WildTangent error unable to delete for the past 3 weeks

[rozzie]

Hello everyone, I got a virus thru messenger and my screen went blank, i was able to kind of fix it with help from other forums but there's only one thing i cant get rid of.... on Spybot-search & destroy i got a WildTangent error, 3 files that cannot be fixed, it says it will be fixed on restart but it doesnt... i have runned ATF-Cleaner, Malwarebytes', spywareblaster, and the only problem i have left is wiuth the 3 found items under WildTangent:

(SBI $3A3BDC07) Program directory
C:\WINDOWS\wt\

(SBI $76830867) Progam directory
C:\WINDOWS\wt\wtupdates\

(SBI $AEA200D6) Program directory
C:\WINDOWS\wt\wtupdates\WireControl\


please, this past three weeks they have been horrible, im very tired and exausted, i have read so many pages and run so many things but this 3 items i haven't been able do get rid of them..

thank you very much for your help

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

I am sorry to hear you are having such a tough time with malware, I can relate especially since I spend a lot of volunteer time doing just that. I normally do not post to folks who have not read the directions and posted a HJT log, but I thought I would see if I can help you a little.

1) If you are going to ask for help in the Malware Removal forum, posted above and pinned (sticky)to the top of this forum are instructions that must be folllowed, like this one:
Do NOT run 'FIXES' before helpers have analyzed the HJT log
http://forums.spybot.info/showthread.php?t=16806

2) The items you posted have to do with a new feature in Spybot S&D, you can post your questions for those folks here:
http://forums.spybot.info/forumdisplay.php?f=50
Hopefully they will resolve your issues, but if you do need to return to the Malware Removal forum, please read and follow the directions.

Thanks

[rozzie]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

I am sorry to hear you are having such a tough time with malware, I can relate especially since I spend a lot of volunteer time doing just that. I normally do not post to folks who have not read the directions and posted a HJT log, but I thought I would see if I can help you a little.

1) If you are going to ask for help in the Malware Removal forum, posted above and pinned (sticky)to the top of this forum are instructions that must be folllowed, like this one:
Do NOT run 'FIXES' before helpers have analyzed the HJT log
http://forums.spybot.info/showthread.php?t=16806

2) The items you posted have to do with a new feature in Spybot S&D, you can post your questions for those folks here:
http://forums.spybot.info/forumdisplay.php?f=50
Hopefully they will resolve your issues, but if you do need to return to the Malware Removal forum, please read and follow the directions.

Thanks



Im very sorry, but i was in another forum and i followed some direcctions to make this pc work again, but the only thing that was coming up is those 3 errors but i will read those directions because i am very desperate to make sure this is virus free so i can start making my payments online again... thank you very much for answering me because i check the forum around 7 times a day to see if i have an answer... i will try to calm down and follow ur instrucctions.. thank you

[rozzie]

Hello everyone, I got a virus thru messenger and my screen went blank, i was able to kind of fix it with help from other forums but there's only one thing i cant get rid of.... on Spybot-search & destroy i got a WildTangent error, 3 files that cannot be fixed, it says it will be fixed on restart but it doesnt... i was in another forum and i followed the directions i have runned ATF-Cleaner, Malwarebytes', spywareblaster but when i try to run the kaspersky program, it didnt let me go thru and i was not able to download it. It looks like the pc may be running ok but when i run spybot i get 3 found items under WildTangent:

(SBI $3A3BDC07) Program directory
C:\WINDOWS\wt\

(SBI $76830867) Progam directory
C:\WINDOWS\wt\wtupdates\

(SBI $AEA200D6) Program directory
C:\WINDOWS\wt\wtupdates\WireControl\


please, this past three weeks they have been horrible, im very tired and exausted, i have read so many pages and run so many things but this 3 items i haven't been able do get rid of them..
just in case i will add a hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:05:49 AM, on 9/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\QuickTime\qttask.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AOL 9.1\waol.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://rozzies.spaces.live.com/PhotoUpload/MsnPUpld.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 5412 bytes


thank you very much for your help, sorry if i make a mistake in the way i post this.. im little confuse

[pskelley]

Thanks for the response, I will say when you post here, you set a notification and anytime someone adds to your post you should receive that notification. Often folks will have the email filters set so high that the email from Safer Networking will go to the spam box, so be careful to check there, tell the filter that it is not spam. To be sure your notification is set, look at the top where it says "Thread Tools", drop down that menu and make sure it is set to Subscribed. That being the case, you will be offered the option to "Unsubscribe".

Hope this helps...Phil