Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

TR/Generic.2365032.4

  • 17-01-2010 4:00pm
    #1
    cheeseonion
    Closed Accounts Posts: 5 ✭


    hi, i got a warning about having TR/Generic.2365032.4 on my pc.
    i'm kind of scared it might be a keylogger or something, which i had before (didn't have the same name) and made me format my pc.
    i tried deleting it with antivir, but it just keeps popping up.
    at a system scan it said: the file could not be copied to quarantine!


Comments

  • #2
    cheeseonion
    Closed Accounts Posts: 5 ✭cheeseonion


    Logfile of Trend Micro HijackThis v2.0.3 (BETA)
    Scan saved at 17:27:35, on 17-1-2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\windows\System32\smss.exe
    C:\windows\system32\winlogon.exe
    C:\windows\system32\services.exe
    C:\windows\system32\lsass.exe
    C:\windows\system32\svchost.exe
    C:\windows\System32\svchost.exe
    C:\windows\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\windows\Explorer.EXE
    C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
    C:\windows\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Curse\CurseClient.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\program files\steam\steam.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\windows\system32\IoctlSvc.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\windows\System32\svchost.exe
    C:\windows\system32\wuauclt.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\windows\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
    O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI" TRANSFORMS="C:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST" WISE_SETUP_EXE_PATH="c:\nvidia\displaydriver\190.62\international\PhysX_9.09.0814_SystemSoftware.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
    O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: ,C:\windows\TEMP\21425sys.dll
    O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll
    O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - D:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updateservice (gupdate1ca3e2f79fd702) (gupdate1ca3e2f79fd702) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\windows\system32\IoctlSvc.exe

    --
    End of file - 9329 bytes


  • #3
    ActorSeeksJob
    Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


    hi

    Please download DDS and save it to your desktop.
    • Disable any script blocking protection
    • Double click dds.pif to run the tool.
    • When done, two DDS.txts will open.
    • Save both reports to your desktop.

    Please include the contents of the following in your next reply:

    DDS.txt
    Attach.txt.


  • #4
    cheeseonion
    Closed Accounts Posts: 5 ✭cheeseonion


    hi, thanks for your help:


    DDS (Ver_09-12-01.01) - NTFSx86
    Run by Jochem at 19:23:23,50 on zo 17-01-2010
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16
    Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2046.1078 [GMT 1:00]

    AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

    ============== Running Processes ===============

    C:\windows\system32\svchost -k DcomLaunch
    svchost.exe
    C:\windows\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\windows\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    svchost.exe
    C:\windows\Explorer.EXE
    C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
    C:\windows\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Curse\CurseClient.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\program files\steam\steam.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\windows\system32\IoctlSvc.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\windows\System32\svchost.exe -k netsvcs
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\windows\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Java\jre6\bin\jucheck.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live\Toolbar\wltuser.exe
    C:\Documents and Settings\Jochem\Bureaublad\dds.pif

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.daemon-search.com/startpage
    uSearch Page = hxxp://search.live.com
    mSearchAssistant = hxxp://search.live.com/sphome.aspx
    uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Nero Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Nero Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [CurseClient] c:\program files\curse\CurseClient.exe -silent
    uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    uRun: [Steam] "c:\program files\steam\steam.exe" -silent
    uRunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "c:\program files\common files\wise installation wizard\wisc5c1c0f0d62f4dbf81d4d7ef397c228b_9_09_0814.msi" transforms="c:\program files\common files\wise installation wizard\wisc5c1c0f0d62f4dbf81d4d7ef397c228b_9_09_0814.mst" wise_setup_exe_path="c:\nvidia\displaydriver\190.62\international\PhysX_9.09.0814_SystemSoftware.exe"
    mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [CloneCDTray] "c:\program files\slysoft\clonecd\CloneCDTray.exe" /s
    mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    StartupFolder: c:\docume~1\jochem\menust~1\progra~1\opstar~1\xfire.lnk - c:\program files\xfire\Xfire.exe
    StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
    DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    AppInit_DLLs: ,c:\windows\temp\21425sys.dll
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\jochem\applic~1\mozilla\firefox\profiles\cqob6qkc.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

    ============= SERVICES / DRIVERS ===============

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-22 11608]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-22 108289]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-22 185089]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-22 56816]
    R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2009-10-29 1074568]
    R2 wmcmgc;Windows Management Configuration;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-9-22 238080]
    S2 gupdate1ca3e2f79fd702;Google Updateservice (gupdate1ca3e2f79fd702);c:\program files\google\update\GoogleUpdate.exe [2009-9-25 133104]
    S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\program files\dragon age\bin_ship\daupdatersvc.service.exe [2009-11-12 25832]
    S3 GarenaPEngine;GarenaPEngine;c:\docume~1\jochem\locals~1\temp\ACPF5C.tmp [2010-1-14 25616]

    =============== Created Last 30 ================

    2010-01-17 16:27:10 0 d
    w- c:\program files\TrendMicro
    2010-01-16 20:03:31 0 d
    w- c:\program files\Age Of Empires 2 & The Conquerors Expansion - Full Game
    2010-01-14 23:07:30 0 d
    w- C:\Folding@HomeCPU
    2010-01-14 21:44:59 0 d
    w- c:\program files\common files\DirectX
    2010-01-14 21:31:01 0 d
    w- c:\program files\BlackShot
    2010-01-13 11:08:34 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
    2010-01-07 22:14:30 0 d
    w- c:\program files\Guitar Pro 5
    2010-01-05 23:47:58 0 d
    w- c:\program files\RADVideo
    2010-01-03 16:32:12 77054 ----a-w- c:\windows\War3Unin.dat
    2010-01-03 16:32:11 2829 ----a-w- c:\windows\War3Unin.pif
    2010-01-03 16:32:11 139264 ----a-w- c:\windows\War3Unin.exe
    2010-01-01 22:04:42 0 d
    w- c:\program files\Garena
    2010-01-01 21:55:44 0 d
    w- c:\docume~1\jochem\applic~1\Xfire
    2010-01-01 21:55:29 0 d
    w- c:\program files\Xfire
    2009-12-30 16:44:53 0 d
    w- c:\docume~1\alluse~1\applic~1\vsosdk
    2009-12-30 16:03:46 87608 ----a-w- c:\docume~1\jochem\applic~1\inst.exe
    2009-12-30 16:03:46 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
    2009-12-30 16:03:46 47360 ----a-w- c:\docume~1\jochem\applic~1\pcouffin.sys
    2009-12-30 16:03:36 65602 ----a-w- c:\windows\system32\cook3260.dll
    2009-12-30 16:03:36 217127 ----a-w- c:\windows\system32\drv43260.dll
    2009-12-30 16:03:36 208935 ----a-w- c:\windows\system32\drv33260.dll
    2009-12-30 16:03:36 176165 ----a-w- c:\windows\system32\drv23260.dll
    2009-12-30 16:03:36 102439 ----a-w- c:\windows\system32\sipr3260.dll
    2009-12-30 16:03:35 626688 ----a-w- c:\windows\system32\vp7vfw.dll
    2009-12-30 16:03:35 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
    2009-12-30 16:03:34 0 d
    w- c:\program files\VSO
    2009-12-29 16:39:54 648192 ----a-w- c:\windows\system32\NEROINSTAEC43759.DB
    2009-12-29 16:39:54 1000744 ----a-w- c:\windows\system32\ShellManager10E2D762.dll
    2009-12-28 22:36:26 0 d
    w- c:\program files\Nero
    2009-12-25 19:06:39 0 d
    w- C:\divx
    2009-12-20 20:16:58 0 d
    w- c:\program files\RAR Password Cracker
    2009-12-20 19:38:56 0 d
    w- c:\program files\SlySoft
    2009-12-20 18:07:22 0 d
    w- C:\Programs Files

    ==================== Find3M ====================

    2009-12-10 23:39:08 86256 ----a-w- c:\windows\system32\perfc013.dat
    2009-12-10 23:39:08 499226 ----a-w- c:\windows\system32\perfh013.dat
    2009-12-07 20:18:57 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2009-11-30 19:37:34 41872 ----a-w- c:\windows\system32\xfcodec.dll
    2009-11-14 00:47:28 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
    2009-11-14 00:47:28 856064 ----a-w- c:\windows\system32\divx_xx07.dll
    2009-11-14 00:47:28 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
    2009-11-14 00:47:28 843776 ----a-w- c:\windows\system32\divx_xx16.dll
    2009-11-14 00:47:28 839680 ----a-w- c:\windows\system32\divx_xx11.dll
    2009-11-14 00:47:28 696320 ----a-w- c:\windows\system32\DivX.dll
    2009-10-29 05:38:25 670208 ----a-w- c:\windows\system32\wininet.dll
    2009-10-26 23:42:32 37888 ----a-w- c:\windows\system32\flash_lib.dll
    2009-10-21 05:40:47 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 05:40:47 25088 ----a-w- c:\windows\system32\httpapi.dll

    ============= FINISH: 19:23:44,64 ===============


  • #5
    ActorSeeksJob
    Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


    hi

    Download TFC to your desktop
    • Open the file and close any other windows.
    • It will close all programs itself when run, make sure to let it run uninterrupted.
    • Click the Start button to begin the process. The program should not take long to finish its job
    • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean




    Please download Malwarebytes' Anti-Malware from Here

    Double Click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.
    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






    Go to Kaspersky website and perform an online antivirus scan.
    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
        Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
      [*]Click on My Computer under Scan.
      [*]Once the scan is complete, it will display the results. Click on View Scan Report.
      [*]You will see a list of infected items there. Click on Save Report As....
      [*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.


    5. #6
      cheeseonion
      Closed Accounts Posts: 5 ✭cheeseonion


      hi,
      i can't seem to get kaspersky to work, it keeps jamming while its updating the database.

      Malwarebytes' Anti-Malware 1.44
      Database version: 3594
      Windows 5.1.2600 Service Pack 3
      Internet Explorer 6.0.2900.5512

      20-1-2010 17:23:55
      mbam-log-2010-01-20 (17-23-55).txt

      Scan type: Quick Scan
      Objects scanned: 106096
      Time elapsed: 5 minute(s), 6 second(s)

      Memory Processes Infected: 0
      Memory Modules Infected: 0
      Registry Keys Infected: 0
      Registry Values Infected: 0
      Registry Data Items Infected: 0
      Folders Infected: 0
      Files Infected: 0

      Memory Processes Infected:
      (No malicious items detected)

      Memory Modules Infected:
      (No malicious items detected)

      Registry Keys Infected:
      (No malicious items detected)

      Registry Values Infected:
      (No malicious items detected)

      Registry Data Items Infected:
      (No malicious items detected)

      Folders Infected:
      (No malicious items detected)

      Files Infected:
      (No malicious items detected)


      mbam didnt find anything, but i still got a popup from antivir, that he detected the virus again


    6. Advertisement
    7. #7
      ActorSeeksJob
      Closed Accounts Posts: 1,970 ✭✭✭ActorSeeksJob


      can you get the avira log ?


    8. #8
      cheeseonion
      Closed Accounts Posts: 5 ✭cheeseonion


      hi, sorry for the late response, but i just found out your site was back on.
      i seem to be getting more detections of several virusses, though i dont recall being on strange sites etc.

      avira log:



      Avira AntiVir Personal
      Report file date: zaterdag 30 januari 2010 14:56

      Scanning for 1711998 virus strains and unwanted programs.

      Licensee : Avira AntiVir Personal - FREE Antivirus
      Serial number : 0000149996-ADJIE-0000001
      Platform : Windows XP
      Windows version : (Service Pack 3) [5.1.2600]
      Boot mode : Normally booted
      Username : SYSTEM
      Computer name : JOCHEM

      Version information:
      BUILD.DAT : 9.0.0.419 21701 Bytes 22-1-2010 18:29:00
      AVSCAN.EXE : 9.0.3.10 466689 Bytes 19-11-2009 18:20:58
      AVSCAN.DLL : 9.0.3.0 40705 Bytes 27-2-2009 09:58:24
      LUKE.DLL : 9.0.3.2 209665 Bytes 20-2-2009 10:35:49
      LUKERES.DLL : 9.0.2.0 12033 Bytes 27-2-2009 09:58:52
      VBASE000.VDF : 7.10.0.0 19875328 Bytes 6-11-2009 18:20:58
      VBASE001.VDF : 7.10.1.0 1372672 Bytes 19-11-2009 18:20:58
      VBASE002.VDF : 7.10.3.1 3143680 Bytes 20-1-2010 19:00:38
      VBASE003.VDF : 7.10.3.75 996864 Bytes 26-1-2010 18:39:13
      VBASE004.VDF : 7.10.3.76 2048 Bytes 26-1-2010 18:39:13
      VBASE005.VDF : 7.10.3.77 2048 Bytes 26-1-2010 18:39:13
      VBASE006.VDF : 7.10.3.78 2048 Bytes 26-1-2010 18:39:13
      VBASE007.VDF : 7.10.3.79 2048 Bytes 26-1-2010 18:39:13
      VBASE008.VDF : 7.10.3.80 2048 Bytes 26-1-2010 18:39:13
      VBASE009.VDF : 7.10.3.81 2048 Bytes 26-1-2010 18:39:13
      VBASE010.VDF : 7.10.3.82 2048 Bytes 26-1-2010 18:46:00
      VBASE011.VDF : 7.10.3.83 2048 Bytes 26-1-2010 18:46:00
      VBASE012.VDF : 7.10.3.84 2048 Bytes 26-1-2010 18:46:00
      VBASE013.VDF : 7.10.3.85 2048 Bytes 26-1-2010 18:46:00
      VBASE014.VDF : 7.10.3.86 2048 Bytes 26-1-2010 18:46:00
      VBASE015.VDF : 7.10.3.87 2048 Bytes 26-1-2010 18:46:00
      VBASE016.VDF : 7.10.3.88 2048 Bytes 26-1-2010 18:46:00
      VBASE017.VDF : 7.10.3.89 2048 Bytes 26-1-2010 18:46:00
      VBASE018.VDF : 7.10.3.90 2048 Bytes 26-1-2010 18:46:01
      VBASE019.VDF : 7.10.3.91 2048 Bytes 26-1-2010 18:46:01
      VBASE020.VDF : 7.10.3.92 2048 Bytes 26-1-2010 18:46:01
      VBASE021.VDF : 7.10.3.93 2048 Bytes 26-1-2010 18:46:01
      VBASE022.VDF : 7.10.3.94 2048 Bytes 26-1-2010 18:46:01
      VBASE023.VDF : 7.10.3.95 2048 Bytes 26-1-2010 18:46:03
      VBASE024.VDF : 7.10.3.96 2048 Bytes 26-1-2010 18:46:03
      VBASE025.VDF : 7.10.3.97 2048 Bytes 26-1-2010 18:46:03
      VBASE026.VDF : 7.10.3.98 2048 Bytes 26-1-2010 18:46:03
      VBASE027.VDF : 7.10.3.99 2048 Bytes 26-1-2010 18:46:03
      VBASE028.VDF : 7.10.3.100 2048 Bytes 26-1-2010 18:46:03
      VBASE029.VDF : 7.10.3.101 2048 Bytes 26-1-2010 18:46:03
      VBASE030.VDF : 7.10.3.102 2048 Bytes 26-1-2010 18:46:03
      VBASE031.VDF : 7.10.3.120 172544 Bytes 29-1-2010 16:32:21
      Engineversion : 8.2.1.154
      AEVDF.DLL : 8.1.1.3 106868 Bytes 23-1-2010 18:13:07
      AESCRIPT.DLL : 8.1.3.12 823675 Bytes 23-1-2010 18:13:07
      AESCN.DLL : 8.1.4.0 127348 Bytes 28-1-2010 16:40:36
      AESBX.DLL : 8.1.1.1 246132 Bytes 19-11-2009 18:20:58
      AERDL.DLL : 8.1.3.4 479605 Bytes 1-12-2009 18:32:28
      AEPACK.DLL : 8.2.0.5 422262 Bytes 14-1-2010 16:42:25
      AEOFFICE.DLL : 8.1.0.38 196987 Bytes 23-7-2009 08:59:39
      AEHEUR.DLL : 8.1.1.1 2322805 Bytes 28-1-2010 16:39:08
      AEHELP.DLL : 8.1.10.0 237942 Bytes 14-1-2010 16:42:07
      AEGEN.DLL : 8.1.1.85 369012 Bytes 28-1-2010 16:38:52
      AEEMU.DLL : 8.1.1.0 393587 Bytes 3-10-2009 15:44:59
      AECORE.DLL : 8.1.10.0 184695 Bytes 28-1-2010 16:38:50
      AEBB.DLL : 8.1.0.3 53618 Bytes 9-10-2008 13:32:40
      AVWINLL.DLL : 9.0.0.3 18177 Bytes 12-12-2008 07:47:59
      AVPREF.DLL : 9.0.3.0 44289 Bytes 23-9-2009 00:04:45
      AVREP.DLL : 8.0.0.3 155905 Bytes 20-1-2009 13:34:28
      AVREG.DLL : 9.0.0.0 36609 Bytes 5-12-2008 09:32:09
      AVARKT.DLL : 9.0.0.3 292609 Bytes 24-3-2009 14:05:41
      AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30-1-2009 09:37:08
      SQLITE3.DLL : 3.6.1.0 326401 Bytes 28-1-2009 14:03:49
      SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2-2-2009 07:21:33
      NETNT.DLL : 9.0.0.0 11521 Bytes 5-12-2008 09:32:10
      RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15-5-2009 14:39:58
      RCTEXT.DLL : 9.0.73.0 86785 Bytes 19-11-2009 18:20:57

      Configuration settings for the scan:
      Jobname.............................: Complete system scan
      Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
      Logging.............................: low
      Primary action......................: interactive
      Secondary action....................: ignore
      Scan master boot sector.............: on
      Scan boot sector....................: on
      Boot sectors........................: C:, D:,
      Process scan........................: on
      Scan registry.......................: on
      Search for rootkits.................: on
      Integrity checking of system files..: off
      Scan all files......................: All files
      Scan archives.......................: on
      Recursion depth.....................: 20
      Smart extensions....................: on
      Macro heuristic.....................: on
      File heuristic......................: medium

      Start of the scan: zaterdag 30 januari 2010 14:56

      Starting search for hidden objects.
      '50789' objects were checked, '0' hidden objects were found.

      The scan of running processes will be started
      Scan process 'SkypeNames.exe' - '1' Module(s) have been scanned
      Scan process 'firefox.exe' - '1' Module(s) have been scanned
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'dwwin.exe' - '1' Module(s) have been scanned
      Scan process 'wlcomm.exe' - '1' Module(s) have been scanned
      Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'skypePM.exe' - '1' Module(s) have been scanned
      Scan process 'alg.exe' - '1' Module(s) have been scanned
      Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
      Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
      Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
      Scan process 'IoctlSvc.exe' - '1' Module(s) have been scanned
      Scan process 'jqs.exe' - '1' Module(s) have been scanned
      Scan process 'hamachi-2.exe' - '1' Module(s) have been scanned
      Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
      Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'Xfire.exe' - '1' Module(s) have been scanned
      Scan process 'WZQKPICK.EXE' - '1' Module(s) have been scanned
      Scan process 'Steam.exe' - '1' Module(s) have been scanned
      Scan process 'Skype.exe' - '1' Module(s) have been scanned
      Scan process 'daemon.exe' - '1' Module(s) have been scanned
      Scan process 'CTSyncU.exe' - '1' Module(s) have been scanned
      Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
      Scan process 'uTorrent.exe' - '1' Module(s) have been scanned
      Scan process 'CurseClient.exe' - '1' Module(s) have been scanned
      Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
      Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
      Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
      Scan process 'CloneCDTray.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'HDeck.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      51 processes with 51 modules were scanned

      Starting master boot sector scan:
      Master boot sector HD0
      [INFO] No virus was found!

      Start scanning boot sectors:
      Boot sector 'C:\'
      [INFO] No virus was found!
      Boot sector 'D:\'
      [INFO] No virus was found!

      Starting to scan executable files (registry).
      The registry was scanned ( '54' files ).


      Starting the file scan:

      Begin scan in 'C:\'
      C:\pagefile.sys
      [WARNING] The file could not be opened!
      [NOTE] This file is a Windows system file.
      [NOTE] This file cannot be opened for scanning.
      C:\Program Files\Age Of Empires 2 & The Conquerors Expansion - Full Game\mythxpak.exe
      [DETECTION] Is the TR/Horse.MG Trojan
      C:\System Volume Information\_restore{27C9CD00-97EC-4A28-8DB3-8AFA6A3AFD03}\RP207\A0025817.exe
      [DETECTION] Is the TR/Horse.MG Trojan
      C:\System Volume Information\_restore{27C9CD00-97EC-4A28-8DB3-8AFA6A3AFD03}\RP230\A0026912.exe
      [DETECTION] Is the TR/Horse.MG Trojan
      C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING] The file could not be opened!
      Begin scan in 'D:\'

      Beginning disinfection:
      C:\Program Files\Age Of Empires 2 & The Conquerors Expansion - Full Game\mythxpak.exe
      [DETECTION] Is the TR/Horse.MG Trojan
      [NOTE] The file was moved to '4bd84b26.qua'!
      C:\System Volume Information\_restore{27C9CD00-97EC-4A28-8DB3-8AFA6A3AFD03}\RP207\A0025817.exe
      [DETECTION] Is the TR/Horse.MG Trojan
      [NOTE] The file was moved to '4b944add.qua'!
      C:\System Volume Information\_restore{27C9CD00-97EC-4A28-8DB3-8AFA6A3AFD03}\RP230\A0026912.exe
      [DETECTION] Is the TR/Horse.MG Trojan
      [NOTE] The file was moved to '49975dbe.qua'!


      End of the scan: zaterdag 30 januari 2010 16:05
      Used time: 1:08:54 Hour(s)

      The scan has been done completely.

      9757 Scanned directories
      461678 Files were scanned
      3 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      3 Files were moved to quarantine
      0 Files were renamed
      2 Files cannot be scanned
      461673 Files not concerned
      3334 Archives were scanned
      2 Warnings
      4 Notes
      50789 Objects were scanned with rootkit scan
      0 Hidden objects were found


      and i also get this from time to time:

      Virus or unwanted program 'HIDDENEXT/Crypted [heuristic]'
      detected in file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\7FAJR8Z8\0[1].jpg.
      Action performed: Delete file


    9. #9
      ASJ112
      Site Banned Posts: 1,167 ✭✭✭ASJ112


      those are fine

      Your logs are clean


      Now we need to create a new System Restore point.

      Click Start Menu > Run > type (or copy and paste)

      %SystemRoot%\System32\restore\rstrui.exe

      Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

      Next goto Start Menu > Run > type

      cleanmgr

      Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

      To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.




      • Download OTC to your desktop and run it
      • Click Yes to beginning the Cleanup process and remove these components, including this application.
      • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.




      Below I have included a number of recommendations for how to protect your computer against malware infections.
      • Keep Windows updated by regularly checking their website at :
        http://windowsupdate.microsoft.com/
        This will ensure your computer has always the latest security updates available installed on your computer.

      • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

      • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

      • Make Internet Explorer more secure
        • Click Start > Run
        • Type Inetcpl.cpl & click OK
        • Click on the Security tab
        • Click Reset all zones to default level
        • Make sure the Internet Zone is selected & Click Custom level
        • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
        • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

      • TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

      • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

      • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
        secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
        blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
        Here


        If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
        • NoScript - for blocking ads and other potential website attacks
        • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling


      • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

      • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

      • FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.

      • Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.

      • Please read my guide on how to prevent malware and about safe computing here

      Thank you for your patience, and performing all of the procedures requested.


    Advertisement