|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
02-10-2008, 05:59 PM
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 6
OS: WIN XP
|
zlob.dnschanger.rtk virus
I have this virus that I can't seem to get rid of. Can somebody please help me? Here are my logs: Thanks, Kyle
Deckard's System Scanner v20071014.68 Run by Chew Family on 2008-02-10 16:35:08 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2008-02-11 00:35:10 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-02-10 16:37:36 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\SYSTEM32\smss.exe C:\WINDOWS\SYSTEM32\csrss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\SYSTEM32\services.exe C:\WINDOWS\SYSTEM32\lsass.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\SYSTEM32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\acsd.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\NAVAPSVC.EXE C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE C:\Program Files\Norton SystemWorks\Norton Utilities\Speed Disk\NOPDB.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\SYSTEM32\alg.exe C:\Program Files\Creative\ShareDLL\CTNotify.exe C:\Program Files\Micro Innovations\Optical Scroll\mouse32a.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\SYSTEM32\ctfmon.exe C:\Program Files\Creative\ShareDLL\Mediadet.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\WINDOWS\SYSTEM32\svchost.exe C:\WINDOWS\SYSTEM32\WudfHost.exe C:\WINDOWS\SYSTEM32\wbem\wmiprvse.exe C:\Documents and Settings\Chew Family\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\REAL\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NAVShExt.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NAVShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb04.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Optical Scroll\mouse32a.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\NPJPI150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\NPJPI150_05.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.sbcglobal.net (HKCU) O15 - Trusted Zone: http://sbcglobal.net (HKCU) O15 - Trusted Zone: https://sbcglobal.net (HKCU) O15 - Trusted Zone: *.yahoo.com (HKCU) O15 - Trusted Zone: http://yahoo.com (HKCU) O15 - Trusted Zone: https://yahoo.com (HKCU) O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () - http://download.av.aol.com/molbin/sh...3/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} () - http://download.av.aol.com/molbin/sh...20/mcgdmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{0B1872CB-CA7C-4FCB-98C6-15FA8B88C1E8}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{203BC1B8-C77B-4259-9BBA-82C57DF8A014}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{39E86191-05A0-4EB7-8D83-EB5E4E608351}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{59C6CDB8-10FB-48D3-85AA-E9007E5EE9E6}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{72371A32-193F-479E-B7DD-15EF7B3F7870}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\SYSTEM32\msvidctl.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: ndwiat - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM32\wiascr.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\acsd.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NAVAPSVC.EXE O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\Speed Disk\NOPDB.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O24 - Desktop Component 1: Internet Explorer Channel Bar - 131A6951-7F78-11D0-A979-00C04FD705A2 -- End of file - 13209 bytes -- File Associations ----------------------------------------------------------- .bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153 .com - comfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,2 .hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23 .ini - inifile - DefaultIcon - shell32.dll,-151 .js - jsfile - DefaultIcon - c:\Corel\Suite8\Programs\CCWin\Cscape.exe ,1 .js - jsfile - shell\open\command - c:\Corel\Suite8\Programs\CCWin\Cscape.exe .reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1 .txt - txtfile - DefaultIcon - shell32.dll,-152 .vbs - VBSFile - DefaultIcon - unable to read value -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- S3 SDdriver - c:\windows\system32\drivers\sddriver.sys <Not Verified; Symantec Corporation; Norton Speed Disk> S3 SDTHOOK - c:\windows\system32\drivers\sdthook.sys <Not Verified; Panda Software; Panda® Antivirus> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-02-10 14:09:44 368 --a------ C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job 2008-02-10 02:00:54 500 --a------ C:\WINDOWS\Tasks\Maintenance-Defragment programs.job 2008-02-10 01:00:02 538 --a------ C:\WINDOWS\Tasks\Maintenance-Disk cleanup.job 2008-02-10 00:00:02 320 --a------ C:\WINDOWS\Tasks\Symantec Drmc.job 2008-02-08 20:58:06 560 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Chew Family.job 2008-02-06 23:00:02 502 --a------ C:\WINDOWS\Tasks\Tune-up Application Start.job 2008-02-04 13:10:40 304 --a------ C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job -- Files created between 2008-01-10 and 2008-02-10 ----------------------------- 2008-02-10 16:24:19 0 d-------- C:\ie-spyad_zo 2008-02-10 16:17:02 0 d-------- C:\Program Files\SpywareBlaster 2008-01-30 22:04:59 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus> 2008-01-30 21:46:26 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-01-24 21:01:46 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-01-24 20:37:34 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Mozilla 2008-01-22 21:56:48 0 d-------- C:\Program Files\SymNetDrv 2008-01-22 21:39:27 4608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys <Not Verified; Symantec Corporation; Symantec Core Component> 2008-01-22 21:39:14 0 d-------- C:\Program Files\Norton SystemWorks 2008-01-21 16:37:43 0 d-------- C:\Program Files\Windows Media Connect 2 2008-01-21 16:35:39 0 d-------- C:\WINDOWS\system32\LogFiles 2008-01-21 16:35:39 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-01-14 21:09:16 0 d-------- C:\Documents and Settings\maria mills\Application Data 2008-01-14 21:09:16 0 d-------- C:\Documents and Settings\maria mills\Application Data\Symantec 2008-01-14 21:09:03 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Symantec 2008-01-10 08:49:02 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Help -- Find3M Report --------------------------------------------------------------- 2008-01-06 19:31:50 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-03 09:55:46 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Snapfish 2007-11-26 08:00:46 102262 --a------ C:\WINDOWS\hpoins05.dat 2007-11-23 21:28:58 3424 --a------ C:\WINDOWS\mozver.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SystemTray"="SysTray.Exe" [08/23/2001 12:00 PM C:\WINDOWS\SYSTEM32\systray.exe] "HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb04.exe" [10/22/2001 04:01 PM] "LoadQM"="loadqm.exe" [05/03/2000 05:23 PM C:\WINDOWS\LOADQM.EXE] "Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [08/30/1999 01:55 AM] "LoadPowerProfile"="powrprof.dll" [08/03/2004 11:56 PM C:\WINDOWS\SYSTEM32\powrprof.dll] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [08/31/2005 06:36 PM] "FLMOFFICE4DMOUSE"="C:\Program Files\Micro Innovations\Optical Scroll\mouse32a.exe" [02/22/2007 01:25 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/23/2007 09:27 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/17/2008 11:42 AM] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [01/22/2008 09:56 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [11/14/2007 02:33 PM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 08:24 AM] "Norton SystemWorks"="C:\Program Files\Norton SystemWorks\cfgwiz.exe" [09/09/2004 06:12 PM] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2/13/2004 2:12:08 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 12:05:56 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "Btn_Back"=0 (0x0) "Btn_Forward"=0 (0x0) "Btn_Stop"=0 (0x0) "Btn_Refresh"=0 (0x0) "Btn_Home"=0 (0x0) "Btn_Search"=0 (0x0) "Btn_History"=0 (0x0) "Btn_Favorites"=0 (0x0) "Btn_Folders"=0 (0x0) "Btn_Fullscreen"=0 (0x0) "Btn_Tools"=0 (0x0) "Btn_MailNews"=0 (0x0) "Btn_Size"=0 (0x0) "Btn_Print"=0 (0x0) "Btn_Edit"=0 (0x0) "Btn_Discussions"=0 (0x0) "Btn_Cut"=0 (0x0) "Btn_Copy"=0 (0x0) "Btn_Paste"=0 (0x0) "Btn_Encoding"=0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "Btn_Back"=0 (0x0) "Btn_Forward"=0 (0x0) "Btn_Stop"=0 (0x0) "Btn_Refresh"=0 (0x0) "Btn_Home"=0 (0x0) "Btn_Search"=0 (0x0) "Btn_History"=0 (0x0) "Btn_Favorites"=0 (0x0) "Btn_Folders"=0 (0x0) "Btn_Fullscreen"=0 (0x0) "Btn_Tools"=0 (0x0) "Btn_MailNews"=0 (0x0) "Btn_Size"=0 (0x0) "Btn_Print"=0 (0x0) "Btn_Edit"=0 (0x0) "Btn_Discussions"=0 (0x0) "Btn_Cut"=0 (0x0) "Btn_Copy"=0 (0x0) "Btn_Paste"=0 (0x0) "Btn_Encoding"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="kdgxt.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4YN36J72QZSAZ5] C:\WINDOWS\System32\YjuIP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E8GeN] C:\docume~1\mariam~1\locals~1\temp\E8GeN.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egkje] C:\documents and settings\maria mills\local settings\temp\egkje.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\PROGRA~1\WHENUS~1\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WZCSVC"=2 (0x2) "WmdmPmSp"=2 (0x2) "UPS"=3 (0x3) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "Versato"=C:\Program Files\MediaKey\Versato.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "SchedulingAgent"=mstask.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5be4be42-f327-11d6-9198-806d6172696f}] AutoRun\command- D:\NCDSTART.EXE *Newly Created Service* - WUDFPF *Newly Created Service* - WUDFSVC [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] rundll32.exeadvpack.dll [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl -- End of Deckard's System Scanner: finished at 2008-02-10 16:41:50 ------------ Last edited by tetonbob; 02-11-2008 at 10:58 AM. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-10-2008, 07:40 PM
|
#2 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Hi and welcome to TSF.
I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please be patient with me during this time.
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
|
|
|
|
|
02-12-2008, 03:50 AM
|
#3 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Hello and welcome to TSF
You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply. To do this click Thread Tools (above the first post), then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions as this webpage would not be available when you're carrying out the fix. Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your system is clean. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- The fixes we will use are specific to your problems and should only be used for this issue on this machine. Please only use this topic to reply to. Do not start another thread. If any other issues arise let me know. The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end! Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more likely additional infections will result. ---------------------------------------- Did you install a custom theme for your Windows XP? Please tell me in your next reply. --------------------------------------------------------------- While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
--------------------------------------------------------------- Please download HijackThis 2.0 to your desktop. Alternate link Make sure you close down EVERY open window and close ALL browser windows. The only thing that should be open is the HijackThis program. Double-click on the file you just downloaded. Click on the "Install" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) Please remember to close all other windows, including browsers then click Fix checked. --------------------------------------------------------------- Please download FixWareout from one of these sites: http://downloads.subratam.org/Fixwareout.exe http://www.bleepingcomputer.com/lonny/Fixwareout.exe Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal. Once the desktop loads please post the text that will open (report.txt) in your next reply. ---------------------------------------------------------------
--------------------------------------------------------------- Please post the following logs in your next reply...
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
Last edited by Angelfire777; 02-13-2008 at 03:21 AM. |
|
|
|
|
02-14-2008, 09:05 PM
|
#4 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 6
OS: WIN XP
|
Re: zlob.dnschanger.rtk virus
I hope I did everthing correctly. Was I supposed to close the Hijackthis window when I ran the fixwareout program? Also, the 09 - Extra button: Real. com -{CD67....} did have a file associated with it. I checked the button anyway. I certainly appreciate all your help. Let me know what the next step is. As far as I know, there is no theme associated with this computer. This was given to me by a friend.
Thank you, Kyle Username "Chew Family" - 02/14/2008 19:50:12 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check Successfully flushed the DNS Resolver Cache. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "system"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SystemTray"="SysTray.Exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\SYSTEM32\\hpztsb04.exe" "LoadQM"="loadqm.exe" "Disc Detector"="C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "FLMOFFICE4DMOUSE"="C:\\Program Files\\Micro Innovations\\Optical Scroll\\mouse32a.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Norton SystemWorks"="\"C:\\Program Files\\Norton SystemWorks\\cfgwiz.exe\" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~ Deckard's System Scanner v20071014.68 Run by Chew Family on 2008-02-14 19:58:11 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Chew Family.exe) ----------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:58:22 PM, on 2/14/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\Micro Innovations\Optical Scroll\mouse32a.exe C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Documents and Settings\Chew Family\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Chew Family.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\hpztsb04.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Optical Scroll\mouse32a.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.sbcglobal.net O15 - Trusted Zone: http://*.sbcglobal.net O16 - DPF: Go2CallClient - http://www.go2call.com/cashDialer/CallClient.cab O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/sh...3/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/sh...20/mcgdmgr.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0B1872CB-CA7C-4FCB-98C6-15FA8B88C1E8}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{203BC1B8-C77B-4259-9BBA-82C57DF8A014}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{39E86191-05A0-4EB7-8D83-EB5E4E608351}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{59C6CDB8-10FB-48D3-85AA-E9007E5EE9E6}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{72371A32-193F-479E-B7DD-15EF7B3F7870}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\..\{0B1872CB-CA7C-4FCB-98C6-15FA8B88C1E8}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 11383 bytes -- Files created between 2008-01-14 and 2008-02-14 ----------------------------- 2008-02-14 19:28:37 0 d-------- C:\Program Files\Trend Micro 2008-02-10 16:24:19 0 d-------- C:\ie-spyad_zo 2008-02-10 16:17:02 0 d-------- C:\Program Files\SpywareBlaster 2008-01-30 22:04:59 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus> 2008-01-30 21:46:26 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-01-24 21:01:46 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-01-24 20:37:34 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Mozilla 2008-01-22 21:56:48 0 d-------- C:\Program Files\SymNetDrv 2008-01-22 21:39:27 4608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys <Not Verified; Symantec Corporation; Symantec Core Component> 2008-01-22 21:39:14 0 d-------- C:\Program Files\Norton SystemWorks 2008-01-21 16:37:43 0 d-------- C:\Program Files\Windows Media Connect 2 2008-01-21 16:35:39 0 d-------- C:\WINDOWS\system32\LogFiles 2008-01-21 16:35:39 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-01-14 21:09:16 0 d-------- C:\Documents and Settings\maria mills\Application Data 2008-01-14 21:09:16 0 d-------- C:\Documents and Settings\maria mills\Application Data\Symantec 2008-01-14 21:09:03 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Symantec -- Find3M Report --------------------------------------------------------------- 2008-01-10 08:49:04 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Help 2008-01-06 19:31:50 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-03 09:55:46 0 d-------- C:\Documents and Settings\Chew Family\Application Data\Snapfish 2007-11-26 08:00:46 102262 --a------ C:\WINDOWS\hpoins05.dat 2007-11-23 21:28:58 3424 --a------ C:\WINDOWS\mozver.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SystemTray"="SysTray.Exe" [08/23/2001 12:00 PM C:\WINDOWS\SYSTEM32\systray.exe] "HPDJ Taskbar Utility"="C:\WINDOWS\SYSTEM32\hpztsb04.exe" [10/22/2001 04:01 PM] "LoadQM"="loadqm.exe" [05/03/2000 05:23 PM C:\WINDOWS\LOADQM.EXE] "Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [08/30/1999 01:55 AM] "LoadPowerProfile"="powrprof.dll" [08/03/2004 11:56 PM C:\WINDOWS\SYSTEM32\powrprof.dll] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [08/31/2005 06:36 PM] "FLMOFFICE4DMOUSE"="C:\Program Files\Micro Innovations\Optical Scroll\mouse32a.exe" [02/22/2007 01:25 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/23/2007 09:27 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/17/2008 11:42 AM] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [01/22/2008 09:56 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [11/14/2007 02:33 PM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 08:24 AM] "Norton SystemWorks"="C:\Program Files\Norton SystemWorks\cfgwiz.exe" [09/09/2004 06:12 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2/13/2004 2:12:08 PM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 12:05:56 PM] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "Btn_Back"=0 (0x0) "Btn_Forward"=0 (0x0) "Btn_Stop"=0 (0x0) "Btn_Refresh"=0 (0x0) "Btn_Home"=0 (0x0) "Btn_Search"=0 (0x0) "Btn_History"=0 (0x0) "Btn_Favorites"=0 (0x0) "Btn_Folders"=0 (0x0) "Btn_Fullscreen"=0 (0x0) "Btn_Tools"=0 (0x0) "Btn_MailNews"=0 (0x0) "Btn_Size"=0 (0x0) "Btn_Print"=0 (0x0) "Btn_Edit"=0 (0x0) "Btn_Discussions"=0 (0x0) "Btn_Cut"=0 (0x0) "Btn_Copy"=0 (0x0) "Btn_Paste"=0 (0x0) "Btn_Encoding"=0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "Btn_Back"=0 (0x0) "Btn_Forward"=0 (0x0) "Btn_Stop"=0 (0x0) "Btn_Refresh"=0 (0x0) "Btn_Home"=0 (0x0) "Btn_Search"=0 (0x0) "Btn_History"=0 (0x0) "Btn_Favorites"=0 (0x0) "Btn_Folders"=0 (0x0) "Btn_Fullscreen"=0 (0x0) "Btn_Tools"=0 (0x0) "Btn_MailNews"=0 (0x0) "Btn_Size"=0 (0x0) "Btn_Print"=0 (0x0) "Btn_Edit"=0 (0x0) "Btn_Discussions"=0 (0x0) "Btn_Cut"=0 (0x0) "Btn_Copy"=0 (0x0) "Btn_Paste"=0 (0x0) "Btn_Encoding"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4YN36J72QZSAZ5] C:\WINDOWS\System32\YjuIP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E8GeN] C:\docume~1\mariam~1\locals~1\temp\E8GeN.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egkje] C:\documents and settings\maria mills\local settings\temp\egkje.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\PROGRA~1\WHENUS~1\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WZCSVC"=2 (0x2) "WmdmPmSp"=2 (0x2) "UPS"=3 (0x3) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "Versato"=C:\Program Files\MediaKey\Versato.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "SchedulingAgent"=mstask.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] rundll32.exeadvpack.dll [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl -- End of Deckard's System Scanner: finished at 2008-02-14 19:59:03 ------------ Last edited by tetonbob; 02-15-2008 at 06:17 AM. |
|
|
|
|
02-16-2008, 04:08 AM
|
#5 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Hi kchew,
Well done. It would be advised to close everything else whilst running malware removal tools to prevent user distraction and disruption for the tools themselves. -------------------------------------------------------- I see that you are using an outdated version of Firefox. We would like you to update it to the latest version which is 2.0.0.12 as numerous security patches and enhancements have been made for the new version. Malware writers tend to exploit outdated version of softwares. Please look at this link --> http://www.netsquirrel.com/articles/update_firefox.html It should give you a better idea on how to update your firefox to the latest version. A restart of your Firefox browser is needed to complete the upgrade. -------------------------------------------------------- P2P - I see you have P2P softwares (Limewire and WinMX) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. -------------------------------------------------------- Now, click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "%userprofile%\desktop\dss.exe" /daft
-------------------------------------------------------- Open notepad and copy the text in the codebox below and then paste into notepad: (don't forget to copy and paste REGEDIT4) Code:
REGEDIT4 [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4YN36J72QZSAZ5] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E8GeN] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egkje] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] It should look like this:  Double click on fix.reg & allow it to merge into the registry. -------------------------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) SpyBot Search and Destroy has a built-in plugin that replaces unwanted or rogue DNS with the DNS of OpenDNS. It is a precautionary measure taken by SpyBot in order to prevent the user from being redirected to unwanted sites by the unlegitimate DNS. *This step is optional* -- If you think that you do not want to use OpenDNS, please fix the following entries as well. More information on OpenDNS in their main site (http://www.opendns.com/) or here -> http://en.wikipedia.org/wiki/OpenDNS O17 - HKLM\System\CCS\Services\Tcpip\..\{0B1872CB-CA7C-4FCB-98C6-15FA8B88C1E8}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{203BC1B8-C77B-4259-9BBA-82C57DF8A014}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{39E86191-05A0-4EB7-8D83-EB5E4E608351}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{59C6CDB8-10FB-48D3-85AA-E9007E5EE9E6}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{72371A32-193F-479E-B7DD-15EF7B3F7870}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\..\{0B1872CB-CA7C-4FCB-98C6-15FA8B88C1E8}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 Please remember to close all other windows, including browsers then click Fix checked. -------------------------------------------------------- Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the Accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%. --------------------------------------------------------
-------------------------------------------------------- Please post the following logs in your next reply...
--------------------------------------------------------
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
|
|
|
|
|
02-18-2008, 06:41 AM
|
#7 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Hi,
Well done! Please navigate to the following two dlls and delete them. (Let me know if you fail to delete any) C:\Program Files\MSN Messenger\riched20.dll C:\Program Files\MSN Messenger\msimg32.dll Please post a fresh HJT log in your next reply. How is your system behaving now?
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
|
|
|
|
|
02-19-2008, 12:01 AM
|
#8 (permalink) |
|
Registered User
Join Date: Feb 2008
Posts: 6
OS: WIN XP
|
Re: zlob.dnschanger.rtk virus
I found the two dll files and deleted them. The computer seems to be working okay so far, although I haven't tried to do too much searching yet. Thanks so much for the help!
Kyle |
|
|
|
|
02-20-2008, 02:17 AM
|
#9 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Hi,
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
--------------------------------------------------------------------- Everything looks great --- your HijackThis log appears to be clean. :) --------------------------------------------------------------------- C:\System Volume Information\ is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, uninstalling ComboFix will reset/clear the cache in a little while. --------------------------------------------------------------------- Start > Run - type ComboFix /u and press enter. Combofix will auto uninstall now. --------------------------------------------------------------------- Please take some time reading this list; it is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.
Please respond to this thread one more time so we can mark this thread as resolved.
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
|
|
|
|
|
02-26-2008, 06:16 AM
|
#11 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Hi,
My apologies, kchew. We can reset System Restore and Hidden files with these simple steps: ------------------------------------------------- CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder) Go to Start >> Run - type control sysdm.cpl,,4 & press Enter
This will flush out previous restore points (which contain the infections) and create a new restore point. -------------------------------------------------
------------------------------------------------- Please respond to this thread one more time so we can mark this thread as resolved.
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
|
|
|
|
|
02-27-2008, 09:44 PM
|
#13 (permalink) |
|
TSF Enthusiast
|
Re: zlob.dnschanger.rtk virus
Yes please. Have a safe computing day.
__________________
If You Feel That We've Helped You, Please Donate To The Forum `世上无难事,只怕有心人` e X P e r i 3 n c 3 -- AleX `玉不琢不成器` "It's not because things are difficult that we dare not, it's because we dare not that things are difficult" <- Makes a huge diff
|
|
|
|
| Thread Tools | |
|
|
