Tech Support Forum - View Single Post

**mamadawn** · 07-27-2005, 09:36 PM

You're my hero! But it was common sense finally kicking in that got my modem working. Okay, so I'll stop blaming the modem... It was the surge protector. I don't have a reset switch on it but I did turn it off and back on. Everything was working the same and I still had no dial tone. I finally plug the computer directly into my phone line and, wa la, there's my dial tone. So it looks to me as though lightening hit the surge protector and saved it from ruining my modem. Unless you have any other theories. It must have just come in the phone line and stopped at the surge protector and fried that portion of the protector because my computer, shredder, printer, monitor, etc. are all plugged into the same surge protector and they are all still working properly.

Now, where were we with the whole virus thing. I'm so wiped from the day and stressing myself out about the computer I can't think straight anymore. So I'll leave you with the latest hijackthis and ewido scans. I'll try to run a trendmicro scan and see if it won't update still. I'll try to send that off to you first thing in the morning. I'm too scared to run a panda scan at this point because I don't want the internet to go down again.

Let me know what else needs to be done to finish cleaning out all the viruses. I can tell you that it's taking an aweful long time to execute any programs after windows starts up. I can move the cursor around freely and click to highlight and Icon but if I double click on an icon it takes around 2 minutes for that program to finally open. Once the computer is up and running I don't have that trouble anymore. So either I've added more things to my start up list and don't know about it or there's a virus still learking.

FYI - I burned a copy of the IE file you linked me to and ran the setup on my computer... sure enough it just went on ahead and updated my IE. I didn't go into the actual setup to see if I could find the wininet.dll file to replace the one on my computer with it because I thought that when I updated with your cd that it automatically put that file in. Am I correct?

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 10:35:09 PM, 7/27/2005
+ Report-Checksum: DC27C868

+ Scan result:

C:\Documents and Settings\Dawn D. Slezak\Cookies\dawn d. slezak@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 10:36:07 PM, on 7/27/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netins.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SSC_UserPrompt] - C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F9BD96E-596B-404B-B2E3-6E3BE44F5CEA}: NameServer = 167.142.225.3 167.142.225.5
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Sorry this post was lenghty and jarbbled... I'm sooo tired.
Thanks a million!!

07-27-2005, 09:36 PM	#12 (permalink)
mamadawn I helped the forums. Join Date: Jul 2005 Location: Cedar Rapids, IA Posts: 14 OS: 2000	Yeah! I'm so happy again!! You're my hero! But it was common sense finally kicking in that got my modem working. Okay, so I'll stop blaming the modem... It was the surge protector. I don't have a reset switch on it but I did turn it off and back on. Everything was working the same and I still had no dial tone. I finally plug the computer directly into my phone line and, wa la, there's my dial tone. So it looks to me as though lightening hit the surge protector and saved it from ruining my modem. Unless you have any other theories. It must have just come in the phone line and stopped at the surge protector and fried that portion of the protector because my computer, shredder, printer, monitor, etc. are all plugged into the same surge protector and they are all still working properly. Now, where were we with the whole virus thing. I'm so wiped from the day and stressing myself out about the computer I can't think straight anymore. So I'll leave you with the latest hijackthis and ewido scans. I'll try to run a trendmicro scan and see if it won't update still. I'll try to send that off to you first thing in the morning. I'm too scared to run a panda scan at this point because I don't want the internet to go down again. Let me know what else needs to be done to finish cleaning out all the viruses. I can tell you that it's taking an aweful long time to execute any programs after windows starts up. I can move the cursor around freely and click to highlight and Icon but if I double click on an icon it takes around 2 minutes for that program to finally open. Once the computer is up and running I don't have that trouble anymore. So either I've added more things to my start up list and don't know about it or there's a virus still learking. FYI - I burned a copy of the IE file you linked me to and ran the setup on my computer... sure enough it just went on ahead and updated my IE. I didn't go into the actual setup to see if I could find the wininet.dll file to replace the one on my computer with it because I thought that when I updated with your cd that it automatically put that file in. Am I correct? --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 10:35:09 PM, 7/27/2005 + Report-Checksum: DC27C868 + Scan result: C:\Documents and Settings\Dawn D. Slezak\Cookies\dawn d. slezak@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup ::Report End Logfile of HijackThis v1.99.1 Scan saved at 10:36:07 PM, on 7/27/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netins.net/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SSC_UserPrompt] - C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7F9BD96E-596B-404B-B2E3-6E3BE44F5CEA}: NameServer = 167.142.225.3 167.142.225.5 O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe Sorry this post was lenghty and jarbbled... I'm sooo tired. Thanks a million!!