Search:

Thanks for the fix Blade81 :bigthumb:

TPM

Blade81,

Thanks! the machine is running well and without popups. I ran OTMoveIT2. Just wondering if you reply was a form letter as W2K does not have a System Restore tab, thats XP32. Also,...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:27 AM, on 2/11/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
...

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, February 10, 2008 8:23:33 PM
Operating System: Microsoft Windows 2000...

I think running combofix in safe mode did the trick. :laugh:

Spybot shows it to be clean. I will run a Kaspersky check.

What directories and files do I need to clean up from these programs? I...

Since C: is a FAT32 disk, what would happen if I booted off a W98 boot floppy and tried to delete those 2 files? They would not have loaded in that environment would they have?

TPM

ComboFix 08-02.05.3 - Administrator 02/10/2008 10:09:45.7 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.824 [GMT -5:00]
Running from: C:\Documents and...

IAT C:\WINNT\Explorer.EXE[1420] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryA] [732E7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft...

Here you are:

GMER 1.0.14.14116 - http://www.gmer.net
Rootkit scan 2008-02-10 09:41:28
Windows 5.0.2195 Service Pack 4


---- System - GMER 1.0.14 ----

SSDT ...

Copied msconfig over from a XP box.

Here is ntbtlog:

Service Pack 4 2 10 2008 08:43:09.484
Loaded driver \WINNT\System32\ntoskrnl.exe
Loaded driver \WINNT\System32\hal.dll
Loaded driver...

We seem to have been typing at the same time. This is a W2K box, no MSCONFIG, AFAIK?

-TPM

Do you need new logfiles of anything other than combofix?

Thanks!

TPM

Did not delete 2 files and now I have popups :(

ComboFix 08-02.05.3 - Administrator 02/09/2008 17:15:52.4 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.778 [GMT -5:00]...

I would prefer my problems being fixed, of course. Many other forums change your name from things like "Junior Member" to "Donating Member" or "Supporting Member" when you become monetarily...

Shouldn't people who have donated get a special tagline or glowing star above their username? :bigthumb:

TPM

ComboFix 08-02.05.3 - Administrator 02/06/2008 14:35:42.1 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.786 [GMT -5:00]
Running from: C:\Documents and...

here is my Kapersy log.

Thanks!

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, February 05, 2008 5:42:15 PM
...

Spybot cannot get rid of Smitfraud or Virtumond and Kapersky is finding Virii that Avast! misses.

Logs are below and attached. Thanks!

TPM

Logfile of Trend Micro HijackThis v2.0.2
Scan...

THis cleaned out ~2000 things, but not the one I was looking to get ride of. Oh well, its going back to them. I thinks its clean and she will probably just fill it up again just to spite me...

Will do! Thansk! again!

Yeah, I tried del it with regedit, but it cannot be deleted or renamed. Thought maybe this was common and there was another way to kill it.

Thanks!

Nope, Spybot still shows this: :(

Huntbar: Uninstall settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinTools


--- Spybot -...

Not you are not blind, I put Avast on it for her, but had not started it yet. I wanted you to see a clean hijack log before adding stuff to the process list. I am only doing this once for them, so...

:laugh: :laugh: I know how to unistall progs, I did not realize that was a "real" virus program, thought it was a spoof. It was never installed completely, so did not show in any of the normal...

Phil, thanks for the help. Was OOT for a few days, will finish up and get back to you.

TPM

Thanks! when installing the .inf file "windows cannot find grpconv" and everytime I right click, I get an install window saying "installing Defender Pro Anti Virus"?

E2TakeOut v1.01...

#Trend Micro HouseCall - Storage of detected incidents
#Sat Jul 22 16:05:48 GMT-06:00 2006
scanned.pattern.type=malware,grayware,system.grayware,vulnerability.software...

Trying to fix a friends wife's computer. Started with over 3000 spybot entrys.:sick:

Here are the Hijack log The Virus log is in the next post. Please help, I've followed the To Do list on the...