Program Files\HPQ\Quick Launch Buttons\EabServr[Caution: Executable File] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper[Caution: Executable File] C:\Program Files\Apoint2K\Apntex[Caution: Executable File] C:\Program Files\Logitech\QuickCam10\QuickCam10[Caution: Executable File] C:\Program Files\iTunes\iTunesHelper[Caution: Executable File] C:\WINDOWS\AGRSMMSG[Caution: Executable File] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt[Caution: Executable File] C:\Program Files\MSN Messenger\MsnMsgr[Caution: Executable File] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier[Caution: Executable File] C:\Program Files\HPQ\SHARED\HPQWMI[Caution: Executable File] C:\Program Files\iPod\bin\iPodService[Caution: Executable File] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem[Caution: Executable File] C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX[Caution: Executable File] C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager[Caution: Executable File] C:\Program Files\Trend Micro\HijackThis\HijackThis[Caution: Executable File] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost; R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit[Caution: Executable File] O1 - Hosts: 200.124.131.116 casinocontroller.com O1 - Hosts: 200.124.131.116 casinocontroller.com O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: rosqxvmn - {BD60E499-C107-4500-B34C-4BA089A6EEC3} - C:\WINDOWS\rosqxvmn.dll O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray[Caution: Executable File] O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd[Caution: Executable File] O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP[Caution: Executable File] O4 - HKLM\..\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4[Caution: Executable File] /tray O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint[Caution: Executable File] O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: Executable File]" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant[Caution: Executable File] O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2[Caution: Executable File] O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher[Caution: Executable File] O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: Executable File]" O4 - HKLM\..\Run: [iS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz[Caution: Executable File] /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [urlLSTCK[Caution: Executable File]] C:\Program Files\Norton Internet Security\UrlLstCk[Caution: Executable File] O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr[Caution: Executable File] /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset[Caution: Executable File] O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper[Caution: Executable File]" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10[Caution: Executable File]" /hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: Executable File]" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: Executable File]" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG[Caution: Executable File] O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt[Caution: Executable File]" /min O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: Executable File]" /background O4 - HKCU\..\Run: [ctfmon[Caution: Executable File]] C:\WINDOWS\system32\ctfmon[Caution: Executable File] O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier[Caution: Executable File] O4 - HKCU\..\Run: [smart Antivirus-2009[Caution: Executable File]] C:\Program Files\Smart Antivirus 2009\Smart Antivirus-2009[Caution: Executable File] O4 - HKCU\..\Run: [srvuimon] C:\WINDOWS\system32\zyvmtgzc[Caution: Executable File] O4 - HKLM\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: Executable File] O4 - HKCU\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: Executable File] O4 - HKUS\S-1-5-18\..\Run: [CTFMON[Caution: Executable File]] C:\WINDOWS\system32\CTFMON[Caution: Executable File] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON[Caution: Executable File]] C:\WINDOWS\system32\CTFMON[Caution: Executable File] (User 'Default user') O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem[Caution: Executable File] O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA[Caution: Executable File] O4 - Global Startup: NkvMon[Caution: Executable File].lnk = C:\Program Files\Nikon\NkView6\NkvMon[Caution: Executable File] O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm011YYGB O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?88f3a98184a046d4939a3b342278ea87 O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?88f3a98184a046d4939a3b342278ea87 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: Executable File] O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: Executable File] O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: Executable File] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: Executable File] O9 - Extra button: Aspinalls Online Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\aspinallsMPP\MPPoker[Caution: Executable File] (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve ... lisher.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak[Caution: Executable File].imgfarm.com/images/nocach ... .0.1.0.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-U ... E_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register ... lashax.cab O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.xfactorchallenge.co.uk/playe ... IEHDSD.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ ... /CTPID.cab O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.gameassists.co.uk/fre ... ashAX2.cab O20 - AppInit_DLLs: uqykml.dll O21 - SSODL: ngwstxfd - {12A86329-12B5-4A74-9A0D-4CA777C807CC} - C:\WINDOWS\ngwstxfd.dll (file missing) O21 - SSODL: qrbgltos - {36B256FE-032A-4390-A6AC-7719A639D188} - C:\WINDOWS\qrbgltos.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: Executable File] O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched[Caution: Executable File] O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard[Caution: Executable File] O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService[Caution: Executable File] O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: Executable File] (file missing) O23 - Service: Symantec Network Proxy (ccProxy) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccProxy[Caution: Executable File] (file missing) O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc[Caution: Executable File] (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: Executable File] (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA[Caution: Executable File] O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService[Caution: Executable File] O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI[Caution: Executable File] O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService[Caution: Executable File] O23 - Service: IS Service (ISSVC) - Unknown owner - C:\Program Files\Norton Internet Security\ISSVC[Caution: Executable File] (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc[Caution: Executable File] O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv[Caution: Executable File] O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch[Caution: Executable File] O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc[Caution: Executable File] (file missing) O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan[Caution: Executable File] (file missing) O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution: Executable File] (file missing) O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution: Executable File] (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent[Caution: Executable File] O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc[Caution: Executable File] (file missing) O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: Executable File] -- End of file - 14226 bytes[/hide] danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 25, 200817 yr Don't count on me for this, since I'm not too savvy for the HJT logs, but here are the lines I think should be fixed (I strongly suggest you wait for someone to confirm) [hide=]R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2 O1 - Hosts: 200.124.131.116 casinocontroller.com O1 - Hosts: 200.124.131.116 casinocontroller.com O4 - HKLM\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: Executable File] O4 - HKCU\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: Executable File] O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm011YYGB O9 - Extra button: Aspinalls Online Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\aspinallsMPP\MPPoker[Caution: Executable File] (file missing) (HKCU) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak[Caution: Executable File].imgfarm.com/images/nocach ... .0.1.0.cab[/hide] As I said, wait for someone to confirm the lines. Some of those I mentionned are not really a danger, but things that can be removed since they're not used. Also, I would avise you to remove Norton and get a good antivirus when your problems are solved, Norton is garbage, and I would suggest either Avira or NOD32.
October 25, 200817 yr Author Ok. I'll wait for someone. But the thing is, the start menu is missing the all programs button, and log off. You got a solution to this? Thanks by the way. danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 25, 200817 yr Don't count on me for this, since I'm not too savvy for the HJT logs, but here are the lines I think should be fixed (I strongly suggest you wait for someone to confirm) [hide=]R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2 O1 - Hosts: 200.124.131.116 casinocontroller.com O1 - Hosts: 200.124.131.116 casinocontroller.com O4 - HKLM\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: Executable File] O4 - HKCU\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: Executable File] O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm011YYGB O9 - Extra button: Aspinalls Online Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\aspinallsMPP\MPPoker[Caution: Executable File] (file missing) (HKCU) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak[Caution: Executable File].imgfarm.com/images/nocach ... .0.1.0.cab[/hide] As I said, wait for someone to confirm the lines. Some of those I mentionned are not really a danger, but things that can be removed since they're not used. Also, I would advise you to remove Norton and get a good antivirus when your problems are solved, Norton is garbage, and I would suggest either Avira or NOD32. Yes, you need to change those lines. The first one, about the home page, is a malware site that has drive-by downloads of rogue antivirus programs. You need to get rid of the hosts file entries to. Go to start > run > regedit. See if you can open it, if not, we have some work to do, because that's a pretty serious issue. Also, the last line, imgfarm.com, has stealth installs of SmileyCentral and other bits of malware. Have you been playing online poker recently? Because many of those sites can't be trusted. Because of the multiple poker-related entries in that HJT, you seems to have gotten infected by visiting one of those bad sites. It seems a bit like a Vundo variant to me, but I'm not sure. You should use that DieNortonDie thing from Clare, to get rid of those other pieces that Norton left over, since you're using Avira now. I would suggest you download Comodo as well, to hopefully stop any remote connections. If you do download it, make sure you read every popup carefully. It's important you don't just click "allow" on everything, as that defeats the purpose of a firewall. As far as the missing programs thing - read this. [hide=Funny Quotes]So you sucker punched a kid in the back of the head? Good job.What scares me is that you're like 10 years old.-.- im not that freaking youngYou were a couple years ago.It's not racist if its true.Hmm... I wonder how one goes about throwing someone out a window in a mystic fashion :-k The mental image for that is freaking awesome.[/hide]- I dont need to "get a life." I'm a gamer - I have LOTS of lives!
October 25, 200817 yr Author I haven't been playing poker, I share this computer. I can open regedit. And for that all programs issue - I don't have vista, so no default settings for me. - Thanks. So I just scan again and check those and fix right? I'll be sure to download that too. danke Schon Sam!^^"Blood runs thicker, oh were thick as thieves you know"-Carl Barât
October 25, 200817 yr I haven't been playing poker, I share this computer. I can open regedit. And for that all programs issue - I don't have vista, so no default settings for me. - Thanks. So I just scan again and check those and fix right? I'll be sure to download that too. Nooo...no fix. Not yet. I don't want you to go through and delete something that could be crucial later on. Just wait for Clare or sloter to stop by, they will know what to do. You should, however, jump-tackle the person(s) you share the computer with. One of them has downloaded a bunch of stuff on your computer, including poker, and that's probably the cause of your problems. If you have any logs (Firewall, AV, etc), go through those and see if anything has been added recently, like in the last week or two. [hide=Funny Quotes]So you sucker punched a kid in the back of the head? Good job.What scares me is that you're like 10 years old.-.- im not that freaking youngYou were a couple years ago.It's not racist if its true.Hmm... I wonder how one goes about throwing someone out a window in a mystic fashion :-k The mental image for that is freaking awesome.[/hide]- I dont need to "get a life." I'm a gamer - I have LOTS of lives!
October 25, 200817 yr Heres a log. [hide=]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:27: VIRUS ALERT!, on 25/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] c:\program files\common files\logishrd\lvmvfm\LVPrcSrv[Caution: ExecutableFile] C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched[Caution: ExecutableFile] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard[Caution: ExecutableFile] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService[Caution: ExecutableFile] C:\WINDOWS\system32\CTsvcCDA[Caution: ExecutableFile] C:\Program Files\Common Files\LightScribe\LSSrvc[Caution: ExecutableFile] C:\Program Files\Analog Devices\SoundMAX\SMAgent[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\WINDOWS\system32\wscntfy[Caution: ExecutableFile] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile] C:\WINDOWS\system32\igfxtray[Caution: ExecutableFile] C:\WINDOWS\system32\hkcmd[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP[Caution: ExecutableFile] C:\Program Files\Apoint2K\Apoint[Caution: ExecutableFile] C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: ExecutableFile] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant[Caution: ExecutableFile] C:\Program Files\Hp\HP Software Update\HPWuSchd2[Caution: ExecutableFile] C:\Program Files\HPQ\Quick Launch Buttons\EabServr[Caution: ExecutableFile] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper[Caution: ExecutableFile] C:\Program Files\Apoint2K\Apntex[Caution: ExecutableFile] C:\Program Files\Logitech\QuickCam10\QuickCam10[Caution: ExecutableFile] C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile] C:\WINDOWS\AGRSMMSG[Caution: ExecutableFile] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt[Caution: ExecutableFile] C:\Program Files\MSN Messenger\MsnMsgr[Caution: ExecutableFile] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier[Caution: ExecutableFile] C:\Program Files\HPQ\SHARED\HPQWMI[Caution: ExecutableFile] C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem[Caution: ExecutableFile] C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX[Caution: ExecutableFile] C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager[Caution: ExecutableFile] C:\Program Files\Trend Micro\HijackThis\HijackThis[Caution: ExecutableFile] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost; R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit[Caution: ExecutableFile] O1 - Hosts: 200.124.131.116 casinocontroller.com O1 - Hosts: 200.124.131.116 casinocontroller.com O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: rosqxvmn - {BD60E499-C107-4500-B34C-4BA089A6EEC3} - C:\WINDOWS\rosqxvmn.dll O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray[Caution: ExecutableFile] O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd[Caution: ExecutableFile] O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP[Caution: ExecutableFile] O4 - HKLM\..\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4[Caution: ExecutableFile] /tray O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint[Caution: ExecutableFile] O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched[Caution: ExecutableFile]" O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant[Caution: ExecutableFile] O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2[Caution: ExecutableFile] O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher[Caution: ExecutableFile] O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]" O4 - HKLM\..\Run: [iS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz[Caution: ExecutableFile] /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [urlLSTCK[Caution: ExecutableFile]] C:\Program Files\Norton Internet Security\UrlLstCk[Caution: ExecutableFile] O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr[Caution: ExecutableFile] /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset[Caution: ExecutableFile] O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper[Caution: ExecutableFile]" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10[Caution: ExecutableFile]" /hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG[Caution: ExecutableFile] O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt[Caution: ExecutableFile]" /min O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: ExecutableFile]" /background O4 - HKCU\..\Run: [ctfmon[Caution: ExecutableFile]] C:\WINDOWS\system32\ctfmon[Caution: ExecutableFile] O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier[Caution: ExecutableFile] O4 - HKCU\..\Run: [smart Antivirus-2009[Caution: ExecutableFile]] C:\Program Files\Smart Antivirus 2009\Smart Antivirus-2009[Caution: ExecutableFile] O4 - HKCU\..\Run: [srvuimon] C:\WINDOWS\system32\zyvmtgzc[Caution: ExecutableFile] O4 - HKLM\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: ExecutableFile] O4 - HKCU\..\Policies\Explorer\Run: [xvGm6FmCTZ] C:\Documents and Settings\All Users\Application Data\jejinqjc\jihkhans[Caution: ExecutableFile] O4 - HKUS\S-1-5-18\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\CTFMON[Caution: ExecutableFile] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON[Caution: ExecutableFile]] C:\WINDOWS\system32\CTFMON[Caution: ExecutableFile] (User 'Default user') O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem[Caution: ExecutableFile] O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA[Caution: ExecutableFile] O4 - Global Startup: NkvMon[Caution: ExecutableFile].lnk = C:\Program Files\Nikon\NkView6\NkvMon[Caution: ExecutableFile] O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZKxdm011YYGB O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?88f3a98184a046d4939a3b342278ea87 O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?88f3a98184a046d4939a3b342278ea87 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag[Caution: ExecutableFile] O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] O9 - Extra button: Aspinalls Online Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\aspinallsMPP\MPPoker[Caution: ExecutableFile] (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak[Caution: ExecutableFile].imgfarm.com/images/nocache/funwebproducts/ei-3/WebfettiInitialSetup1.0.1.0.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.xfactorchallenge.co.uk/playerBase/kSoloIEHDSD.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15033/CTPID.cab O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.gameassists.co.uk/freeplay/FlashAX2.cab O20 - AppInit_DLLs: uqykml.dll O21 - SSODL: ngwstxfd - {12A86329-12B5-4A74-9A0D-4CA777C807CC} - C:\WINDOWS\ngwstxfd.dll (file missing) O21 - SSODL: qrbgltos - {36B256FE-032A-4390-A6AC-7719A639D188} - C:\WINDOWS\qrbgltos.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice[Caution: ExecutableFile] O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched[Caution: ExecutableFile] O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard[Caution: ExecutableFile] O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService[Caution: ExecutableFile] O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile] (file missing) O23 - Service: Symantec Network Proxy (ccProxy) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccProxy[Caution: ExecutableFile] (file missing) O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc[Caution: ExecutableFile] (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile] (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA[Caution: ExecutableFile] O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService[Caution: ExecutableFile] O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI[Caution: ExecutableFile] O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile] O23 - Service: IS Service (ISSVC) - Unknown owner - C:\Program Files\Norton Internet Security\ISSVC[Caution: ExecutableFile] (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc[Caution: ExecutableFile] O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv[Caution: ExecutableFile] O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch[Caution: ExecutableFile] O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc[Caution: ExecutableFile] (file missing) O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan[Caution: ExecutableFile] (file missing) O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution: ExecutableFile] (file missing) O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution: ExecutableFile] (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent[Caution: ExecutableFile] O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc[Caution: ExecutableFile] (file missing) O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile] -- End of file - 14226 bytes[/hide] Hi there... In my quote of your text, I've located and bolded the primary one from what appears to be that nasty viral product, as well as other critical problem items that must be destroyed. It is quite likely that a number of those others (which other people have marked) apply in addition to the ones I've marked. Now, while I'm probably dead-on for anything I've marked, I'd wait for one last person to come through and confirm all that has been marked for killing so far by the rest of us. Better safe, than stuck in a bad situation later. :geek: ~D. V. "The author of that viral malware needs to die." Devnull [OT: Clare, where the [bleep] have you gone off to?!?!?] and normally with a cool mind.(Warning: This user can be VERY confusing to some people... And talks in 3rd person for the timebeing due to how insane they are... Sometimes even to themself.)
October 26, 200817 yr Damn you seem to be right, smart-antivirus2009 has a name like some very nasty viruses(rogue antiviruses).
October 26, 200817 yr Damn you seem to be right, smart-antivirus2009 has a name like some very nasty viruses(rogue antiviruses). I'll admit, I stopped to research that before I locked onto it. If I had stopped to research a few more, I might have highlighted them also, based on whether or not I found anything suspicious. :anxious: ... Sure is hard, though, to pin all the bad ones down. :| ~Mr. D. V. "Yes, I was just doing a quick browse..." Devnull and normally with a cool mind.(Warning: This user can be VERY confusing to some people... And talks in 3rd person for the timebeing due to how insane they are... Sometimes even to themself.)
October 26, 200817 yr I'll admit, I stopped to research that before I locked onto it. If I had stopped to research a few more, I might have highlighted them also, based on whether or not I found anything suspicious. O20 - AppInit_DLLs: uqykml.dll This Registry value located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows loads a DLL into memory when the user logs in, after which it stays in memory until logoff. Very few legitimate programs use it (Norton CleanSweep uses APITRAP.DLL), most often it is used by trojans or agressive browser hijackers.
October 26, 200817 yr Yeah, I certainly hope you can get it resolved. Looks like those are BAD viruses. I think the newest highlights are right. Thoroughly retired, may still write now and again
Create an account or sign in to comment