unable to perm remove geeda.dll
- Thread starter westing
- Start date
Few questions:
My pc-cillin icon that usually shows up in my system tray no longer appears? If I open the main console from my startup menu it comes up but when I exit it still does not show up in my system tray and it will not allow me to check for updates?
My subscription ends March 8, is it worth me purchasing it again or using one of the free anti-virus and firewalls recommended?
Also, I removed windows defender b/c I kept getting a error message when I tried to install updates. This happens when there are windows updates as well. The automatic update will download the updates but I have to manually install each one. Is this a result of the vundo virus and should I be able to re-install windows defender and keep it updated? Sorry for all the questions!!! I really appreciate all of your help and time today! I'm in no rush for the answers just when ever you get the chance.
My pc-cillin icon that usually shows up in my system tray no longer appears? If I open the main console from my startup menu it comes up but when I exit it still does not show up in my system tray and it will not allow me to check for updates?
My subscription ends March 8, is it worth me purchasing it again or using one of the free anti-virus and firewalls recommended?
Also, I removed windows defender b/c I kept getting a error message when I tried to install updates. This happens when there are windows updates as well. The automatic update will download the updates but I have to manually install each one. Is this a result of the vundo virus and should I be able to re-install windows defender and keep it updated? Sorry for all the questions!!! I really appreciate all of your help and time today! I'm in no rush for the answers just when ever you get the chance.
ken545
Emeritus-Security Expert
Hello,
pc-cillin is one of the programs that was infected by this trojan, what I would do is completely uninstall it via the Add Remove Programs in the Control Panel. I would also uninstall Trojan Hunter as thats not the best of programs,
If you need a free Anti Virus program, here are a few, just install one , more is overkill and will actually do more harm than good.
You need to enable windows to show all files and folders, instructions
Here
Delete the files in RED
C:\WINDOWS\system32\.htm
C:\WINDOWS\BM2bdc6baa.xml
Download and save RenV to your desktop
Doubleclick RenV.exe.
When finished, it shall produce a new log for you. Post that log in your next reply.
pc-cillin is one of the programs that was infected by this trojan, what I would do is completely uninstall it via the Add Remove Programs in the Control Panel. I would also uninstall Trojan Hunter as thats not the best of programs,
If you need a free Anti Virus program, here are a few, just install one , more is overkill and will actually do more harm than good.
You need to enable windows to show all files and folders, instructions
Here
Delete the files in RED
C:\WINDOWS\system32\.htm
C:\WINDOWS\BM2bdc6baa.xml
Download and save RenV to your desktop
Doubleclick RenV.exe.
When finished, it shall produce a new log for you. Post that log in your next reply.
Last edited:
Code:
Ran on Mon 03/03/2008 - 20:35:31.39
----a-w 81,920 2008-03-02 18:12:47 C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w 221,184 2008-03-02 18:12:47 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w 185,896 2008-03-02 18:12:48 C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w 462,336 2008-03-02 18:12:49 C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader .exe
----a-w 94,208 2008-03-02 18:12:46 C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w 132,496 2008-03-02 18:12:50 C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w 2,097,488 2008-03-02 19:09:25 C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w 1,807,960 2008-03-02 18:13:00 C:\Program Files\Trend Micro\Internet Security 14\pccguide .exe
----a-w 321,040 2008-03-02 18:12:57 C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon .exe
----a-w 866,584 2008-02-25 03:16:09 C:\Program Files\Windows Defender\MSASCui .exe
----a-w 59,392 2008-02-23 20:23:51 C:\WINDOWS\ehome\ehtray .exe
----a-w 315,904 2007-12-22 19:55:17 C:\WINDOWS\inf\unregmp2 .exe
----a-w 15,360 2008-02-23 20:24:11 C:\WINDOWS\system32\ctfmon .exe
----a-w 122,940 2008-03-02 18:12:47 C:\WINDOWS\system32\DLA\DLACTRLW .EXE
Entries: 14 (14)
Directories: 0 Files: 14
Bytes: 6,784,708 Blocks: 13,256I'm still looking for the C:\WINDOWS\system32\.htm file, I didn't notice the "." before htm.
ken545
Emeritus-Security Expert
Open NOTEPAD.exe and copy/paste the text in the code box below into it:
Save this as Log.txt
Drag Log.txt into RenV as you see in the screenshot.
It will produce a new log, post it please
Code:
----a-w 81,920 2008-03-02 18:12:47 C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w 221,184 2008-03-02 18:12:47 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w 185,896 2008-03-02 18:12:48 C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w 462,336 2008-03-02 18:12:49 C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader .exe
----a-w 94,208 2008-03-02 18:12:46 C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w 132,496 2008-03-02 18:12:50 C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w 2,097,488 2008-03-02 19:09:25 C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w 1,807,960 2008-03-02 18:13:00 C:\Program Files\Trend Micro\Internet Security 14\pccguide .exe
----a-w 321,040 2008-03-02 18:12:57 C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon .exe
----a-w 866,584 2008-02-25 03:16:09 C:\Program Files\Windows Defender\MSASCui .exe
----a-w 59,392 2008-02-23 20:23:51 C:\WINDOWS\ehome\ehtray .exe
----a-w 315,904 2007-12-22 19:55:17 C:\WINDOWS\inf\unregmp2 .exe
----a-w 15,360 2008-02-23 20:24:11 C:\WINDOWS\system32\ctfmon .exe
----a-w 122,940 2008-03-02 18:12:47 C:\WINDOWS\system32\DLA\DLACTRLW .EXESave this as Log.txt
Drag Log.txt into RenV as you see in the screenshot.
It will produce a new log, post it please
You say cool, I have no idea whats going on!! 
:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:40 PM, on 3/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1198884907640
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1198347871062
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 7341 bytes
:Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:40 PM, on 3/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1198884907640
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1198347871062
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 7341 bytes
ken545
Emeritus-Security Expert
Your log looks fine :bigthumb: The only thing you need to remove is Viewpoint, unless you use it. it usually installs without your knowledge or consent and is not needed for anything, you can uninstall it via the Add Remove programs. Its not malicious but uses system resources and is in the process of crossing the line into Adware.
The Vundo File Infecter that you had adds infected files to some programs, in your case it was the ones in the Code Box so that everytime you boot your PC or run those programs they can reinfect you. But the slimeballs that wrote it just wanted to add a file to them , not replace a legit file or the program wont work and Combofix weeds though them to find the infected ones and keep the legit copies. The bad files were removed after the initial run but a bug in Combofix had them show up again, but there gone now.
Go to C:\Program Files and see if you have a folder for Trojan Hunter.
C:\WINDOWS\BM2bdc6baa.txt <--you can remove this file
How is your system running now?????????????
The Vundo File Infecter that you had adds infected files to some programs, in your case it was the ones in the Code Box so that everytime you boot your PC or run those programs they can reinfect you. But the slimeballs that wrote it just wanted to add a file to them , not replace a legit file or the program wont work and Combofix weeds though them to find the infected ones and keep the legit copies. The bad files were removed after the initial run but a bug in Combofix had them show up again, but there gone now.
Go to C:\Program Files and see if you have a folder for Trojan Hunter.
C:\WINDOWS\BM2bdc6baa.txt <--you can remove this file
How is your system running now?????????????
Removed Viewpoint, did not find a file for Trojan Hunter, removed the C:\WINDOWS\BM2bdc6baa.txt file and my compute is running great!!!!!!!! I can't thank you enough for your help and the time you spent!!! Is there a specific way I can get rid of the stuff I used today or should I keep them, like vundo fix, malwarebytes, combofix and all the logs? Also,
I uninstalled pc-cillin like I said before but I noticed folders I still have. Is there something I can use to get rid of these? Last one,: do you happen to know why my windows updates and windows defender updates won't install?
I uninstalled pc-cillin like I said before but I noticed folders I still have. Is there something I can use to get rid of these? Last one,
: do you happen to know why my windows updates and windows defender updates won't install?
ken545
Emeritus-Security Expert
My bad 
The program you want to uninstall is Spyhunter I need a bruski
Glad things are running better :bigthumb:
The free version of Malwarebytes is yours to keep, you can run it every now and then to keep and eye on things.
You can drag RenV to the trash.
Windows Tech Support Forums
It's Not Always Malware
Speedup Windows
Windows Tips
Time for some housekeeping
The above procedure will:
Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
Glad we could help
Safe Surfn
Ken
The program you want to uninstall is Spyhunter I need a bruski
Glad things are running better :bigthumb:
The free version of Malwarebytes is yours to keep, you can run it every now and then to keep and eye on things.
You can drag RenV to the trash.
Not sure on this one. I will link you to some windows support sites that are better equipped to help you with that.
Windows Tech Support Forums
- Windows Helpnet <-- Excellent XP Forum
- PcPitStop <-- You can take your system in for a checkup here.
- Windows Support <-- Good Windows forum
- HardWareGuys <--Good Hardware forum
It's Not Always Malware
Speedup Windows
Windows Tips
Time for some housekeeping
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- When shown the disclaimer, Select "2"
The above procedure will:
- Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Reset System Restore.
How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.- Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
- WhattheTech
- TonyKlein CastleCops
- Grinler BleepingComputer
- GeeksTo Go
- Dslreports
Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
- Spybot Search and Destroy 1.5
Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
- Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
- Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
- IE-Spyad
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
- Firefox 2.0.0.12 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
Glad we could help
Safe Surfn
Ken
Last edited:
ken545
Emeritus-Security Expert
Good Morning,
I have been looking over your log and I think the reason for you not being able to update your programs may be related to this InstallShield Update Service This was one of the programs that the File Infecter played with. As a precaution we removed it from starting up with HJT and we can restore it.
To restore the backups:
Look for these two entries.
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
If that did not help than when you post on a windows support forum let them know you had a bad Vundo infection and it messed up that program, they will be able to help you install it properly.
Stay well,
Ken
I have been looking over your log and I think the reason for you not being able to update your programs may be related to this InstallShield Update Service This was one of the programs that the File Infecter played with. As a precaution we removed it from starting up with HJT and we can restore it.
To restore the backups:
- Open HiJackThis
- Click on "View the list of Backups"
- Place a check mark next to anything you want to restore
- Click Restore
- Click Yes
- Reboot your computer
Look for these two entries.
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
If that did not help than when you post on a windows support forum let them know you had a bad Vundo infection and it messed up that program, they will be able to help you install it properly.
- Your Java is out of date and leaving your system vulnerable.
- Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
- It should have an icon next to it:
Select it and click Remove. - Reboot your system.
- Then go to the Sun Microsystems and install the update
- Java Runtime Environment (JRE) 6 Update 4 <--This is what you need to download and install.
- If you chose the online installation, it will prompt you to run the program.
- If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
- Then after install you can verify your installation here Sun Java Verify
Stay well,
Ken
Last edited:
Good morning
I was on a google forum and found a notepad doc that I saved and ran and was able to get defender udates. So, hopefully that fixed it. I will post what I actually ran when I am home this evening around 6pm est. Also, I removed the older version of J2SE yesterday in between post and download the Java Runtime Environment (JRE) 6 Update 4 to my documents but have not installed it. I will do that as soon as I can. Thanks, for your continued help!!
I was on a google forum and found a notepad doc that I saved and ran and was able to get defender udates. So, hopefully that fixed it. I will post what I actually ran when I am home this evening around 6pm est. Also, I removed the older version of J2SE yesterday in between post and download the Java Runtime Environment (JRE) 6 Update 4 to my documents but have not installed it. I will do that as soon as I can. Thanks, for your continued help!!
windows updates:
This is what I did in order for windows to automatically install updates, it worked for windows defender as well:
From: http://groups.google.com/group/microsoft.public.windowsupdate/browse_thread/thread/20581c2030685bfc
Cut and paste this into notepad:
regsvr32.exe iuengine.dll
regsvr32.exe wuapi.dll
regsvr32.exe wuaueng1.dll
regsvr32.exe wuauserv.dll
regsvr32.exe wuaueng.dll
regsvr32.exe wucltui.dll
regsvr32.exe wups.dll
regsvr32.exe wuweb.dll
regsvr32.exe wups2.dll
regsvr32.exe cdm.dll
regsvr32.exe msxml2r.dll
regsvr32.exe msxml3r.dll
regsvr32.exe msxml.dll
regsvr32.exe msxml3.dll
regsvr32.exe msxmlr.dll
regsvr32.exe msxml2.dll
regsvr32.exe qmgr.dll
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 cryptdlg.dll
Now click on File
Click on Save As
(dialogue box appears)
At the bottom do the drop down in Save as Type as ALL FILES
In File Name box name it Winupdatefix.bat
Save it to your desktop (for ease of finding it)
it will appear as a ms-dos batch file.
double click
press enter after each confirmation. if it says it is missing a file or
cannot re-register don't worry. Note: initpki.dll will seem to hang, it
just takes less than a minute comapred to the others (that are almost
instant).
-----------------------------------------------
Hopefully, this didn't do any harm to my computer.
This is what I did in order for windows to automatically install updates, it worked for windows defender as well:
From: http://groups.google.com/group/microsoft.public.windowsupdate/browse_thread/thread/20581c2030685bfc
Cut and paste this into notepad:
regsvr32.exe iuengine.dll
regsvr32.exe wuapi.dll
regsvr32.exe wuaueng1.dll
regsvr32.exe wuauserv.dll
regsvr32.exe wuaueng.dll
regsvr32.exe wucltui.dll
regsvr32.exe wups.dll
regsvr32.exe wuweb.dll
regsvr32.exe wups2.dll
regsvr32.exe cdm.dll
regsvr32.exe msxml2r.dll
regsvr32.exe msxml3r.dll
regsvr32.exe msxml.dll
regsvr32.exe msxml3.dll
regsvr32.exe msxmlr.dll
regsvr32.exe msxml2.dll
regsvr32.exe qmgr.dll
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 cryptdlg.dll
Now click on File
Click on Save As
(dialogue box appears)
At the bottom do the drop down in Save as Type as ALL FILES
In File Name box name it Winupdatefix.bat
Save it to your desktop (for ease of finding it)
it will appear as a ms-dos batch file.
double click
press enter after each confirmation. if it says it is missing a file or
cannot re-register don't worry. Note: initpki.dll will seem to hang, it
just takes less than a minute comapred to the others (that are almost
instant).
-----------------------------------------------
Hopefully, this didn't do any harm to my computer.