Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2 3 ... 6  All   Go Down

Author Topic: Registry....  (Read 37984 times)

0 Members and 1 Guest are viewing this topic.

tina1rules

    Topic Starter


    Intermediate

    Thanked: 2
    Registry....
    « on: August 07, 2008, 01:21:54 AM »
    Okay so I truly believe after following many many steps countless times that something is in my registry(I think i have some half installed software in there actually). AVG found a restry error and I was researching it moving along nicely. So I wondered about a program designed for that,on your sites suggestions there was 3 links I chose the Glary Utility. I ran the restry cleaner and the results are 622! 622? really.
    I haven't cleaned anything or fix'd anything. So what do you think I should do now? seriously I am like wow.
    Logged

    evilfantasy

    • Malware Removal Specialist
    • Moderator


      • Genius
    • Calm like a bomb
      • Thanked: 493
    • Experience: Experienced
    • OS: Windows 11
    Re: Registry....
    « Reply #1 on: August 07, 2008, 01:24:09 AM »
    Registry tools are dangerous, and that's an understatement.

    What is it you are actually trying to do?
    Logged

    tina1rules

      Topic Starter


      Intermediate

      Thanked: 2
      Re: Registry....
      « Reply #2 on: August 07, 2008, 01:30:39 AM »
      Its a long story. But I think I have a restry key left in there from an old virus. On top of that I was removing some programs one day and I think I half installed or something.
      My computer can not be pinged as if I have a firewall up which I do not.

      So i was trying to see if I had traces of Norton or Comondo or something left in there blocking things.

      And it is saying I have over 600 restry errors,it doesn't sound right to me.

      Logged

      evilfantasy

      • Malware Removal Specialist
      • Moderator


        • Genius
      • Calm like a bomb
        • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: Registry....
      « Reply #3 on: August 07, 2008, 01:36:52 AM »
      Quote from: tina1rules on August 07, 2008, 01:30:39 AM

      And it is saying I have over 600 restry errors,it doesn't sound right to me.

      Glary Utilities is good software but in my opinion way too aggressive in what it removes. Too many times I have see where it was ran, all items fixed, then the computer wouldn't boot to Windows. You should uninstall it.

      Can you do a System Restore to before this problem with pinging started happening and then let me suggest some better ways of dealing with the virus, and uninstalling whatever it is you need uninstalled?
      Logged

      tina1rules

        Topic Starter


        Intermediate

        Thanked: 2
        Re: Registry....
        « Reply #4 on: August 07, 2008, 01:45:16 AM »
        Restore won't go back that far. I had systen restore off then or something. Its been awhile. I am a persistant person. I try and figure it out for awhile then stop. I usually get re-install windows as a reply but I find it more intertaining to figure it out. So I would say I am ready for your suggestions.
        Logged

        evilfantasy

        • Malware Removal Specialist
        • Moderator


          • Genius
        • Calm like a bomb
          • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11
        Re: Registry....
        « Reply #5 on: August 07, 2008, 01:50:12 AM »
        Can you access the Internet or are you unable to connect on the PC?
        Logged

        tina1rules

          Topic Starter


          Intermediate

          Thanked: 2
          Re: Registry....
          « Reply #6 on: August 07, 2008, 10:05:17 AM »
          That to me is the hilarious part. I can connect to the internet I can surf all that. I can't do things like play WoW if I wanted to(which I don't) or Poker Stars.I get cannot connect to server.  So this also means my AVG or super anti-spy can't get updates. Also I have Internet Explorer,XP sp2,so when I click tols and diagnose problems,it basically tells me I am not connected to the internet,that i can use another computer to go to microsoft . com  ::)


          I have ran firewall testers and it tells me its working 100%,but my wndows one is OFF,and I have uninstalled other programs that I thought had firewalls. This computer had Norten on it and Mcafee at one point.

          During another whats wrong with my computer mission I had Comondoand AVAST I have uninstalled it too.

          Also when I go into Safemode I can Play poker stars and I can download updates for AVG ect.,however I can't access yahoo games,specifically Spelldown :(

          So this time when I ran AVG i did get two results and they were registry items.,hence my curiosity as too if my registry is screwd somewhere.

          So I googled those two results one result is telling me to remove a certain registry key,the other seems to be just a sensitive find.

          I am running scans again and will post logs when you want them.
          Logged

          evilfantasy

          • Malware Removal Specialist
          • Moderator


            • Genius
          • Calm like a bomb
            • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: Registry....
          « Reply #7 on: August 07, 2008, 10:07:54 AM »
          Post the logs whenever you are ready.
          Logged

          tina1rules

            Topic Starter


            Intermediate

            Thanked: 2
            Re: Registry....
            « Reply #8 on: August 07, 2008, 11:47:52 AM »
            Still waiting on scans. However I just thought of something I restored my computer once to factory settings,and I did back-up everything. So If I can't figure out this problem I am having,Can I restore the back-up easily.

            still waiting on scans to finish will post logs shortly.

            Logged

            evilfantasy

            • Malware Removal Specialist
            • Moderator


              • Genius
            • Calm like a bomb
              • Thanked: 493
            • Experience: Experienced
            • OS: Windows 11
            Re: Registry....
            « Reply #9 on: August 07, 2008, 11:48:36 AM »
            Yes the backup will work.

            Do you have your install CD?
            Logged

            tina1rules

              Topic Starter


              Intermediate

              Thanked: 2
              Re: Registry....
              « Reply #10 on: August 07, 2008, 12:14:19 PM »
              Yes I do,however if I lose the files on media player I fear I will be yelled at til my head explodes.

              and I have never done uch a pocess with a disk so I am a tad intimidated.

              I have two of the 3 logs the sticky says to post. I can't figure out where the log is on SuperAnti SPY though.
              Logged

              evilfantasy

              • Malware Removal Specialist
              • Moderator


                • Genius
              • Calm like a bomb
                • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: Registry....
              « Reply #11 on: August 07, 2008, 12:16:28 PM »
              Open SAS and click on Preferences.
              Now click the Statistics/Logs tab.
              You will find the log in there.
              Logged

              tina1rules

                Topic Starter


                Intermediate

                Thanked: 2
                Re: Registry....
                « Reply #12 on: August 07, 2008, 12:20:36 PM »
                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 2:09:19 PM, on 8/7/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                C:\WINDOWS\system32\cisvc.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
                C:\WINDOWS\system32\locator.exe
                C:\PROGRA~1\AVG\AVG8\avgrsx.exe
                C:\PROGRA~1\AVG\AVG8\avgemc.exe
                C:\WINDOWS\System32\alg.exe
                C:\WINDOWS\system32\cidaemon.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                C:\WINDOWS\SOUNDMAN.EXE
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
                C:\Program Files\Digital Media Reader\readericon45G.exe
                C:\Program Files\QuickTime\qttask.exe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                C:\Program Files\Messenger\msmsgs.exe
                C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
                C:\Program Files\BigFix\bigfix.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\mspaint.exe
                C:\WINDOWS\system32\drwtsn32.exe
                C:\WINDOWS\system32\drwtsn32.exe
                C:\WINDOWS\system32\taskmgr.exe
                C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
                C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
                C:\PROGRA~1\AVG\AVG8\avgscanx.exe
                C:\Program Files\AVG\AVG8\avgui.exe
                C:\WINDOWS\system32\NOTEPAD.EXE
                C:\WINDOWS\system32\NOTEPAD.EXE
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T3418
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 134.87.141.73:80
                R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
                O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
                O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
                O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
                O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
                O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
                O4 - HKLM\..\Run: [SecurityUpdate] rundll32.exe C:\WINDOWS\system32\sotohuf.dll,TurnOn2
                O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
                O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
                O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe"
                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
                O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
                O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
                O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
                O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
                O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
                O4 - HKCU\..\Run: [PlayNC Launcher] C:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
                O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
                O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
                O4 - Startup: TrueAssistant.lnk = C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe
                O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
                O4 - Global Startup: VersionTrackerPro.lnk = ?
                O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
                O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
                O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
                O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
                O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
                O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
                O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
                O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
                O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                O15 - Trusted Zone: *.att.net
                O15 - Trusted Zone: http://*.att.net
                O15 - Trusted Zone: *.sbcglobal.net
                O15 - Trusted Zone: http://*.sbcglobal.net
                O16 - DPF: ActiveGS.cab - http://www.virtualapple.org/activegs.cab
                O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
                O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1201728035968
                O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/sbc/TrueInstallSBC.exe
                O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
                O20 - AppInit_DLLs: avgrsstx.dll
                O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
                O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
                O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\PROGRA~1\Symantec\isPwdSvc.exe (file missing)
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
                O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

                --



                SUPERAntiSpyware Scan Log
                http://www.superantispyware.com

                Generated 08/07/2008 at 02:06 PM

                Application Version : 3.9.1008

                Core Rules Database Version : 3259
                Trace Rules Database Version: 1270

                Scan type       : Complete Scan
                Total Scan Time : 02:16:57

                Memory items scanned      : 457
                Memory threats detected   : 0
                Registry items scanned    : 5650
                Registry threats detected : 0
                File items scanned        : 56674
                File threats detected     : 4

                Adware.Tracking Cookie
                   C:\Documents and Settings\Owner\Cookies\owner@specificclick[1].txt
                   C:\Documents and Settings\Owner\Cookies\owner@atdmt[1].txt
                   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
                   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt



                Malwarebytes' Anti-Malware 1.11
                Database version: 599

                Scan type: Full Scan (C:\|D:\|)
                Objects scanned: 175324
                Time elapsed: 1 hour(s), 21 minute(s), 58 second(s)

                Memory Processes Infected: 0
                Memory Modules Infected: 0
                Registry Keys Infected: 0
                Registry Values Infected: 0
                Registry Data Items Infected: 0
                Folders Infected: 0
                Files Infected: 0

                Memory Processes Infected:
                (No malicious items detected)

                Memory Modules Infected:
                (No malicious items detected)

                Registry Keys Infected:
                (No malicious items detected)

                Registry Values Infected:
                (No malicious items detected)

                Registry Data Items Infected:
                (No malicious items detected)

                Folders Infected:
                (No malicious items detected)

                Files Infected:
                (No malicious items detected)
                Logged

                evilfantasy

                • Malware Removal Specialist
                • Moderator


                  • Genius
                • Calm like a bomb
                  • Thanked: 493
                • Experience: Experienced
                • OS: Windows 11
                Re: Registry....
                « Reply #13 on: August 07, 2008, 12:33:22 PM »
                Go to My Computer->Tools->Folder Options->View tab:
                • Under the Hidden files and folders heading:
                • Select Show hidden files and folders.
                • Uncheck Hide protected operating system files (recommended) option.
                • Also, make sure there is no checkmark beside Hide file extensions for known file types.
                • Click OK
                .
                ----------

                Open HijackThis and select Do a system scan only.

                Place a check mark next to the following entries: (if there)

                • R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 134.87.141.73:80
                • O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                • O4 - HKLM\..\Run: [SecurityUpdate] rundll32.exe C:\WINDOWS\system32\sotohuf.dll,TurnOn2
                .
                Important: Close all windows except for HijackThis and then click Fix checked.

                Exit HijackThis.

                ----------

                Now locate and delete this file.

                C:\WINDOWS\system32\sotohuf.dll

                Restart the computer and let me know how things are now.
                Logged

                tina1rules

                  Topic Starter


                  Intermediate

                  Thanked: 2
                  Re: Registry....
                  « Reply #14 on: August 07, 2008, 01:26:55 PM »
                  Okay I did the hijack this part. I don't know how to find the file sotohuff,I did a search files but it didn't show up.
                  Logged
                  Pages: [1] 2 3 ... 6  All   Go Up
                  « previous next »