Tech Support Forum - View Single Post

**src2206** · 04-17-2006, 07:46 AM

Hi Vikesrock8411,
At the very begining I would like to offer you my sincere apologies for my overt zealousness and assuming that this apology is accepted (as you are a very kind hearted person

) I would like to wish you HAPPY EASTER (beleted, apologies again!!!). My anxiety was mainly driven by this fact that I was new to this forum (and to be honest, any forum- this is my first) I was not really sure whether I was replying in proper manner

. In future this will not happen.
Enyways,now regarding the files shown by Active Scan-

I tried to use killbox first as being detailed in one of your forum threads. I chose the option 'replace on reeboot' and under that 'replace with dummy' and checking the box 'end explorer shell while killing file' but that didnot work. I even tried to do that in safe mode but to vein (though this process worked fine with original cmb_12341 file). Then I chose 'standard file kill' and 'end explorer shell while killing the file'. This time it worked and I double checked by going to the windows folder whether the files were there or not. Though the program informed that a backup has been created but I couldn't find that. Could you please tell me where those might be? Then I downloaded all the softwares as you directed and installed them. Here also I had a problem and need your help. With Spyware Guard & Spyware Blaster, whenever I try to run them a windows opens up and tries to install Dictation2005. Even if I press 'cancel' it tries atleast twice or thrice. As SG is loaded at starup, after every boot the installer appears. Please help me with this.

Active Scan Log 1 (before installing SG and others)

Incident Status Location

Adware:adware/secure32 Not disinfected E:\WINDOWS\secure32.html
Adware:adware/cws.searchmeup Not disinfected E:\WINDOWS\uniq
Adware:adware/powerstrip Not disinfected Windows Registry
Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Cookies\proma roy choudhury@tribalfusion[1].txt
Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/myaffiliateprogram Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[www.myaffiliateprogram.com/]
Spyware:Cookie/Com.com Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[.com.com/]
Possible Virus. Not disinfected D:\My Documents\My Completed Downloads\OS-Adobe_Acrobat 7.0 Pro_Tryout_to_Full_Activation.exe[run.exe]
Potentially unwanted tool:Application/Processor Not disinfected D:\My Documents\My Downloads\1. To BE WRRITTEN\smitRem\smitRem.exe[Process.exe]
Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[]
Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Cookies\proma roy choudhury@tribalfusion[1].txt
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{2C20C2E6-EFE2-4234-A7EA-BC8834903B3C}\{37159949-5FCF-4BA4-A7B7-F720EA34501A}.txt[{37159949-5FCF-4BA4-A7B7-F720EA34501A}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{2C20C2E6-EFE2-4234-A7EA-BC8834903B3C}\{F4E0F731-07BC-4AFF-9A5F-4F235200E92C}.txt[{F4E0F731-07BC-4AFF-9A5F-4F235200E92C}.txt]
Spyware:Cookie/Paypopup Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{560DCF33-C67E-4899-A3D8-B65F6A972FF1}.txt[{560DCF33-C67E-4899-A3D8-B65F6A972FF1}.txt]
Spyware:Cookie/888 Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{5C527138-0ADE-45EC-8411-150F87E7FA25}.txt[{5C527138-0ADE-45EC-8411-150F87E7FA25}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{CF53017D-E377-4B2F-B897-7CC922467E35}.txt[{CF53017D-E377-4B2F-B897-7CC922467E35}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{DF341150-DA84-41E3-8456-854D5A0943BF}.txt[{DF341150-DA84-41E3-8456-854D5A0943BF}.txt]
Spyware:Cookie/YieldManager Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt[{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{36DC5134-6453-45B6-A634-CBA912679548}.txt[{36DC5134-6453-45B6-A634-CBA912679548}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt[{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt]

Active Scan Log 2( After deleting the files and installing SG)

Incident Status Location

Adware:adware/powerstrip Not disinfected Windows Registry
Potentially unwanted tool:Application/Processor Not disinfected D:\My Documents\My Downloads\1. To BE WRRITTEN\smitRem\smitRem.exe[Process.exe]
Spyware:Cookie/YieldManager Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt[{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{36DC5134-6453-45B6-A634-CBA912679548}.txt[{36DC5134-6453-45B6-A634-CBA912679548}.txt]
Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt[{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt]

I have deleted the files but what to do abot powerstrip I could not understand. I could not find it too. Please see if you do anything. ( though I know you can

)

After deleting files, I again ran Panda Scan twice to find to my horror that there are again spywares. I am posting that log too for your kind attention. Again I deleted Files using killbox using 'standard kill'. Then I ran a CleanUp and went for another scan. That log also I am posting.
Regarding other softwares according to your advice, I already have AVG ANTIVIRUS, ZONE ALARM FIREWALL, AD-AWARE SE 1.06 & SPYBOT S&D installed and they are regurarly (and relegiously) updated.
I know again I may have some problems, BUT THIS TIME I AM NOT WORRIED 'CAUSE I KNOW A FRIEND IS OUT THERE TO BAIL ME OUT OF THIS SITUATION.

Thank You Very Much My Dear Friend. And I wish that I could join your team and help others like me out there and eradicate the real fear of loosing identity in this virtual world.

04-17-2006, 07:46 AM	#10 (permalink)
src2206 TSF Enthusiast Join Date: Apr 2006 Location: Kolkata, India Posts: 2,068 OS: WinXP Pro SP3 My System	HJT Log (urgent) Thank You My Friend Hi Vikesrock8411, At the very begining I would like to offer you my sincere apologies for my overt zealousness and assuming that this apology is accepted (as you are a very kind hearted person ) I would like to wish you HAPPY EASTER (beleted, apologies again!!!). My anxiety was mainly driven by this fact that I was new to this forum (and to be honest, any forum- this is my first) I was not really sure whether I was replying in proper manner . In future this will not happen. Enyways,now *regarding the files shown by Active Scan- I tried to use killbox first as being detailed in one of your forum threads. I chose the option 'replace on reeboot' and under that 'replace with dummy' and checking the box 'end explorer shell while killing file' but that didnot work. I even tried to do that in safe mode but to vein (though this process worked fine with original cmb_12341 file). Then I chose 'standard file kill' and 'end explorer shell while killing the file'. This time it worked and I double checked by going to the windows folder whether the files were there or not. Though the program informed that a backup has been created but I couldn't find that. Could you please tell me where those might be? Then I downloaded all the softwares as you directed and installed them. Here also I had a problem and need your help. With Spyware Guard & Spyware Blaster, whenever I try to run them a windows opens up and tries to install Dictation2005. Even if I press 'cancel' it tries atleast twice or thrice. As SG is loaded at starup, after every boot the installer appears. Please help me with this. Active Scan Log 1 (before installing SG and others)* Incident Status Location Adware:adware/secure32 Not disinfected E:\WINDOWS\secure32.html Adware:adware/cws.searchmeup Not disinfected E:\WINDOWS\uniq Adware:adware/powerstrip Not disinfected Windows Registry Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Cookies\proma roy choudhury@tribalfusion[1].txt Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/myaffiliateprogram Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[www.myaffiliateprogram.com/] Spyware:Cookie/Com.com Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[.com.com/] Possible Virus. Not disinfected D:\My Documents\My Completed Downloads\OS-Adobe_Acrobat 7.0 Pro_Tryout_to_Full_Activation.exe[run.exe] Potentially unwanted tool:Application/Processor Not disinfected D:\My Documents\My Downloads\1. To BE WRRITTEN\smitRem\smitRem.exe[Process.exe] Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lry8oy48.default\cookies.txt[] Spyware:Cookie/Tribalfusion Not disinfected E:\Documents and Settings\Administrator\Cookies\proma roy choudhury@tribalfusion[1].txt Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{2C20C2E6-EFE2-4234-A7EA-BC8834903B3C}\{37159949-5FCF-4BA4-A7B7-F720EA34501A}.txt[{37159949-5FCF-4BA4-A7B7-F720EA34501A}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{2C20C2E6-EFE2-4234-A7EA-BC8834903B3C}\{F4E0F731-07BC-4AFF-9A5F-4F235200E92C}.txt[{F4E0F731-07BC-4AFF-9A5F-4F235200E92C}.txt] Spyware:Cookie/Paypopup Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{560DCF33-C67E-4899-A3D8-B65F6A972FF1}.txt[{560DCF33-C67E-4899-A3D8-B65F6A972FF1}.txt] Spyware:Cookie/888 Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{5C527138-0ADE-45EC-8411-150F87E7FA25}.txt[{5C527138-0ADE-45EC-8411-150F87E7FA25}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{CF53017D-E377-4B2F-B897-7CC922467E35}.txt[{CF53017D-E377-4B2F-B897-7CC922467E35}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Manual\{56813E67-9032-4598-AC7B-2EE7FCD27806}\{DF341150-DA84-41E3-8456-854D5A0943BF}.txt[{DF341150-DA84-41E3-8456-854D5A0943BF}.txt] Spyware:Cookie/YieldManager Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt[{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{36DC5134-6453-45B6-A634-CBA912679548}.txt[{36DC5134-6453-45B6-A634-CBA912679548}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt[{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt] *Active Scan Log 2( After deleting the files and installing SG)* Incident Status Location Adware:adware/powerstrip Not disinfected Windows Registry Potentially unwanted tool:Application/Processor Not disinfected D:\My Documents\My Downloads\1. To BE WRRITTEN\smitRem\smitRem.exe[Process.exe] Spyware:Cookie/YieldManager Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt[{0ED94141-4F4D-4D3A-9D9F-D50FD172E731}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{36DC5134-6453-45B6-A634-CBA912679548}.txt[{36DC5134-6453-45B6-A634-CBA912679548}.txt] Spyware:Cookie/Belnk Not disinfected E:\Program Files\iolo\System Mechanic Professional 6\Undo\Sched\{F541538C-E618-49E4-B441-464130524BAF}\{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt[{A8AFCF8F-CF9D-432B-9CB8-67C1F2BA0AC6}.txt] I have deleted the files but what to do abot powerstrip I could not understand. I could not find it too. Please see if you do anything. ( though I know you can ) After deleting files, I again ran Panda Scan twice to find to my horror that there are again spywares. I am posting that log too for your kind attention. Again I deleted Files using killbox using 'standard kill'. Then I ran a CleanUp and went for another scan. That log also I am posting. Regarding other softwares according to your advice, I already have AVG ANTIVIRUS, ZONE ALARM FIREWALL, AD-AWARE SE 1.06 & SPYBOT S&D installed and they are regurarly (and relegiously) updated. I know again I may have some problems, BUT THIS TIME I AM NOT WORRIED 'CAUSE I KNOW A FRIEND IS OUT THERE TO BAIL ME OUT OF THIS SITUATION. Thank You Very Much My Dear Friend. And I wish that I could join your team and help others like me out there and eradicate the real fear of loosing identity in this virtual world.