Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2  All   Go Down

Author Topic: Major computer problems, spyware, trojans the works  (Read 7092 times)

0 Members and 1 Guest are viewing this topic.

shadowstar

  • Guest
Major computer problems, spyware, trojans the works
« on: April 22, 2007, 06:07:25 PM »
Windows XP Sp2

Problems:  avg has caught 3 trojans and has put them in its vault they are

Trojan Horde Download.Generic3.QL: their are 2 of these, 1 is with the update files, and 1 has to do with restore
Trojan Horse Generic2.VOI
Trojan Horse Generic2.VOG
   
on top of that, it takes forever looading, I get this message that says

Personalized settings SVCH this never happend until last night, sometimes my taskbar locks up, and if i click on icon the property window opens up, this happens randomly, I got Hijack this and the Panda scan file saved so tell me when you need me to post it please help asap ty.

this all happend last night, I was trying to add an add-on for worldofwarcraft and the trojans popped up.
Logged

unlovedwarrior



    Guru

  • someday this name will be known
    • Thanked: 13
    Re: Major computer problems, spyware, trojans the works
    « Reply #1 on: April 22, 2007, 09:54:28 PM »
    go google

    avg antispyware

    spybot search and destroy

    hijackthis


    update very thing turn system restore off

    reboot into safe mode tapping f8 rapidly before windows loads

    do all of the scans

    post a hijack log for us to look at it will take more than one post

    and tell us how your computer is running


    unlovedwarrior
    Logged

    oddjob



      Hopeful

      Thanked: 4
      • Experience: Beginner
      • OS: Windows 7
      Re: Major computer problems, spyware, trojans the works
      « Reply #2 on: April 23, 2007, 04:18:22 AM »
      While you're at it, shadowstar, download/install and scan with Trojanhunter 4 from here ....

      http://www.misec.net/


      Let it fix what it want to fix.

      Report back asap.


      OJ
      Logged

      phoenix910



        Hopeful

        Thanked: 2
        Re: Major computer problems, spyware, trojans the works
        « Reply #3 on: April 24, 2007, 01:39:03 AM »
        And I'd say download Ad-Aware as well and scan with that.
        Logged

        shadowstar

        • Guest
        Re: Major computer problems, spyware, trojans the works
        « Reply #4 on: April 24, 2007, 01:46:07 AM »
        First of thank you all for replying now let me begin by telling you all what I have done

        Ad-aware scan
        spybot-scan
        Panda anti-virue scan
        avg-spyware scan
        avg-anti-virus scan

        from the looks of it the trojans are gone and so is the majority of the spyware but panda online scan still finds 20 items which it cant disinfect, so here is my hijack this log
        Logged

        shadowstar

        • Guest
        Re: Major computer problems, spyware, trojans the works
        « Reply #5 on: April 24, 2007, 01:46:33 AM »
        Logfile of HijackThis v1.99.1
        Scan saved at 12:45:46 AM, on 4/24/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\SYSTEM32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\SOUNDMAN.EXE
        C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
        C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe
        C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
        C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
        C:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE
        C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
        C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\TrojanHunter 4.6\THGuard.exe
        C:\cleanup tool\HijackThis.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
        R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [msnsyslog] C:\WINDOWS\msnlogm.exe
        O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Labtec\Desktop\V5.1\moffice.exe
        O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe
        O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
        O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
        O4 - HKLM\..\Run: [Secure] C:\WINDOWS\WindowsUpdates.exe
        O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
        O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\MAJIDA~1.001\LOCALS~1\Temp\{795731A9-0EF3-477D-8F0E-6C9C5439F436}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0009"
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
        O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.6\THGuard.exe"
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
        O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
        O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
        O4 - HKCU\..\Run: [PVR] C:\Program Files\XemiComputers\Pocket Voice Recorder\PVR.exe
        O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170739567046
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
        O16 - DPF: {C946EF6D-296D-4907-A6E1-ED0E8E5AF024} (LycosMail Upload Control) - http://mail.lycos.com/hanmail-ax/AttachMail.cab
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

        Logged

        oddjob



          Hopeful

          Thanked: 4
          • Experience: Beginner
          • OS: Windows 7
          Re: Major computer problems, spyware, trojans the works
          « Reply #6 on: April 24, 2007, 03:37:14 AM »
          Hello Shadowstar

          I suggest you print this out to help you follow my advice.

          Open HJT again ... click on scan and do the following ....

          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080 >> put a tick/check mark next to this entry IF it's still present and IF you didn't add it yourself or don't know what it is.

          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) >> put a tick/check mark next to this entry IF it's still present.

          O4 - HKLM\..\Run: [Secure] C:\WINDOWS\WindowsUpdates.exe>> put a tick/check mark next to this entry IF it's still present.

          Remember to close all open windows - including this one - before clicking on "Fix Checked" at the foot of the HJT window.

          **************

          This one ....

          O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\MAJIDA~1.001\LOCALS~1\Temp\{795731A9-0EF3-477D-8F0E-6C9C5439F436}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0009"

          ....is a little unusual. It may be required for access to Tango broadband.  Is this something you use or know about? Is it necessary?

          In my heart of hearts I doubt it's wanted but don't fix it with HJT at the moment.

          Just give me any information you can about it, if anything.

          **************

          You should run first Ccleaner to clean out your system. Get Ccleaner here but ensure you install it WITHOUT the optional Yahoo Toolbar download (you must untick/uncheck the relevant box on download) …

          http://www.ccleaner.com/

          run Ccleaner and let it clean out your computer with the default settings.

          **************

          Please also run a fresh scan with Panda Activescan and remember to save the scan report.

          **************

          In your next post please include ....


          A fresh HJT log

          The PAS scan report

          An update on how the computer is working now.



          OJ






          Logged

          shadowstar

          • Guest
          Re: Major computer problems, spyware, trojans the works
          « Reply #7 on: April 24, 2007, 06:05:57 PM »
          HJT FRESH LOG

          Logfile of HijackThis v1.99.1
          Scan saved at 5:05:24 PM, on 4/24/2007
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\SYSTEM32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\SOUNDMAN.EXE
          C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
          C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe
          C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
          C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
          C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
          C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
          C:\Program Files\TrojanHunter 4.6\THGuard.exe
          C:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE
          C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
          C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\cleanup tool\HijackThis.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
          R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [msnsyslog] C:\WINDOWS\msnlogm.exe
          O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Labtec\Desktop\V5.1\moffice.exe
          O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe
          O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
          O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
          O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
          O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\MAJIDA~1.001\LOCALS~1\Temp\{795731A9-0EF3-477D-8F0E-6C9C5439F436}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0009"
          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
          O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
          O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.6\THGuard.exe"
          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
          O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
          O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
          O4 - HKCU\..\Run: [PVR] C:\Program Files\XemiComputers\Pocket Voice Recorder\PVR.exe
          O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170739567046
          O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
          O16 - DPF: {C946EF6D-296D-4907-A6E1-ED0E8E5AF024} (LycosMail Upload Control) - http://mail.lycos.com/hanmail-ax/AttachMail.cab
          O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
          O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

          Logged

          shadowstar

          • Guest
          Re: Major computer problems, spyware, trojans the works
          « Reply #8 on: April 24, 2007, 06:06:45 PM »
          PANDA ACTIVE SCAN LOG

          Incident                                                                        Status                        Location                                                                                                                                                                                                                                                       

          Spyware:Cookie/Advertising                                                      Not disinfected               C:\Documents and Settings\Administrator.ABDUL\Application Data\Mozilla\Firefox\Profiles\rer46g5r.default\cookies.txt[.advertising.com/]                                                                                                                         
          Spyware:Cookie/Mediaplex                                                        Not disinfected               C:\Documents and Settings\Administrator.ABDUL\Application Data\Mozilla\Firefox\Profiles\rer46g5r.default\cookies.txt[.mediaplex.com/]                                                                                                                           
          Spyware:Cookie/Doubleclick                                                      Not disinfected               C:\Documents and Settings\Administrator.ABDUL\Application Data\Mozilla\Firefox\Profiles\rer46g5r.default\cookies.txt[.doubleclick.net/]                                                                                                                         
          Spyware:Cookie/Atlas DMT                                                        Not disinfected               C:\Documents and Settings\Administrator.ABDUL\Application Data\Mozilla\Firefox\Profiles\rer46g5r.default\cookies.txt[.atdmt.com/]                                                                                                                               
          Spyware:Cookie/YieldManager                                                     Not disinfected               C:\Documents and Settings\Administrator.ABDUL\Application Data\Mozilla\Firefox\Profiles\rer46g5r.default\cookies.txt[ad.yieldmanager.com/]                                                                                                                     
          Spyware:Cookie/Traffic Marketplace                                              Not disinfected               C:\Documents and Settings\Administrator.ABDUL\Application Data\Mozilla\Firefox\Profiles\rer46g5r.default\cookies.txt[.trafficmp.com/]                                                                                                                           
          Logged

          shadowstar

          • Guest
          Re: Major computer problems, spyware, trojans the works
          « Reply #9 on: April 24, 2007, 06:07:56 PM »
          Compuer is working alot better, that Tango thing you brought up I have no idea what it is, never installed anything named tango on my comp.
          Logged

          oddjob



            Hopeful

            Thanked: 4
            • Experience: Beginner
            • OS: Windows 7
            Re: Major computer problems, spyware, trojans the works
            « Reply #10 on: April 25, 2007, 03:04:47 AM »
            Looking good. ;D Apart from that "Tango" 04 entry the log is free of malware.

            As we neither of us know what it is we'll kill it off.

            Open HJT, click on scan and fix this one the same way you did before IF it's still present.....

            [O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\MAJIDA~1.001\LOCALS~1\Temp\{795731A9-0EF3-477D-8F0E-6C9C5439F436}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0009"

            ***************

            Download, install & clean your system out with Spybot S&D from here ....

            http://www.safer-networking.org/en/download/index.html

            That should get rid of the PAS left over cookies.

            [Note >> when scanned and cleaned out you should set up Spybot's "Resident Teatimer" real time protection tool]

            ***************

            Update AVG AS to the latest definitions ands have it scan your system again. Hopefully the resulting log will be cleaner now.

            ***************

            You should keep the programs updated and scan your computer with them all from time to time (AVG AS, Ccleaner, Spybot & PAS). Trojanhunter will be useful while it lasts but it has no "free" version it it will expire in due course.

            ***************

            Now you are clean you might want to read these and bookmark the links for future reference.


            If you are certain you have no more trouble you should clear out all old System Restore points then immediately create a new one so you have something to fall back on should anything go awry again. Also remember to make SR points on a regular basis.

            More on System Restore ...

            http://www.microsoft.com/windowsxp/using/helpandsupport/getstarted/ballew_03may19.mspx


            What may have lead up to your infection and help keep your computer free of malware …

            http://www.castlecops.com/t7736-So_how_did_I_get_infected_in_the_first_place.html

            http://www.help2go.com/Tutorials/Protect_Your_PC/Avoid_Web_Browser_Hijackers.html

            There is a little duplication but these tutorials are both well worth reading.


            Also run through this before posting another HijackThis log …

            http://www.help2go.com/Tutorials/Protect_Your_PC/Get_Rid_of_Spyware%2C_Adware%2C_and_Web_Browser_Hijackers.html


            Best wishes.



            OJ
            Logged

            shadowstar

            • Guest
            Re: Major computer problems, spyware, trojans the works
            « Reply #11 on: April 25, 2007, 03:46:19 AM »
            Woot, Oddjob thanks alot man, systems back to normal which is the way I likes it lol,
            Logged

            oddjob



              Hopeful

              Thanked: 4
              • Experience: Beginner
              • OS: Windows 7
              Re: Major computer problems, spyware, trojans the works
              « Reply #12 on: April 25, 2007, 01:39:36 PM »
              Glad we could help.

              Stay safe (don't forget to read those articles in my last post). ;)


              OJ
              Logged

              GX1_Man

              • Guest
              Re: Major computer problems, spyware, trojans the works
              « Reply #13 on: April 25, 2007, 03:14:11 PM »
              And those are good articles, especially for the unitiated, but worth a read by everyone. I may put some links in the FAQ section.

              Kudos to Oddjob.
              Logged

              tracypatzold

              • Guest
              Re: Major computer problems, spyware, trojans the works
              « Reply #14 on: April 26, 2007, 06:42:47 PM »
              i actually want to know what u guys think is the best antivirus and spyware cleaners? I dont care if they are free or if they cost money. How about good registry cleaners? A good firewall? Thanks alot guys ;D
              Logged
              Pages: [1] 2  All   Go Up
              « previous next »