User Tag List

Am I infected?

This is a discussion on Am I infected? within the Resolved HJT Threads forums, part of the Tech Support Forum category. I've had a few mishaps with spyware, malware, and viruses in the past few days, and I'm not sure if


 
 
Thread Tools Search this Thread
Old 04-23-2006, 11:50 AM   #1
Guest
 
Join Date: Apr 2006
Posts: 6
OS:



I've had a few mishaps with spyware, malware, and viruses in the past few days, and I'm not sure if I've gotten rid of them...

I have Norton Antivirus, Kerio Personal Firewall, Ad-Aware, Hijackthis, and Moveonbot.

Hijackthis Log:

Logfile of HijackThis v1.99.1
Scan saved at 2:48:52 PM, on 23/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\sesinetd.exe
C:\WINDOWS\system32\hserver.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\mousepad13.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Downloadz\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://global.acer.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard13.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad13.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname13.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - https://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - https://update.microsoft.com/microsof...?1132700249250
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - https://messenger.zone.msn.com/binary...t.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: winjjq32 - C:\WINDOWS\SYSTEM32\winjjq32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Houdini License Server (HoudiniLicenseServer) - Side Effects Software Inc. - C:\WINDOWS\system32\sesinetd.exe
O23 - Service: Houdini License Client (HoudiniServer) - Side Effects Software Inc. - C:\WINDOWS\system32\hserver.exe
I deleted this program a while ago, but it won't go away from this list, even if I try to delete it
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

If someone could tell me whether I'm crawling with malware that'd be great!

Thanks!!!
Jame$ is offline  
Sponsored Links
Advertisement
 
Old 04-23-2006, 01:09 PM   #2
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi Jame$ and welcome to TSF.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.


Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below.


If there is anything you don't understand, please ask BEFORE proceeding with the fixes.



Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.



Download Ewido Anti-Malware
  • Install Ewido Anti-Malware
  • When installing, under "Additional Options" uncheck..
    • Install background guard
    • Install scan via context menu
  • Double-click the icon on Desktop to launch Ewido

You will need to update Ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
When you have finished updating, EXIT Ewido.



Download and unzip BFUzip from https://www.merijn.org/files/bfu.zip
Run the program and click the Web button as shown here:


Use this URL to copy into the address bar of the Download script window:
https://metallica.geekstogo.com/alcanshorty.bfu
  • Execute the script by clicking the Execute button.
  • When it finishes running, click the Save button for a copy of the log
  • Post the log created by the script when you have completed the fix

If you have any questions about the use of BFU please read here:
https://metallica.geekstogo.com/BFUinstructions.html




Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
Uncheck the following :
  • Scan local drives for temporary files
Click OK, Press the CleanUp! button to start the program and reboot when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.



Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.



Services
Click Start->Run - type SERVICES.MSC & then click on the OK button
  • Locate the service - HoudiniLicenseServer
  • Double-click on it to open the Properties dialog.
  • Stop the service by using the Stop button.
  • Change the Startup type to Disabled & then click on the OK button
  • Then start HiJackThis & go to Config>Misc.Tools...> Delete an NT service...
  • In the popup box that appears, type in HoudiniLicenseServer, & then click on the OK button
.


Click Start->Run - type SERVICES.MSC & then click on the OK button
  • Locate the service - HoudiniServer
  • Double-click on it to open the Properties dialog.
  • Stop the service by using the Stop button.
  • Change the Startup type to Disabled & then click on the OK button
  • Then start HiJackThis & go to Config>Misc.Tools...> Delete an NT service...
  • In the popup box that appears, type in HoudiniServer, & then click on the OK button
.



HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard13.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad13.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname13.exe
O4 - Startup: PowerReg Scheduler V3.exe
O20 - Winlogon Notify: winjjq32 - C:\WINDOWS\SYSTEM32\winjjq32.dll
O23 - Service: Houdini License Server (HoudiniLicenseServer) - Side Effects Software Inc. - C:\WINDOWS\system32\sesinetd.exe
O23 - Service: Houdini License Client (HoudiniServer) - Side Effects Software Inc. - C:\WINDOWS\system32\hserver.exe


Please remember to close all other windows, including browsers then click Fix checked.



File Deletions
Delete the following Files indicated in RED if they still exist.

C:\WINDOWS\SYSTEM32\winjjq32.dll
C:\WINDOWS\system32\sesinetd.exe
C:\WINDOWS\system32\hserver.exe



Run Ewido
Run Ewido with it's updated definitions (...it's important that all windows must be closed)
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with Ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If Ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
  • When the scan is finished, click the Save Report button at the bottom of the screen.
  • Save the report to your desktop
Close Ewido

NOTE: Ewido scan will require at least an hour.



Reboot
Reboot your system in Normal Mode.



Online Scan

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner.

1. Click Check Now and a "pop up" window will appear. *Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on See report then click Save report

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan




Logs required
BFU log
Ewido Log
Panda Log
HijackThis Log


Please also let me know how your system is performing now and if you have any specific problems.
Glaswegian is offline  
Old 04-23-2006, 04:24 PM   #3
Guest
 
Join Date: Apr 2006
Posts: 6
OS:


Hi Glaswegian, thanks for you help thus far.

Before you replied I found the viruses keyboard13.exe, mousepad13.exe and newname13.exe on a website for PrevX1. I downloaded the 60-day trial of PrevX1 and got rid of the files (surprisingly since its a trial) as well as 12 other malware (might of been some cookies...)

I then proceeded to follow your directions.

BFU Report:
# For use with Merijn's Brute Force Uninstaller
# available from https://www.merijn.org/
#
# Script Name: alcanshorty.BFU
# Author: Pieter Arntz

OptionStatusOn
OptionSetStatus Stopping processes

ProcessKill MsConfigs.exe|1
ProcessKill p2pnetwork.exe|1
ProcessKill winupdates.exe|1
ProcessKill winupdate.exe|1
ProcessKill winsupdater.exe|1
ProcessKill MsUpdate.exe|1
ProcessKill winlog.exe|1
ProcessKill MsMovies.exe|1
ProcessKill p2pnetworking.exe|1
ProcessKill winlogi.exe|1
ProcessKill MSDATA32.EXE|1
ProcessKill %PROGRAMFILES%\wmplayer\wmplayer.exe|1
ProcessKillIfMD5Match \wmplayer.exe|ce9928d88ad3f914c06e07d185d61968|1
ProcessKill %STARTUP%\wmplayer.exe|1
ProcessKill %ALLUSERSSTARTUP%\wmplayer.exe|1
ProcessKillIfMD5Match \wmplayer.exe|4E092016BFA0441061483ED71C85C98D|1
ProcessKill %PROGRAMFILES%\outlook\outlook.exe|1
ProcessKillIfMD5Match \outlook.exe|B420A430D733A3A1D8B27E71F78590E1|1
ProcessKill \scvhost.exe|1
ProcessKill %ALLUSERSSTARTUP%\svchost.exe|1

ProcessKill \stub_113_*.exe|1
ProcessKill \mousepad*.exe|1
ProcessKill \keyboard*.exe|1
ProcessKill \newname*.exe|1
ProcessKill \services32.exe|1
ProcessKill \winsysban*.exe|1
ProcessKill \netmon.exe|1
ProcessKill \paytime.exe|1
ProcessKill \VCClient.exe|1
ProcessKill \VCMain.exe|1
ProcessKill \newfrn.exe|1
ProcessKill \eee2.exe|1
ProcessKill \SYSC00.exe|1
ProcessKill \CheckS02.exe|1
ProcessKill \errorhandler.exe|1
ProcessKill \EQAdvice.exe|1
ProcessKill \vxgame6.exe|1
ProcessKill \sysvx.exe|1
ProcessKill %SYSDIR%\mssearchnet.exe|1
ProcessKill %SYSDIR%\wintask.exe|1
ProcessKill \tetriz3.exe|1
ProcessKill \tool2.exe|1
ProcessKill *.tmp3584.exe|1
ProcessKill \ac2_00*.exe|1
ProcessKillIfContainsText %SYSDIR%\*.exe|ZStart.lnk|1
ProcessKillIfContainsText %SYSDIR%\*.exe|Z_Start.lnk|1
ProcessKillIfContainsText %SYSDIR%\*.exe|Zeno.lnk|1
ProcessKillIfMD5Match eventwvr.exe|E665EEFEEBEFE3177CA1551E75EFCBBB

OptionUnloadShell
DllUnregister %WINDIR%\DH.dll|1

ServiceStop Network Monitor
ServiceStop cmdService
ServiceDisable Network Monitor
ServiceDisable cmdService
ServiceDelete Network Monitor
ServiceDelete cmdService
ProcessSuspend \command.exe|0

OptionSetStatus Resetting folder attributes
FolderSetAttributes %SYSDIR%|A

OptionSetStatus Cleaning registry
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DNS
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|services32
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{8253D547-38DD-4325-B35A-F1817EDFA5F5}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{8293D547-38DD-4325-B35A-F1817EDFA5FC}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{FFF4E223-7019-4ce7-BE03-D7D3C8CCE884}
RegDeleteKey HKCU\SOFTWARE\Classes\CLSID\{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}
RegDeleteKey HKCU\SOFTWARE\Classes\CLSID\{6368D1FC-6F5C-4f1b-B164-E67214F678E9}
RegDeleteKey HKLM\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}
RegDeleteKey HKLM\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}
RegDeleteKey HKLM\SOFTWARE\Classes\TypeLib\{D4C89C18-B4F3-46A9-8800-E9E7A55AFBD9}
RegDeleteKey HKLM\SOFTWARE\Classes\Shorty.Gopher
RegDeleteKey HKLM\SOFTWARE\Classes\Shorty.Gopher.1
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFF4E223-7019-4ce7-BE03-D7D3C8CCE884}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6001CDF7-6F45-471b-A203-0225615E35A7}
RegDeleteKey HKCU\Software\DNS
RegDeleteKey HKCU\Software\CAS
RegDeleteKey HKLM\SOFTWARE\Classes\SYS
RegDeleteKey HKLM\SOFTWARE\Classes\Main.MimeFilter
RegDeleteKey HKLM\SOFTWARE\Classes\Main.MimeFilter.1
RegDeleteKey HKCU\Software\Microsoft\drsmartload
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Enhanced Ads by Zeno
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zeno Search Assistant
RegDeleteKey HKLM\SOFTWARE\Classes\AppID\Main.DLL
RegDeleteKey HKLM\SOFTWARE\Classes\AppID\{E0DC5CC4-25A5-4BC7-A3AA-3525733DC796}
RegDelValue HKCU\System\CurrentControlSet\Control\Lsa|p2pnetwork
RegDelValue HKLM\System\CurrentControlSet\Control\Lsa|p2pnetwork
RegDelValue HKCU\SOFTWARE\Microsoft\OLE|p2pnetwork
RegDelValue HKLM\SOFTWARE\Microsoft\OLE|p2pnetwork
RegDelValue HKCU\SOFTWARE\Microsoft\OLE|winlog
RegDelValue HKLM\SOFTWARE\Microsoft\OLE|winlog
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations|LowRiskFileTypes
RegSetDwordValue HKLM\System\CurrentControlSet\Control\Lsa|Restrictanonymous|0
RegSetStringValue HKLM\SOFTWARE\Microsoft\OLE|EnableDCOM|Y
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler|{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}
RegDeleteKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensSrv
RegDelValue HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad|SysTray.Exbr

RegDeleteKey HKCU\SOFTWARE\FCHelp
RegDeleteKey HKCU\SOFTWARE\FCAdvice
RegDeleteKey HKCR\TypeLib\{1B8B502E-455B-4022-BE77-FB6D9F808A18}
RegDeleteKey HKCR\TypeLib\{D4C89C18-B4F3-46A9-8800-E9E7A55AFBD9}
RegDeleteKey HKCR\CLSID\{724D478A-2BD0-4DB4-AE42-288B1E346EF7}
RegDeleteKey HKCR\CLSID\{994D478A-45D0-4DB4-AE77-288B1E346E99}
RegDelValueIfContainsText HKCR\PROTOCOLS\Filter\text/html\CLSID|{8253D547-38DD-4325-B35A-F1817EDFA5F5}|0
RegDelValueIfContainsText HKCR\PROTOCOLS\Filter\text/html\CLSID|{994D478A-45D0-4DB4-AE77-288B1E346E99}|0
RegDelValueIfContainsText HKCR\PROTOCOLS\Filter\text/html|(default)|FCEngine|0


OptionSetStatus Deleting Runkeys
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MsConfigs
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|p2pnetwork
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdates
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdate
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winsupdater
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MsUpdate
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ms-update
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MsMovies
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|p2pnetworking
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|virtual-ie
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MS DATABASE
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xp
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|wmplayer
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winlog
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|outlook
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winsysupd
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gimmygames
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winsysban
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|TheMonitor
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gimmysmileys
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|keyboard
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|mousepad
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|newname
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|IpNetwork
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CU1
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CU2
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NewFrn
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BrowserUpdateSched
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Command
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xp_system
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|errorhandler
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|sysvx
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|PayTime
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|q8lg
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WinTask driver
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|expload.exe
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|tetriz3
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Microsoft standard protector
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|rmalt
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|eventwvr
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Keygen

RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|CU1
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|CU2
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|services32
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CU1
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CU2
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|newfrn.exe
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|services32
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xp_system
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|EQAdvice
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows installer
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|tetriz3
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows update loader
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Abrada WIN32
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|eventwvr

RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|p2pnetwork
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|ms-update
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|p2pnetworking
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|virtual-ie
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|MS DATABASE
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|xp
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|winlog
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|wmplayer
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|tetriz3
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|CQ4d6
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|SystemTools
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|eventwvr

RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CQ4d6
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|gjZC2XV
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ula0U
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|System

RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MsConfigs
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|p2pnetwork
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdates
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdate
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MS DATABASE
RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|xp
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|WinMedia
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Shell
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Key
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|CAS Client
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|CAS2

OptionSetStatus Deleting files

OptionPauseBetweenCmds 300

FileDelete %SYSDIR%\p2pnetwork.exe
FileDelete %SYSDIR%\scvhost.exe
FileDelete %SYSDIR%\winlog.exe
FileDelete %SYSDIR%\p2pnetworking.exe
FileDelete %SYSDIR%\winlogi.exe
FileDelete %SYSDIR%\MSDATA32.EXE
FileDelete %SYSDIR%\scvhost.exe
FileDelete %SYSDIR%\mc-*-*.exe
FileDelete %ALLUSERSSTARTUP%\wmplayer.exe
FileDelete %ALLUSERSSTARTUP%\svchost.exe

OptionPauseBetweenCmds 50

FolderDelete %PROGRAMFILES%\MsConfigs
FolderDelete %PROGRAMFILES%\winupdates
FolderDelete %PROGRAMFILES%\winupdate
FolderDelete %PROGRAMFILES%\winsupdater
FolderDelete %PROGRAMFILES%\MsUpdate
FolderDelete %PROGRAMFILES%\MsMovies
FolderDelete %PROGRAMFILES%\wmplayer
FolderDelete %PROGRAMFILES%\outlook

FileDelete %SYSTEMDRIVE%\temp.zip
FileDelete %SYSTEMDRIVE%\x.txt
FileDelete %SYSTEMDRIVE%\z.txt
FileDelete %SYSTEMDRIVE%\z.tmp
FileDelete %SYSTEMDRIVE%\xz.exe
FileDelete %SYSTEMDRIVE%\cmon.exe
FileDelete %SYSTEMDRIVE%\at.exe

FileDelete %PROGRAMFILES%\Common Files\Windows\services32.exe
FileDelete %PROGRAMFILES%\Common Files\services.exe
FileDelete %PROGRAMFILES%\Common Files\mc-*-*.exe
FileDelete %PROGRAMFILES%\Common Files\Windows\mc-*-*.exe
FileDelete %PROGRAMFILES%\Common Files\Download\mc-*-*.exe
FileDelete %MYDOCUMENTS%\mc-*-*.exe
FileDelete %SYSTEMDRIVE%\mc-*-*.exe
FileDelete %WINDIR%\csvhost.exe

FileDelete %PROGRAMFILES%\Common Files\Download\freeprodtb.exe
FileDelete %PROGRAMFILES%\Common Files\system32.dll
FileDelete %PROGRAMFILES%\paytime.exe

FileDelete %WINDIR%\newfrn.exe
FileDelete %WINDIR%\errorhandler.exe
FileDelete %WINDIR%\wallpap.exe
FileDelete %WINDIR%\eee2.exe
FileDelete %WINDIR%\DH.dll_
FileDelete %WINDIR%\DH.dll
FileDelete %WINDIR%\dh.ini
FileDelete %WINDIR%\SYSC00.exe
FileDelete %WINDIR%\SYSC0*.exe
FileDelete %WINDIR%\CheckS00.exe
FileDelete %WINDIR%\CheckS01.exe
FileDelete %WINDIR%\CheckS02.exe
FileDelete %WINDIR%\CheckS0*.exe
FileDelete %WINDIR%\drsmartload*.dat
FileDelete %WINDIR%\sysvx_.exe
FileDelete %WINDIR%\newname.dat
FileDelete %WINDIR%\newname*.dat
FileDelete %WINDIR%\newname.exe
FileDelete %WINDIR%\newname4.exe
FileDelete %WINDIR%\newname5.exe
FileDelete %WINDIR%\newname6.exe
FileDelete %WINDIR%\newname7.exe
FileDelete %WINDIR%\newname8.exe
FileDelete %WINDIR%\newname9.exe
FileDelete %WINDIR%\newname10.exe
FileDelete %WINDIR%\newname11.exe
FileDelete %WINDIR%\newname12.exe
FileDelete %WINDIR%\newname13.exe
FileDelete %WINDIR%\newname*.exe
FileDelete %WINDIR%\keyboard.dat
FileDelete %WINDIR%\keyboard*.dat
FileDelete %WINDIR%\keyboard3.exe
FileDelete %WINDIR%\keyboard4.exe
FileDelete %WINDIR%\keyboard5.exe
FileDelete %WINDIR%\keyboard6.exe
FileDelete %WINDIR%\keyboard7.exe
FileDelete %WINDIR%\keyboard8.exe
FileDelete %WINDIR%\keyboard9.exe
FileDelete %WINDIR%\keyboard10.exe
FileDelete %WINDIR%\keyboard11.exe
FileDelete %WINDIR%\keyboard12.exe
FileDelete %WINDIR%\keyboard13.exe
FileDelete %WINDIR%\keyboard*.exe
FileDelete %WINDIR%\mousepad.dat
FileDelete %WINDIR%\mousepad*.dat
FileDelete %WINDIR%\mousepad3.exe
FileDelete %WINDIR%\mousepad4.exe
FileDelete %WINDIR%\mousepad5.exe
FileDelete %WINDIR%\mousepad6.exe
FileDelete %WINDIR%\mousepad7.exe
FileDelete %WINDIR%\mousepad8.exe
FileDelete %WINDIR%\mousepad9.exe
FileDelete %WINDIR%\mousepad10.exe
FileDelete %WINDIR%\mousepad11.exe
FileDelete %WINDIR%\mousepad12.exe
FileDelete %WINDIR%\mousepad13.exe
FileDelete %WINDIR%\mousepad*.exe
FileDelete %WINDIR%\winsysupd*.exe
FileDelete %WINDIR%\winsysupd*.dat
FileDelete %WINDIR%\winsysban*.exe
FileDelete %WINDIR%\gimmygames.exe
FileDelete %WINDIR%\gimmygames*.exe
FileDelete %WINDIR%\gimmygames.dat
FileDelete %WINDIR%\uninstall_nmon.vbs
FileDelete %WINDIR%\xpupdate.exe
FileDelete %WINDIR%\system.exe

FileDelete %SYSTEMDRIVE%\drsmartload.exe
FileDelete %SYSTEMDRIVE%\drsmartload1.exe
FileDelete %SYSTEMDRIVE%\drsmartload46a.exe
FileDelete %SYSTEMDRIVE%\drsmartload45a.exe
FileDelete %SYSTEMDRIVE%\drsmartload618a.exe
FileDelete %SYSTEMDRIVE%\drsmartload117a.exe
FileDelete %SYSTEMDRIVE%\drsmartload*.exe
FileDelete %SYSTEMDRIVE%\mte3ndi6odoxng.exe
FileDelete %SYSTEMDRIVE%\stub_113_*.exe
FileDelete %SYSTEMDRIVE%\winstall.exe
FileDelete %SYSTEMDRIVE%\Veracruz.exe
FileDelete %SYSTEMDRIVE%\WHCC2.exe
FileDelete %SYSTEMDRIVE%\winsysban.exe
FileDelete %SYSTEMDRIVE%\winsysban1.exe
FileDelete %SYSTEMDRIVE%\winsysban2.exe
FileDelete %SYSTEMDRIVE%\winsysban3.exe
FileDelete %SYSTEMDRIVE%\winsysban4.exe
FileDelete %SYSTEMDRIVE%\winsysban5.exe
FileDelete %SYSTEMDRIVE%\winsysban6.exe
FileDelete %SYSTEMDRIVE%\winsysban7.exe
FileDelete %SYSTEMDRIVE%\winsysban8.exe
FileDelete %SYSTEMDRIVE%\winsysban9.exe
FileDelete %SYSTEMDRIVE%\winsysban10.exe
FileDelete %SYSTEMDRIVE%\winsysban11.exe
FileDelete %SYSTEMDRIVE%\winsysban12.exe
FileDelete %SYSTEMDRIVE%\winsysban*.exe
FileDelete %SYSTEMDRIVE%\winsysupd.exe
FileDelete %SYSTEMDRIVE%\winsysupd1.exe
FileDelete %SYSTEMDRIVE%\winsysupd2.exe
FileDelete %SYSTEMDRIVE%\winsysupd3.exe
FileDelete %SYSTEMDRIVE%\winsysupd4.exe
FileDelete %SYSTEMDRIVE%\winsysupd5.exe
FileDelete %SYSTEMDRIVE%\winsysupd6.exe
FileDelete %SYSTEMDRIVE%\winsysupd7.exe
FileDelete %SYSTEMDRIVE%\winsysupd8.exe
FileDelete %SYSTEMDRIVE%\winsysupd9.exe
FileDelete %SYSTEMDRIVE%\winsysupd10.exe
FileDelete %SYSTEMDRIVE%\winsysupd11.exe
FileDelete %SYSTEMDRIVE%\winsysupd12.exe
FileDelete %SYSTEMDRIVE%\winsysupd*.exe
FileDelete %SYSTEMDRIVE%\enewsletterpro.exe
FileDelete %SYSTEMDRIVE%\gimmygames.exe
FileDelete %SYSTEMDRIVE%\gimmygames1.exe
FileDelete %SYSTEMDRIVE%\gimmygames2.exe
FileDelete %SYSTEMDRIVE%\gimmygames3.exe
FileDelete %SYSTEMDRIVE%\gimmygames4.exe
FileDelete %SYSTEMDRIVE%\gimmygames5.exe
FileDelete %SYSTEMDRIVE%\gimmygames6.exe
FileDelete %SYSTEMDRIVE%\gimmygames7.exe
FileDelete %SYSTEMDRIVE%\gimmygames8.exe
FileDelete %SYSTEMDRIVE%\gimmygames9.exe
FileDelete %SYSTEMDRIVE%\gimmygames10.exe
FileDelete %SYSTEMDRIVE%\gimmygames11.exe
FileDelete %SYSTEMDRIVE%\gimmygames12.exe
FileDelete %SYSTEMDRIVE%\gimmygames*.exe
FileDelete %SYSTEMDRIVE%\gimmysmileys.exe
FileDelete %SYSTEMDRIVE%\gimmysmileys1.exe
FileDelete %SYSTEMDRIVE%\gimmysmileys2.exe
FileDelete %SYSTEMDRIVE%\gimmysmileys*.exe
FileDelete %SYSTEMDRIVE%\myupdates.exe
FileDelete %SYSTEMDRIVE%\keyboard.exe
FileDelete %SYSTEMDRIVE%\keyboard1.exe
FileDelete %SYSTEMDRIVE%\keyboard2.exe
FileDelete %SYSTEMDRIVE%\keyboard3.exe
FileDelete %SYSTEMDRIVE%\keyboard*.exe
FileDelete %SYSTEMDRIVE%\mousepad.exe
FileDelete %SYSTEMDRIVE%\mousepad1.exe
FileDelete %SYSTEMDRIVE%\mousepad2.exe
FileDelete %SYSTEMDRIVE%\mousepad3.exe
FileDelete %SYSTEMDRIVE%\mousepad*.exe
FileDelete %SYSTEMDRIVE%\newname.exe
FileDelete %SYSTEMDRIVE%\newname1.exe
FileDelete %SYSTEMDRIVE%\newname2.exe
FileDelete %SYSTEMDRIVE%\newname3.exe
FileDelete %SYSTEMDRIVE%\newname*.exe
FileDelete %SYSTEMDRIVE%\tool.exe
FileDelete %SYSTEMDRIVE%\tool1.exe
FileDelete %SYSTEMDRIVE%\tool2.exe
FileDelete %SYSTEMDRIVE%\tool3.exe
FileDelete %SYSTEMDRIVE%\tool4.exe
FileDelete %SYSTEMDRIVE%\tool5.exe
FileDelete %SYSTEMDRIVE%\toolbar.exe
FileDelete %SYSTEMDRIVE%\country.exe
FileDelete %SYSTEMDRIVE%\WindowsOS.exe
FileDelete %SYSTEMDRIVE%\kl1.exe
FileDelete %SYSTEMDRIVE%\ms1.exe
FileDelete %SYSTEMDRIVE%\ac2_0010.exe
FileDelete %SYSTEMDRIVE%\ac2_0003.exe
FileDelete %SYSTEMDRIVE%\ac2_00*.exe
FileDelete %SYSTEMDRIVE%\kl02.exe
FileDelete %SYSTEMDRIVE%\sk02.exe
FileDelete %SYSTEMDRIVE%\SnowballWarsInstaller.exe
FileDeleteIfMD5Match %SYSTEMDRIVE%\Installer.exe|242A20BAE9CF9CB816A447150378C02D

FileDelete %PROGRAMFILES%\Network\network.exe
FileDelete %PROGRAMFILES%\Network\ipnetwork.exe

FileDelete %SYSDIR%\winserver.exe
FileDelete %SYSDIR%\winserv.dll
FileDelete %SYSDIR%\winserv32.dll
FileDelete %SYSDIR%\winserv.ini
FileDelete %SYSDIR%\winserv.dat
FileDelete %SYSDIR%\perflibs_.dat
FileDelete %SYSDIR%\abrada.exe
FileDelete %SYSDIR%\abrada*.exe
FileDelete %SYSDIR%\abrada.dat
FileDelete %SYSDIR%\abrada*.dat
FileDelete %SYSDIR%\abrada.ini
FileDelete %SYSDIR%\abrada*.ini
FileDelete %SYSDIR%\abradal.dll
FileDelete %SYSDIR%\abrada*.dll
FileDelete %SYSDIR%\abradaload.dll

FileDelete %SYSDIR%\rjdsrego.exe
FileDelete %SYSDIR%\qwinksap.exe
FileDelete %SYSDIR%\qwinkrag.exe
FileDelete %SYSDIR%\qwinsrag.exe
FileDelete %SYSDIR%\dwdsregt.exe
FileDelete %SYSDIR%\swinmsap.exe
FileDelete %SYSDIR%\ysys*.exe
FileDelete %SYSDIR%\child.dll
FileDelete %SYSDIR%\sysvx.exe
FileDelete %SYSDIR%\comdlg64.dll
FileDelete %SYSDIR%\whitevx.lst
FileDelete %SYSDIR%\paytime.exe
FileDelete %SYSDIR%\vxgame1.exe
FileDelete %SYSDIR%\vxgame2.exe
FileDelete %SYSDIR%\vxgame3.exe
FileDelete %SYSDIR%\vxgame4.exe
FileDelete %SYSDIR%\vxgame6.exe
FileDelete %SYSDIR%\vxgamet1.exe
FileDelete %SYSDIR%\vxgamet2.exe
FileDelete %SYSDIR%\vxgamet3.exe
FileDelete %SYSDIR%\vxgamet4.exe
FileDelete %SYSDIR%\mssearchnet.exe
FileDelete %SYSDIR%\wintask.exe
FileDelete %SYSDIR%\tetriz3.exe
FileDelete %SYSDIR%\ad.html
FileDelete %SYSDIR%\slk8x2peu.exe
FileDelete %SYSDIR%\e6tw76cpw.exe
FileDelete %SYSDIR%\parad.raw.exe
FileDelete %SYSDIR%\SudokuInstaller.exe
FileDelete %SYSDIR%\kernels8.exe
FileDelete %SYSDIR%\bin29a.log


FileDelete %SYSTEMDRIVE%\ZICORN00.exe
FileDelete %SYSTEMDRIVE%\ZICORN001.exe
FileDelete %SYSTEMDRIVE%\ZICORN00*.exe
FileDelete %STARTUP%\wmplayer.exe
FileDelete %STARTUP%\Z_Start.lnk
FileDelete %STARTUP%\Zstart.lnk
FileDelete %STARTUP%\Zeno.lnk
FileDeleteIfContainsText %SYSDIR%\*.exe|ZStart.lnk

FileDelete %PROGRAMFILES%\Common Files\system32.dll
FileDelete %PROGRAMFILES%\Catcher.dll
FileDelete %PROGRAMFILES%\gui.exe
FileDelete %PROGRAMFILES%\cwebpage.dll
FileDelete %PROGRAMFILES%\version.txt
FileDelete %PROGRAMFILES%\x.bmp

FileDelete %DESKTOP%\Free Plasma TV.lnk
FileDelete %DESKTOP%\Weather.lnk
FileDelete %DESKTOP%\Poker Shortcut.lnk
FileDelete %DESKTOP%\chat now.lnk
FileDelete %DESKTOP%\Play Poker Online.lnk

SystemEmptyTempFolder
SystemEmptyInternetCache
FileDelete %SYSDIR%\CMD.COM
FileDelete %SYSDIR%\netstat.com
FileDelete %SYSDIR%\ping.com
FileDelete %SYSDIR%\regedit.com
FileDelete %SYSDIR%\tasklist.com
FileDelete %SYSDIR%\taskkill.com
FileDelete %SYSDIR%\taskmgr.com
FileDelete %SYSDIR%\tracert.com

OptionSetStatus Deleting folders
FolderDelete %PROGRAMFILES%\Maxifiles
FolderDelete %PROGRAMFILES%\DNS
FolderDelete %PROGRAMFILES%\EQAdvice
FolderDelete %PROGRAMFILES%\FCAdvice
FolderDelete %PROGRAMFILES%\Common Files\FreeProd1
FolderDelete %PROGRAMFILES%\Common Files\FreeProd2
FolderDelete %PROGRAMFILES%\Common Files\InetGet
FolderDelete %PROGRAMFILES%\Common Files\InetGet2
FolderDelete %PROGRAMFILES%\InetGet2
FolderDelete %PROGRAMFILES%\Common Files\VCClient
FolderDelete %PROGRAMFILES%\Network Monitor
FolderDelete %WINDIR%\inet20001
FolderDelete %PROGRAMFILES%\Update06
FolderDelete %PROGRAMFILES%\Update03
FolderDelete %PROGRAMFILES%\Update04
FolderDelete %PROGRAMFILES%\Update08
FolderDelete %PROGRAMFILES%\W-Update
FileDelete %PROGRAMFILES%\Updates\Keygen.exe
FileDelete %PROGRAMFILES%\Internet Explorer\keygen.exe
FileDelete %PROGRAMFILES%\Internet Explorer\Setup.exe
FolderDelete %PROGRAMFILES%\Yazzle Sudoku
FolderDelete %ProgramFiles%\Cas
FolderDelete %ProgramFiles%\CasStub
FolderDelete %ProgramFiles%\Cas2Stub
FolderDelete C:\temp

OptionSetStatus Trying heuristics
FolderCreate %SYSTEMDRIVE%\bintheredunthat
FileMove %WINDIR%\win*-*.exe|%SYSTEMDRIVE%\bintheredunthat
FileMoveIfContainsHex %SYSTEMDRIVE%\*.exe|%SYSTEMDRIVE%\bintheredunthat|2E,00,6E,00,6F,00,00,00,08,00,00,00,6E,00,61,00,6D,00,65,00,00,00,00,00,0A,00,00,00,66,00,6F,00
FileMoveIfContainsHex %SYSTEMDRIVE%\*.exe|%SYSTEMDRIVE%\bintheredunthat|2E,00,6E,00,6F,00,00,00,06,00,00,00,6E,00,61,00,6D,00,00,00,0A,00,00,00,65,00,66,00,6F,00
FileMoveIfContainsHex %SYSTEMDRIVE%\*.exe|%SYSTEMDRIVE%\bintheredunthat|2E,00,6E,00,00,00,10,00,00,00,6F,00,6E,00,61,00,6D,00,65,00,66,00,6F,00,72,00,00,00,00,00,10,00
FileMoveIfContainsHex %WINDIR%\*.exe|%SYSTEMDRIVE%\bintheredunthat|53,00,79,00,73,00,4D,00,6F,00,6E,00,2E,00,65,00,78,00,65
FileMoveIfContainsText %SYSTEMDRIVE%\*.exe|%SYSTEMDRIVE%\bintheredunthat|WebBrowser1
FileMoveIfContainsText %SYSTEMDRIVE%\*.exe|%SYSTEMDRIVE%\bintheredunthat|Project1
FileMoveIfContainsText %SYSTEMDRIVE%\*.exe|%SYSTEMDRIVE%\bintheredunthat|NSISu_.exe
FileMoveIfContainsHex %SYSTEMDRIVE%\w*.dll|%SYSTEMDRIVE%\bintheredunthat|61,63,32,2E,64,6C,6C,00,49,31,00,49,32
FileMoveIfContainsHex %SYSDIR%\w*.dll|%SYSTEMDRIVE%\bintheredunthat|61,63,32,2E,64,6C,6C,00,49,31,00,49,32
FileDeleteIfMD5Match %SYSDIR%\eventwvr.exe|E665EEFEEBEFE3177CA1551E75EFCBBB

I then ran HijackThis and checked the entries.
keyboard13.exe, mousepad13.exe and newname13.exe were absent from the list - PrevX1 must of gotten rid of them.
Both houdini items were also missing - I know these were not malware, just pesky pieces of remaining software from something I uninstalled.

Logfile of HijackThis v1.99.1
Scan saved at 6:10:42 PM, on 23/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Downloadz\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - https://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - https://update.microsoft.com/microsof...?1132700249250
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - https://messenger.zone.msn.com/binary...t.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

File Deletions:
I think winjjq32.dll was there, so I deleted it (i'm not sure, it might not of been there) the other two were no where to be found. (for sure.)

I then ran Ewido:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 6:30:52 PM, 23/04/2006
+ Report-Checksum: A4DD840

+ Scan result:

:mozilla.18:C:\Documents and Settings\Jamie\Application Data\Mozilla\Firefox\Profiles\vs8v6c2e.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Jamie\Application Data\Mozilla\Firefox\Profiles\vs8v6c2e.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Jamie\Application Data\Mozilla\Firefox\Profiles\vs8v6c2e.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Jamie\Application Data\Mozilla\Firefox\Profiles\vs8v6c2e.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Jamie\Application Data\Mozilla\Firefox\Profiles\vs8v6c2e.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\System Volume Information\_restore{64C55BAE-0167-4E29-A424-980E0BCA06F2}\RP178\A0035507.exe -> Downloader.VB.abj : Cleaned with backup
C:\System Volume Information\_restore{64C55BAE-0167-4E29-A424-980E0BCA06F2}\RP178\A0035508.exe -> Downloader.VB.aaf : Cleaned with backup


::Report End

And then rebooted in normal mode, Panda ActiveScan found 2 spyware:


Incident Status Location

Adware:adware/dollarrevenue Not disinfected C:\WINDOWS\teller2.chk
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Jamie\Application Data\Mozilla\Firefox\Profiles\vs8v6c2e.default\cookies.txt[]

Firefox has crashed a few times, not responding. This may be because activescan is slowing it down, I am not sure.

Here is PrevX1's log of quarentined files (I have now deleted them)



Thanks for all your help!
Jame$ is offline  
Sponsored Links
Advertisement
 
Old 04-24-2006, 12:03 PM   #4
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Hi again Jame$

Good job. Between PrevX and BFU we’ve wiped out the nasties. Looks like we got rid of the Houdini remnants too.


Clear your Firefox cookies. From the open browser, go to Tools > Options > Privacy > Cookies > Clear


Delete the following Files indicated in RED if they still exist.

C:\WINDOWS\teller2.chk


Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
  • Extended
Scan Options:
  • Scan Archives
  • Scan Mail Bases
Click OK

Now under select a target to scan: Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan


Please post back with the Kaspersky Log and a fresh HijackThis Log (remember to take the log in Normal Mode).

Please also let me know how your system is performing now, including Firefox.
Glaswegian is offline  
Old 04-24-2006, 01:04 PM   #5
Guest
 
Join Date: Apr 2006
Posts: 6
OS:


Running Kaspersky now...

Since I turned off PrevX1 not much has crashed. A few program installs have frozen, but thats probably normal since I was listening to music and doing other stuff at the same time.

Last night I noticed windows had to shut down two un-responding programs when I turned off the computer - sgtray.exe and another one that I cannot recall the name of. It it happens again I'll write it down.

I also had trouble installing a older freeware video editor I found (current versoin costs $$$, but the old version, if you can find it was released free)

Anyways, for the install, I clicked it, it had some loading bars, and then everything disapeared regarding the install. Few minutes later I was looking through the task manager, and saw many of the installs running (I had tried a few more times) I ended them, and a few other unecessary operations, and low and behold the install started. I'm really not sure whether this is from a virus, malware, or just some freak accident with it - I am leaning towards it wasn't a virus that caused the accident, but I'm not sure.

Kasperspy is about 77% done and its found 3 viruses, and 6 infected objects so far... Will it remove them or will that be a further step with another program?

Thanks for all your help - I'll post the logs from HijackThis and Kasperspy when they are done.
Jame$ is offline  
Old 04-24-2006, 01:14 PM   #6
Guest
 
Join Date: Apr 2006
Posts: 6
OS:


-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, April 24, 2006 16:12:15
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 24/04/2006
Kaspersky Anti-Virus database records: 189702
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 65349
Number of viruses found: 3
Number of infected objects: 6
Number of suspicious objects: 0
Duration of the scan process: 3029 sec

Infected Object Name - Virus Name
C:\Program Files\Norton AntiVirus\Quarantine\74E02C4E.exe/data0002 Infected: Trojan-Clicker.Win32.Small.jf
C:\Program Files\Norton AntiVirus\Quarantine\74E02C4E.exe Infected: Trojan-Clicker.Win32.Small.jf
C:\System Volume Information\_restore{64C55BAE-0167-4E29-A424-980E0BCA06F2}\RP178\A0035511.DLL Infected: Trojan.Win32.Agent.qt
D:\System Volume Information\_restore{64C55BAE-0167-4E29-A424-980E0BCA06F2}\RP137\A0026549.exe/stream/data0013 Infected: not-a-virus:AdWare.Win32.DownloadWare.a
D:\System Volume Information\_restore{64C55BAE-0167-4E29-A424-980E0BCA06F2}\RP137\A0026549.exe/stream Infected: not-a-virus:AdWare.Win32.DownloadWare.a
D:\System Volume Information\_restore{64C55BAE-0167-4E29-A424-980E0BCA06F2}\RP137\A0026549.exe Infected: not-a-virus:AdWare.Win32.DownloadWare.a

Scan process completed.

Now two of those are norton quarantines...does that mean they should just be deleted?
Jame$ is offline  
Old 04-24-2006, 01:27 PM   #7
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Jame$

Can you post a fresh HijackThis Log please?
Glaswegian is offline  
Old 04-24-2006, 01:30 PM   #8
Guest
 
Join Date: Apr 2006
Posts: 6
OS:


Sorry about that!

Logfile of HijackThis v1.99.1
Scan saved at 4:29:46 PM, on 24/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.com/downloads/k...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - https://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - https://update.microsoft.com/microsof...?1132700249250
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - https://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
Jame$ is offline  
Old 04-24-2006, 01:40 PM   #9
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Jame$

sgtray.exe is one of those annoying utilities that seems to come bundled with many PCs. It’s just a reminder to backup your files. If you don’t need that reminder, disable it using the method I mentioned in my first post (I wouldn’t actually delete it). The older software may simply not be fully compatible with XP – if you are still having problems with that, you might want to try posting in the XP Forum – plenty of real XP experts there.

I believe Prevx is known as good software, but I’m not aware if it causes any system conflicts – but then, that’s Windows for you.

Clear out Norton's Quarantine folder. If you're unsure on how to do it, you can use Symantec's guide.


Well, your log is clean. Any more problems? If not we’ll just tidy up and I’ll let you go.


Reset Hidden/System Files
To reset your hidden and system files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.


System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



IMPORTANT!!!
Please ensure that Windows is patched against the WMF exploit. This is a dangerous vulnerability that opens the door to multiple infections; and a possible reason you were infected. Visit Window's Update to get the KB912919 patch.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera


Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Sygate Personal Firewall
ZoneAlarm
Tiny Personal Firewall


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are two very good free Antivirus products which are available:
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

How Did I Get Infected In The First Place?
The Anti-Spyware Tutorial.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.
Glaswegian is offline  
Old 04-24-2006, 01:52 PM   #10
Guest
 
Join Date: Apr 2006
Posts: 6
OS:


Great!

So what were those other items kasperspy found?

There was only one norton quarantined virus though... not two...

Thanks for all your help Glasweigan
Jame$ is offline  
Old 04-24-2006, 02:25 PM   #11
Security Manager
Analyst
Rangemaster, TSF Academy
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 39,536
OS: Windows 10 Pro

My System

Quote:
Originally Posted by Jame$
Great!

So what were those other items kasperspy found?

There was only one norton quarantined virus though... not two...

Thanks for all your help Glasweigan
You're welcome.

The other items were held in the System Restore points and would have been deleted when we flushed them. Otherwise you could have restored the malware.
Glaswegian is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 11:21 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts