|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-06-2007, 11:28 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 4
OS: winxp
|
Constant popups and warnings with erroneous messages - Ultimate Defender 2
Well, the guy who posted with this title (without the 2) seemed to have the exact same prob as me.
"I'm getting constant IE and window popups and warnings that my system is infected but nothing from AVP or . The malware is installing shortcuts on my desktop (Spyware&Malware protection, Privacy protector, Error Cleaner) They are all http links to load an onlinesecurityworld.com webpage. There is a popup that says “Spyware Alert” Security Warning! Trojan.W32.Looksky detected ... Alert in system tray that shows as a red triangle with an white exclamation point inside. IE pops up constantly and goes to www.udefender.com There is also a cmd window that comes up and executes C:\Windows\smc.bat" Also, it should be noted that before all this happened, my internet history bin was full of sites such as "narutosex.com" and "clitgames.com" I have already downloaded combofix and it seemed to work really well. Here are my logs. ComboFix 07-08-07.5 - "Owner" 2007-08-06 23:15:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.175 [GMT -7:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Owner\FAVORI~1.\Error Cleaner.url C:\DOCUME~1\Owner\FAVORI~1.\Privacy Protector.url C:\DOCUME~1\Owner\FAVORI~1.\Spyware&Malware Protection.url C:\WINDOWS\dat.txt C:\WINDOWS\DOWNLO~1.\ysbactivex.dll C:\WINDOWS\main_uninstaller.exe C:\WINDOWS\sconf32.dll C:\WINDOWS\wmplayer.dll C:\WINDOWS\wmsound.dll ((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 ))))))))))))))))))))))))))))))) 2007-08-06 23:13 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-06 23:13 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-06 22:46 <DIR> d-------- C:\VundoFix Backups 2007-08-06 14:36 <DIR> d-------- C:\Program Files\VideoAccessCodec 2007-07-26 22:27 2,365,192 --a------ C:\Program Files\xfire_installer_23928.gunz.exe 2007-07-26 21:55 <DIR> d--h----- C:\DOCUME~1\Owner\APPLIC~1\ijjigame 2007-07-26 21:35 <DIR> d-------- C:\Program Files\LevelUpGames 2007-07-26 21:34 177,935,750 --a------ C:\Program Files\GunzIndiaFinalClient.exe 2007-07-17 16:20 <DIR> d-------- C:\gmax 2007-07-09 22:57 40 --a------ C:\DOCUME~1\Owner\language.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-06 23:18 --------- d-------- C:\Program Files\Google 2007-08-06 20:01 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\uTorrent 2007-08-06 15:36 --------- d-------- C:\Program Files\Starcraft 2007-08-06 15:35 --------- d-------- C:\Program Files\Warcraft III 2007-07-31 23:41 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\MSN6 2007-06-04 15:24 1156 --a------ C:\WINDOWS\mozver.dat 2007-05-16 08:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 08:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 08:12 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 08:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 08:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 02:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-04-27 19:11 30632 --a--c--- C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT 2007-04-04 15:34 127306765 --a------ C:\Program Files\GunboundRV_setup.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IPInSightMonitor 01"="C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [2003-07-14 12:30] "2wSysTray"="C:\Program Files\2Wire\2PortalMon.exe" [2003-10-10 03:14] "WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-08-08 13:00] "Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-08-08 13:00] "Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-08 13:00] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-12-18 01:20] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2006-12-10 22:45] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 15:08] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ 2Wire Wireless Client Manager.lnk - C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE [2005-09-27 16:18:17] Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-12 10:53:37] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] hp psc 1000 series.lnk - C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 18:21:38] hpoddt01.exe.lnk - C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04] Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-08 13:00:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "wmplayer"= {F66D84A6-3D6A-4D67-A3C3-AC6792FF34C2} - C:\WINDOWS\wmplayer.dll [ ] "wmsound"= {6565D791-FE69-4AC5-B0BB-48F426E3603D} - C:\WINDOWS\wmsound.dll [ ] R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R3 wltwo51b;2Wire Wireless USB adapter Driver;C:\WINDOWS\system32\DRIVERS\wltwo51b.sys S2 RVIEG01;VSC Engine;\??\C:\Program Files\Cakewalk\Shared Dxi\Roland\RVIEg01.sys S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys S3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys S3 GMSIPCI;GMSIPCI;\??\D:\INSTALL\GMSIPCI.SYS S3 nm;Network Monitor Driver;C:\WINDOWS\system32\DRIVERS\NMnt.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys S3 NTACCESS;NTACCESS;\??\D:\NTACCESS.sys S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys S3 XTrapD12;XTrapD12;\??\C:\WINDOWS\system32\XTrapD12.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- E:\SETUP.EXE Contents of the 'Scheduled Tasks' folder 2005-10-12 02:22:23 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1128313506.job - C:\Program Files\Hewlard Packard\Digital Imaging\Bin\hpqfrucl.exe 2007-07-18 20:40:53 C:\WINDOWS\Tasks\WebReg 20070718134052.job - C:\Program Files\Hewlard Packard\Digital Imaging\Bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-06 23:19:08 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000074 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-06 23:20:54 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-06 23:20 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:21:17 PM, on 8/6/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cmd.exe C:\Program Files\2Wire\2PortalMon.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\QuickTime Alternative\qttask.exe C:\Program Files\AIM\aim.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Hewlard Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\cmd.exe C:\ComboFix\vfind.cfexe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: 2Wire Wireless Client Manager.lnk = ? O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab O21 - SSODL: wmplayer - {F66D84A6-3D6A-4D67-A3C3-AC6792FF34C2} - C:\WINDOWS\wmplayer.dll (file missing) O21 - SSODL: wmsound - {6565D791-FE69-4AC5-B0BB-48F426E3603D} - C:\WINDOWS\wmsound.dll (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6228 bytes If someone could please help, it would be greatly appreciated. Thanks |
|
     |
| Sponsored Links |
|
08-06-2007, 11:43 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Constant popups and warnings with erroneous messages - Ultimate Defender 2
Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O21 - SSODL: wmplayer - {F66D84A6-3D6A-4D67-A3C3-AC6792FF34C2} - C:\WINDOWS\wmplayer.dll (file missing) O21 - SSODL: wmsound - {6565D791-FE69-4AC5-B0BB-48F426E3603D} - C:\WINDOWS\wmsound.dll (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe Ignore any prompts that calls for a reboot --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
Folder:: C:\VundoFix Backups C:\Program Files\VideoAccessCodec C:\Program Files\Viewpoint Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "wmplayer"= - "wmsound"= -  Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
|
|
|
|
|
08-07-2007, 12:55 AM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 4
OS: winxp
|
Re: Constant popups and warnings with erroneous messages - Ultimate Defender 2
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:53 AM, on 8/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\2Wire\2PortalMon.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\QuickTime Alternative\qttask.exe C:\Program Files\AIM\aim.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Hewlard Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: 2Wire Wireless Client Manager.lnk = ? O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 5628 bytes ComboFix 07-08-07.5 - "Owner" 2007-08-06 23:55:34.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.247 [GMT -7:00] Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\VideoAccessCodec C:\Program Files\VideoAccessCodec\install.ico C:\Program Files\VideoAccessCodec\Uninstall.exe C:\Program Files\VideoAccessCodec\VideoAccessCodec.ocx C:\Program Files\Viewpoint C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0302021C.dll C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0302021C_.dll C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0305000D.dll C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr_0305000D.dll C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\JpegReader.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Mts3Reader.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SreeDMMX.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SWFView.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMgr.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPVideo.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPVideo2.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\WaveletReader.dll C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt C:\Program Files\Viewpoint\Viewpoint Media Player\NewComponents\Cursors.dll C:\VundoFix Backups ((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 ))))))))))))))))))))))))))))))) 2007-08-06 23:13 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-06 23:13 <DIR> d-------- C:\Program Files\Trend Micro 2007-07-26 22:27 2,365,192 --a------ C:\Program Files\xfire_installer_23928.gunz.exe 2007-07-26 21:55 <DIR> d--h----- C:\DOCUME~1\Owner\APPLIC~1\ijjigame 2007-07-26 21:35 <DIR> d-------- C:\Program Files\LevelUpGames 2007-07-26 21:34 177,935,750 --a------ C:\Program Files\GunzIndiaFinalClient.exe 2007-07-17 16:20 <DIR> d-------- C:\gmax 2007-07-09 22:57 40 --a------ C:\DOCUME~1\Owner\language.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-06 23:18 --------- d-------- C:\Program Files\Google 2007-08-06 20:01 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\uTorrent 2007-08-06 15:36 --------- d-------- C:\Program Files\Starcraft 2007-08-06 15:35 --------- d-------- C:\Program Files\Warcraft III 2007-07-31 23:41 --------- d-------- C:\DOCUME~1\Owner\APPLIC~1\MSN6 2007-06-04 15:24 1156 --a------ C:\WINDOWS\mozver.dat 2007-05-16 08:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 08:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 08:12 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 08:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 08:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 02:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-04-27 19:11 30632 --a--c--- C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT 2007-04-04 15:34 127306765 --a------ C:\Program Files\GunboundRV_setup.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IPInSightMonitor 01"="C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [2003-07-14 12:30] "2wSysTray"="C:\Program Files\2Wire\2PortalMon.exe" [2003-10-10 03:14] "WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-08-08 13:00] "Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-08-08 13:00] "Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-08 13:00] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-12-18 01:20] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "QuickTime Task"="C:\Program Files\QuickTime Alternative\qttask.exe" [2006-12-10 22:45] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="C:\Program Files\AIM\aim.exe" [2005-08-05 15:08] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ 2Wire Wireless Client Manager.lnk - C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE [2005-09-27 16:18:17] Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-12 10:53:37] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] hp psc 1000 series.lnk - C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 18:21:38] hpoddt01.exe.lnk - C:\Program Files\Hewlard Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04] Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-08 13:00:00] R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R3 wltwo51b;2Wire Wireless USB adapter Driver;C:\WINDOWS\system32\DRIVERS\wltwo51b.sys S2 RVIEG01;VSC Engine;\??\C:\Program Files\Cakewalk\Shared Dxi\Roland\RVIEg01.sys S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys S3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys S3 GMSIPCI;GMSIPCI;\??\D:\INSTALL\GMSIPCI.SYS S3 nm;Network Monitor Driver;C:\WINDOWS\system32\DRIVERS\NMnt.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys S3 NTACCESS;NTACCESS;\??\D:\NTACCESS.sys S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys S3 XTrapD12;XTrapD12;\??\C:\WINDOWS\system32\XTrapD12.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- E:\SETUP.EXE Contents of the 'Scheduled Tasks' folder 2005-10-12 02:22:23 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1128313506.job - C:\Program Files\Hewlard Packard\Digital Imaging\Bin\hpqfrucl.exe 2007-07-18 20:40:53 C:\WINDOWS\Tasks\WebReg 20070718134052.job - C:\Program Files\Hewlard Packard\Digital Imaging\Bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-06 23:58:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000073 scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-07 0:00:26 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-06 23:59 C:\ComboFix2.txt ... 2007-08-06 23:20 --- E O F --- ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, August 07, 2007 12:53:27 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 7/08/2007 Kaspersky Anti-Virus database records: 376356 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 33350 Number of viruses found: 8 Number of infected objects: 19 Number of suspicious objects: 0 Duration of the scan process: 00:38:36 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\6abdaa1f-74f86350/Counter.class Infected: Trojan.Java.ClassLoader.i skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\6abdaa1f-74f86350/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\6abdaa1f-74f86350/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\6abdaa1f-74f86350 ZIP: infected - 3 skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-7d27dd33.zip/Counter.class Infected: Trojan.Java.ClassLoader.i skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-7d27dd33.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-7d27dd33.zip/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-7d27dd33.zip ZIP: infected - 3 skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Desktop\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\sa5.tmp.exe Infected: Trojan-Downloader.Win32.Small.uf skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0002/data0003 Infected: Trojan-Downloader.Win32.Keenval skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0002/data0004 Infected: Trojan-Downloader.Win32.Keenval skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0002/data0005 Infected: Trojan-Downloader.Win32.Keenval skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0002 Infected: Trojan-Downloader.Win32.Keenval skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0008 Infected: Trojan-Downloader.Win32.Small.alx skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0009/data0003 Infected: Trojan-Downloader.Win32.Keenval.f skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0009 Infected: Trojan-Downloader.Win32.Keenval.f skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe/data0005 Infected: Trojan.Win32.Keenval.b skipped C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp\UpdatedUpdaterInstall.exe NSIS: infected - 8 skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped Scan was interrupted by user! The scan stopped at 82 and would not progress anymore. There weren't any other complications and the popups have seemed to stopped. It's kind of late so I'll be back tomorrow. Thank you again! Seriously! |
|
|
|
|
08-07-2007, 06:59 AM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Constant popups and warnings with erroneous messages - Ultimate Defender 2
Open notepad and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\6abdaa1f-74f86350"
"C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-7d27dd33.zip"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
for %%g in (
"C:\Documents and Settings\Owner\My Documents\Cecilla's backup\Documents and Settings\Austin\Local Settings\Temp"
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
|
|
|
|
|
08-07-2007, 07:55 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 23,238
OS: N/A
|
Re: Constant popups and warnings with erroneous messages - Ultimate Defender 2
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
|
|
|
|
| Thread Tools | |
|
|
