Page 1 of 4 1234 LastLast
Results 1 to 10 of 33

Thread: Nasty Bugger won't let me search or look at web pages.

  1. #1
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Red face Nasty Bugger won't let me search or look at web pages.

    Hi Noob Here to this forum. What a great place for Malware removal info. My computer just got infected with some crazy stuff. I had just reinstalled windows on a new hard drive and hadn't yet installed my Zone alarm security suite yet. I went on a trip for three days and when I got back. bam.. IE (and Firefox for that matter) wouldn't search anything. Web sites were redirected, now SPybot S&D 1.6 won't run.. When I try to "Check for Problems" it freezes and an Error message comes up "There is no disk in the drive, Please insert a disk in the drive\Device\Harddisk1\DR2" I went and booted to SAFE mode and STILL the exact same problem. I cannot run Spybot. In advance I really appreciate any help I can get to fix this infection. BTW I DO have Zone Alarm installed now, but it doesn't seem to get rid of this problem. It WILL run but doesn't seem to want to find this bugger. Here is the HJT Log file for review. THANKS!!
    BTW I am running a Anthlon 64 3800 2GHZ RAM

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:21:23 AM, on 7/31/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    G:\WINDOWS\system32\ZoneLabs\vsmon.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    G:\WINDOWS\system32\HPZipm12.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\system32\wscntfy.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    G:\WINDOWS\system32\rundll32.exe
    G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    G:\WINDOWS\system32\Rundll32.exe
    G:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe
    G:\WINDOWS\System32\svchost.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
    G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O4 - HKLM\..\Run: [HP Software Update] G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [000000af] rundll32.exe "G:\WINDOWS\system32\wdbgvmvd.dll",b
    O4 - HKLM\..\Run: [ZoneAlarm Client] "G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LSA Shellu] G:\Documents and Settings\Greg\lsass.exe
    O4 - HKLM\..\Run: [BM03bd692b] Rundll32.exe "G:\WINDOWS\system32\qqyhphao.dll",s
    O4 - HKLM\..\RunOnce: [srePostpone] rundll32.exe g:\windows\system32\zonelabs\srescan.dll,DoSpecialAction
    O4 - HKCU\..\Run: [AWMON] "G:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1214379609671
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
    O23 - Service: HP Status Server - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 4337 bytes

  2. #2
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Default Update

    Ok, I downloaded Free Avira, and it found a Trojan called TR/Vundo.Gen, BDS/VB.BOI, TR/Dldr.Agent.kzt and a few others. I selected Avira to just delete them. Was that correct? My Zone Alarm Security failed to detect this (and I ran Spyware and Anti Virus searches like four times!). Hmmmm SO much for paying for an antivirus program huh? Anyway, the new Avira log and HJT Log is as follows. Thank you very much for any help!!!

    Avira AntiVir Personal
    Report file date: Saturday, August 02, 2008 23:32

    Scanning for 1528705 virus strains and unwanted programs.

    Licensed to: Avira AntiVir PersonalEdition Classic
    Serial number: 0000149996-ADJIE-0001
    Platform: Windows XP
    Windows version: (Service Pack 2) [5.1.2600]
    Boot mode: Normally booted
    Username: SYSTEM
    Computer name: GREGG-87DF4AC81

    Version information:
    BUILD.DAT : 8.1.0.326 16933 Bytes 7/11/2008 12:57:00
    AVSCAN.EXE : 8.1.4.7 315649 Bytes 6/26/2008 16:57:53
    AVSCAN.DLL : 8.1.4.0 40705 Bytes 5/26/2008 15:56:40
    LUKE.DLL : 8.1.4.5 164097 Bytes 6/12/2008 20:44:19
    LUKERES.DLL : 8.1.4.0 12033 Bytes 5/26/2008 15:58:52
    ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 18:33:34
    ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 6/24/2008 21:54:15
    ANTIVIR2.VDF : 7.0.5.174 2027008 Bytes 7/25/2008 05:31:14
    ANTIVIR3.VDF : 7.0.5.205 285696 Bytes 8/1/2008 05:31:15
    Engineversion : 8.1.1.15
    AEVDF.DLL : 8.1.0.5 102772 Bytes 7/9/2008 16:46:50
    AESCRIPT.DLL : 8.1.0.61 311675 Bytes 8/3/2008 05:31:29
    AESCN.DLL : 8.1.0.23 119156 Bytes 8/3/2008 05:31:27
    AERDL.DLL : 8.1.0.20 418165 Bytes 7/9/2008 16:46:50
    AEPACK.DLL : 8.1.2.1 364917 Bytes 8/3/2008 05:31:26
    AEOFFICE.DLL : 8.1.0.21 192891 Bytes 8/3/2008 05:31:24
    AEHEUR.DLL : 8.1.0.44 1343863 Bytes 8/3/2008 05:31:23
    AEHELP.DLL : 8.1.0.15 115063 Bytes 7/9/2008 16:46:50
    AEGEN.DLL : 8.1.0.32 315765 Bytes 8/3/2008 05:31:19
    AEEMU.DLL : 8.1.0.7 430452 Bytes 8/3/2008 05:31:18
    AECORE.DLL : 8.1.1.8 172406 Bytes 8/3/2008 05:31:17
    AEBB.DLL : 8.1.0.1 53617 Bytes 4/24/2008 16:50:42
    AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/9/2008 16:40:05
    AVPREF.DLL : 8.0.2.0 38657 Bytes 5/16/2008 17:28:01
    AVREP.DLL : 8.0.0.2 98344 Bytes 8/3/2008 05:31:16
    AVREG.DLL : 8.0.0.1 33537 Bytes 5/9/2008 19:26:40
    AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 16:29:23
    AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 6/12/2008 20:27:49
    SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/23/2008 01:28:02
    SMTPLIB.DLL : 1.2.0.23 28929 Bytes 6/12/2008 20:49:40
    NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 20:05:10
    RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 6/12/2008 21:48:07
    RCTEXT.DLL : 8.0.52.0 86273 Bytes 6/27/2008 21:34:37

    Configuration settings for the scan:
    Jobname..........................: Complete system scan
    Configuration file...............: g:\program files\avira\antivir personaledition classic\sysscan.avp
    Logging..........................: low
    Primary action...................: interactive
    Secondary action.................: ignore
    Scan master boot sector..........: on
    Scan boot sector.................: on
    Boot sectors.....................: G:,
    Process scan.....................: on
    Scan registry....................: on
    Search for rootkits..............: off
    Scan all files...................: Intelligent file selection
    Scan archives....................: on
    Recursion depth..................: 20
    Smart extensions.................: on
    Macro heuristic..................: on
    File heuristic...................: high

    Start of the scan: Saturday, August 02, 2008 23:32

    The scan of running processes will be started
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'avcenter.exe' - '1' Module(s) have been scanned
    Scan process 'avgnt.exe' - '1' Module(s) have been scanned
    Scan process 'avguard.exe' - '1' Module(s) have been scanned
    Scan process 'sched.exe' - '1' Module(s) have been scanned
    Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
    Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
    Scan process 'firefox.exe' - '1' Module(s) have been scanned
    Scan process 'WINWORD.EXE' - '1' Module(s) have been scanned
    Scan process 'OUTLOOK.EXE' - '1' Module(s) have been scanned
    Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
    Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
    Scan process 'rundll32.exe' - '1' Module(s) have been scanned
    Scan process 'rundll32.exe' - '1' Module(s) have been scanned
    Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
    Scan process 'explorer.exe' - '1' Module(s) have been scanned
    Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
    Scan process 'alg.exe' - '1' Module(s) have been scanned
    Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
    Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'lsass.exe' - '1' Module(s) have been scanned
    Scan process 'services.exe' - '1' Module(s) have been scanned
    Scan process 'winlogon.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'smss.exe' - '1' Module(s) have been scanned
    35 processes with 35 modules were scanned

    Starting master boot sector scan:
    Master boot sector HD0
    [INFO] No virus was found!
    Master boot sector HD1
    [INFO] No virus was found!
    [WARNING] System error [21]: The device is not ready.
    Master boot sector HD2
    [INFO] No virus was found!
    [WARNING] System error [21]: The device is not ready.
    Master boot sector HD3
    [INFO] No virus was found!

    Start scanning boot sectors:
    Boot sector 'G:\'
    [INFO] No virus was found!

    Starting to scan the registry.
    G:\WINDOWS\system32\wdbgvmvd.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!

    The registry was scanned ( '56' files ).


    Starting the file scan:

    Begin scan in 'G:\'
    G:\ARK14.tmp
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [WARNING] The file could not be deleted!
    [NOTE] Attempting to perform action using the ARK lib.
    [NOTE] The file was deleted!
    G:\pagefile.sys
    [WARNING] The file could not be opened!
    G:\Documents and Settings\Greg\Desktop\Data Backup\01134-943934505 06-18 MJG\Program Files\Adobe\Acrobat 7.0\Setup Files\AcroPro\EFG\Data1.cab
    [0] Archive type: CAB (Microsoft)
    --> Print03.html2
    [WARNING] No further files can be extracted from this archive. The archive will be closed
    G:\Documents and Settings\Greg\Local Settings\Application Data\Mozilla\Firefox\Profiles\1n7d796z.default\Cache\387E8C81d01
    [DETECTION] Is the TR/Dldr.FraudLoa.NC Trojan
    [NOTE] The file was deleted!
    G:\Documents and Settings\Tammy\services.exe
    [DETECTION] Is the TR/Dldr.Agent.kzt Trojan
    [NOTE] The file was deleted!
    G:\Documents and Settings\Tammy\Local Settings\Temporary Internet Files\Content.IE5\61AP87I7\trace[2].htm
    [DETECTION] Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
    [NOTE] The file was deleted!
    G:\Documents and Settings\Tammy\Local Settings\Temporary Internet Files\Content.IE5\YBODS16F\kb767887[1]
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP31\A0003561.exe
    [DETECTION] Is the TR/Dldr.VB.fen.4 Trojan
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP31\A0003564.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP31\A0003575.exe
    [DETECTION] Is the TR/Dldr.VB.fen.4 Trojan
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP31\A0003773.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.BOI back-door program
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP31\A0003774.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.BOI back-door program
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP31\A0003775.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.BOI back-door program
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP43\A0009772.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP43\A0009773.inf
    [DETECTION] Contains recognition pattern of the WORM/Autorun.VDJ worm
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP43\A0009774.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\System Volume Information\_restore{FCC29E91-E646-4D03-862C-2FBAEE76CC20}\RP45\A0009777.exe
    [DETECTION] Is the TR/Dldr.Agent.kzt Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\eenostdp.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\eiwave.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\fhkvbu.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\gupcylfq.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\hdkbaura.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\hwnshfvq.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\jkdqvmid.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\jkwgrp.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\liblzd.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\ookpkynp.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\ooxxjngc.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\oygpgl.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\pac.txt
    [DETECTION] Is the TR/Dldr.VB.VPG Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\qjeaplnj.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\qqyhphao.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\rcgwwomd.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\sgaved.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\tqdpubql.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\uqrdqo.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\xrtcmwnn.VIR
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [WARNING] The file could not be deleted!
    [NOTE] Attempting to perform action using the ARK lib.
    [NOTE] The file was deleted!
    G:\WINDOWS\system32\yciwbpjv.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE] The file was deleted!


    End of the scan: Sunday, August 03, 2008 00:22
    Used time: 49:58 Minute(s)

    The scan has been done completely.

    9679 Scanning directories
    488949 Files were scanned
    37 viruses and/or unwanted programs were found
    0 Files were classified as suspicious:
    37 files were deleted
    0 files were repaired
    0 files were moved to quarantine
    0 files were renamed
    1 Files cannot be scanned
    488911 Files not concerned
    2100 Archives were scanned
    6 Warnings
    37 Notes



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:33:04 AM, on 8/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    G:\WINDOWS\system32\HPZipm12.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\system32\wscntfy.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    G:\WINDOWS\System32\svchost.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    G:\WINDOWS\system32\rundll32.exe
    G:\WINDOWS\system32\Rundll32.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
    G:\Program Files\Internet Explorer\IEXPLORE.EXE
    G:\Program Files\Internet Explorer\IEXPLORE.EXE
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    g:\program files\avira\antivir personaledition classic\avcenter.exe
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
    G:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
    G:\Program Files\Internet Explorer\IEXPLORE.EXE
    G:\WINDOWS\system32\notepad.exe
    G:\WINDOWS\system32\notepad.exe
    G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O4 - HKLM\..\Run: [HP Software Update] G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LSA Shellu] G:\Documents and Settings\Greg\lsass.exe
    O4 - HKLM\..\Run: [BM03bd692b] Rundll32.exe "G:\WINDOWS\system32\xrtcmwnn.dll",s
    O4 - HKLM\..\Run: [avgnt] "G:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [AWMON] "G:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1214379609671
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=23100
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - G:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - G:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
    O23 - Service: HP Status Server - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5468 bytes

  3. #3
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Default 3rd update of HJT after Spybot S&D found Virtumonde

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:55:17 AM, on 8/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    G:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    G:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
    G:\WINDOWS\system32\wscntfy.exe
    G:\WINDOWS\System32\svchost.exe
    G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O4 - HKLM\..\Run: [HP Software Update] G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LSA Shellu] G:\Documents and Settings\Greg\lsass.exe
    O4 - HKLM\..\Run: [BM03bd692b] Rundll32.exe "G:\WINDOWS\system32\qqyhphao.dll",s
    O4 - HKLM\..\Run: [000000af] rundll32.exe "G:\WINDOWS\system32\wdbgvmvd.dll",b
    O4 - HKLM\..\RunOnce: [srePostpone] rundll32.exe g:\windows\system32\zonelabs\srescan.dll,DoSpecialAction
    O4 - HKCU\..\Run: [AWMON] "G:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1214379609671
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=23100
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - G:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - G:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
    O23 - Service: HP Status Server - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5066 bytes

  4. #4
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Default Still can't get rid of TR/Vundo.GEN

    Ok, I renamed my HijackThis to iwillforgetthis and ran a new Log. Please if anyone can help I would really appreciate it!!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:01:27 AM, on 8/4/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    G:\WINDOWS\system32\ZoneLabs\vsmon.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    G:\WINDOWS\system32\Ati2evxx.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    G:\Program Files\Bonjour\mDNSResponder.exe
    G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    G:\WINDOWS\system32\wscntfy.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
    G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe
    G:\WINDOWS\System32\svchost.exe
    G:\WINDOWS\system32\HPZipm12.exe
    G:\Program Files\Trend Micro\iwillforgetthis\iwillforgetthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: {9410843c-dfcc-0c28-b5a4-f7fff1de94a2} - {2a49ed1f-ff7f-4a5b-82c0-ccfdc3480149} - G:\WINDOWS\system32\ditlep.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {72549D86-C9BB-444A-A9F3-DE6BBC54DB91} - G:\WINDOWS\system32\qoMghhhH.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {DB036A52-3A88-466B-BD39-05A6D9D9B18A} - G:\WINDOWS\system32\awtqnolI.dll (file missing)
    O4 - HKLM\..\Run: [HP Software Update] G:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LSA Shellu] G:\Documents and Settings\Greg\lsass.exe
    O4 - HKLM\..\Run: [BM03bd692b] Rundll32.exe "G:\WINDOWS\system32\qqyhphao.dll",s
    O4 - HKLM\..\Run: [000000af] rundll32.exe "G:\WINDOWS\system32\wdbgvmvd.dll",b
    O4 - HKLM\..\RunOnce: [srePostpone] rundll32.exe g:\windows\system32\zonelabs\srescan.dll,DoSpecialAction
    O4 - HKCU\..\Run: [AWMON] "G:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - G:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1214379609671
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=23100
    O20 - Winlogon Notify: awtqnolI - awtqnolI.dll (file missing)
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - G:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - G:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - G:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
    O23 - Service: HP Status Server - Hewlett-Packard Company - G:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - G:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 6077 bytes

  5. #5
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Unhappy Bump... Anyone read these? PLEASE HELP!

    Can anyone please help. I can't get rid this trojan. Thank you for your time I really appreciate it. If I am posting in the wrong forum or part of this forum please let me know. Thank you!
    GG

  6. #6
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,956

    Default

    Hello X2FLYA320,

    Apprantly you missed this forum's sticky topics.

    "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)
    Because of the volume of posts to your own topic, helpers would think you were already being assisted as they look for topics with no response.

    We ask for one HJT log, there are four in this thread.


    The Waiting Room: Post here if waiting for help longer than four days

    Regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  7. #7
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Default Ouch!

    Oh man you are right. I read that way too quickly! Sorry about that. I can see how my post would have been overlooked. I thought I was being helpfull with those HJT logs after I ran some antivirus programs. I will post in the older than 4 day section now. Thank you for responding.
    Cheers

    GG

  8. #8
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi X2FLYA320

    We will begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New HijackThis log.


    A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  9. #9
    Junior Member X2FLYA320's Avatar
    Join Date
    Jul 2008
    Location
    Denver
    Posts
    20

    Smile

    Shaba,
    Please don't think I am ignoring you, I am out of town until monday. As soon I get home I will run your fixes! Thank you very much!

    Greg

  10. #10
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Thanks for letting me know
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •