Riskware keeps coming up on my a-squared scans....

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

Riskware keeps coming up on my a-squared scans....

Options

syeak View Member Profile	Nov 19 2006, 02:20 AM Post #1
Member Posts: 21 OS: Windows XP	Please help me. This is my log: Logfile of HijackThis v1.99.1 Scan saved at 4:16:04 PM, on 19/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\LogMeIn\LogMeInSystray.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Vet\isafe.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\svchost.exe C:\Vet\VetMsg.exe C:\WINDOWS\system32\devldr32.exe C:\Documents and Settings\yeak.YEAKY\Desktop\Virus stuff\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Global Startup: BlueSoleil.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe Thank you.

andydf View Member Profile	Dec 10 2006, 12:51 PM Post #2
Visiting Staff Posts: 1,651 From: Northampton UK OS: xp pro	Hi, syeak Welcome to Geeks to go Sorry about the delay in replying to your post, the forums have been very busy lately. As it's been a few days since your origional post, please could you post a new HJT log for me to see. Also. Please do an online virus scan with Panda ActiveScan Here. You need to use Internet Explorer for this scan. Once you get to the Panda site, scroll down a bit and click on Scan your PC A new window will appear; click on Check Now! A new window will appear; fill in the boxes (Country, State, email addy) Click on Scan Now! > If you have never used ActiveScan before, you will be prompted to install an ActiveX control (asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files. From "Select a device to scan...", choose "My Computer" Allow the scan to run. It'll take a while. When complete, click on "See Report", and then on "Save report"; save it to a convenient location. I will need you to post that report in your next reply; simply open the text file, then copy/paste the content here. Andy

syeak View Member Profile	Dec 15 2006, 08:07 AM Post #3
Member Posts: 21 OS: Windows XP	Hi Andy, Thanks for your help, but please tell me how to configure my security to accept activeX control. I have played around with it, but the scan still will not go through. Here is my log: Logfile of HijackThis v1.99.1 Scan saved at 11:07:10 PM, on 15/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\LogMeIn\LogMeInSystray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 11\MiniMavis.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Vet\isafe.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\svchost.exe C:\Vet\VetMsg.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\yeak.YEAKY\Desktop\Virus stuff\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: Mavis Beacon Teaches Typing Deluxe 11.lnk = C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 11\MiniMavis.exe O4 - Global Startup: BlueSoleil.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe Thanks

andydf View Member Profile	Dec 15 2006, 02:17 PM Post #4
Visiting Staff Posts: 1,651 From: Northampton UK OS: xp pro	Hi syeak From the browser menu, click Tools > Internet Options Click on the Security tab Select the globe icon representing the Internet Zone Click Custom Level Scroll down to the ActiveX controls and plug-ins section Under Download signed ActiveX contols select Prompt Under Run ActiveX controls and plug-ins select Enable Under Script ActiveX controls marked safe for scripting select Enable Click OK to close the Security Settings window (If prompted to verify that you want to change the security settings for this zone click Yes) Click OK to close the Internet Options window You can reset this to the default level if you wish after the scan. Andy

syeak View Member Profile	Dec 16 2006, 10:35 AM Post #5
Member Posts: 21 OS: Windows XP	Hi Andy, I still am unable to download the ActiveX after following your instructions, however I used Kaspersky Online Scan instead which is something that was suggested to me previously from this website. So the Kaspersky Online Scan of 'My Computer' is below my HiJack Log. Also I may not be able to access the ActiveX for the other website because my Anti VIR virus protection deleted the file, but I disabled the guard and the scan still won't work. Thought I just let you know. Logfile of HijackThis v1.99.1 Scan saved at 1:29:26 AM, on 17/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\LogMeIn\LogMeInSystray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 11\MiniMavis.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Vet\isafe.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\svchost.exe C:\Vet\VetMsg.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\yeak.YEAKY\Desktop\Virus stuff\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: Mavis Beacon Teaches Typing Deluxe 11.lnk = C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 11\MiniMavis.exe O4 - Global Startup: BlueSoleil.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, December 17, 2006 1:24:53 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 16/12/2006 Kaspersky Anti-Virus database records: 237128 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ G:\ Scan Statistics: Total number of scanned objects: 56854 Number of viruses found: 1 Number of infected objects: 0 / 0 Number of suspicious objects: 4 Duration of the scan process: 00:54:47 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DloaderAgentWN.zip/crackmasters.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DloaderAgentWN.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DownloaderTsupdateL5.zip/svchostsys.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DownloaderTsupdateL5.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\cert8.db Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\formhistory.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\history.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\key3.db Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\parent.lock Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\search.sqlite Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Mozilla\Firefox\Profiles\z4we4y9s.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Application Data\Sun\Java\Deployment\log\plugin150_03.trace Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Cookies\index.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Messenger\syeak_ynwa@hotmail.com\SharingMetadata\Logs\Dfsr.log Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Messenger\syeak_ynwa@hotmail.com\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Messenger\syeak_ynwa@hotmail.com\SharingMetadata\Working\database_60E8_D6EA_E8D6_BD8A\dfsr.db Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Messenger\syeak_ynwa@hotmail.com\SharingMetadata\Working\database_60E8_D6EA_E8D6_BD8A\fsr.log Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Messenger\syeak_ynwa@hotmail.com\SharingMetadata\Working\database_60E8_D6EA_E8D6_BD8A\fsrtmp.log Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Messenger\syeak_ynwa@hotmail.com\SharingMetadata\Working\database_60E8_D6EA_E8D6_BD8A\tmp.edb Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Windows Live Contacts\syeak_ynwa@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Application Data\Microsoft\Windows Live Contacts\syeak_ynwa@hotmail.com\shadow\members.stg Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Temp\~DF138.tmp Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Temp\~DF1E3.tmp Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Temp\~DFA852.tmp Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Temp\~DFA8B1.tmp Object is locked skipped C:\Documents and Settings\yeak.YEAKY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\yeak.YEAKY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\yeak.YEAKY\NTUSER.DAT.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{AB26917B-E4EA-4C6B-84F5-9DC8BB47E109}\RP25\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Thanks

andydf View Member Profile	Dec 16 2006, 02:36 PM Post #6
Visiting Staff Posts: 1,651 From: Northampton UK OS: xp pro	Hi syeak I can't see anything wrong with the scan results, can you tell me what a-squared finds when it scans your pc? Pleas follow the instructions below. First download AVG Anti-Spyware from HERE and save that file to your desktop. This is a 30 day trial of the program Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files. On the main screen select the icon "Update" then select the "Update now" link. Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab. Once in the Settings screen click on "Recommended actions" and then select "Quarantine". Under "Reports" Select "Automatically generate report after every scan" Un-Select "Only if threats were found" Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter. IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess: Lauch AVG Anti-Spyware by double-clicking the icon on your desktop. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan". AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following: If you have any infections you will prompted, then select "Apply all actions" Next select the "Reports" icon at the top. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important). Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan. Next Open HijackThis, click Config, click Misc Tools Click "Open Uninstall Manager" Click "Save List" (generates uninstall_list.txt) Click Save, copy and paste the results in your next post. Andy

syeak View Member Profile	Dec 17 2006, 09:00 AM Post #7
Member Posts: 21 OS: Windows XP	Hi Andy, I will go on with the instructions that you have given me, but just to let you know that I actually quarantined the Trojan horse TR/Dldr.AGG which was initially the riskware object that appeared on my Anti VIR scan. If I delete this file it will come up again once I restart it. Do you want me to do this or restore it, then to follow your instructions of downloading that program? Thanks Simon

andydf View Member Profile	Dec 17 2006, 11:18 AM Post #8
Visiting Staff Posts: 1,651 From: Northampton UK OS: xp pro	If the file has been quarantined then it will be harmless to your system, you can safely delete it from the quarantine folder. Just run the scan as directed and we'll see what results are found. Andy

syeak View Member Profile	Dec 22 2006, 11:13 AM Post #9
Member Posts: 21 OS: Windows XP	Sorry for the late reply. Here it is: --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 11:36:08 PM 22/12/2006 + Scan result: C:\System Volume Information\_restore{8B9DCABC-642D-47B8-8301-563EA8650419}\RP50\A0027883.exe -> Adware.DopeWars : No action taken. HKU\S-1-5-21-1275210071-920026266-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E6CE4CD-161B-4847-B8BF-E2EF72299D69} -> Logger.Sters : No action taken. C:\!KillBox\LMIinit.dll -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : No action taken. C:\!KillBox\LMIinit.dll( 1) -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : No action taken. C:\!KillBox\LMIinit.dll( 2) -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : No action taken. C:\WINDOWS\system32\LMIinit.dll -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : No action taken. C:\WINDOWS\system32\LMIinit.dll.000.bak -> Not-A-Virus.RemoteAdmin.Win32.RemotelyAnywhere.a : No action taken. C:\Documents and Settings\yeak.YEAKY\Desktop\Misc\Adobe_Photoshop_CS_and_Adobe_ImageReady_CS.zip/patch.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : No action taken. C:\System Volume Information\_restore{8B9DCABC-642D-47B8-8301-563EA8650419}\RP50\A0027810.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : No action taken. ::Report end Logfile of HijackThis v1.99.1 Scan saved at 2:10:30 AM, on 23/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\LogMeIn\LogMeInSystray.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 11\MiniMavis.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Vet\isafe.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\svchost.exe C:\Vet\VetMsg.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\yeak.YEAKY\Desktop\Virus stuff\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: Mavis Beacon Teaches Typing Deluxe 11.lnk = C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 11\MiniMavis.exe O4 - Global Startup: BlueSoleil.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe

andydf View Member Profile	Dec 23 2006, 11:39 AM Post #10
Visiting Staff Posts: 1,651 From: Northampton UK OS: xp pro	Hi syeak No problem with the delay, can you post the uninstall list I requested. Andy

syeak View Member Profile	Dec 25 2006, 12:53 AM Post #11
Member Posts: 21 OS: Windows XP	123 Video Converter Ad-Aware SE Personal Adobe Acrobat Reader 3.01 Adobe Reader 7.0.7 a-squared Free 2.0 AVG Anti-Spyware 7.5 Avira AntiVir PersonalEdition Classic BitLord 1.1 BitTornado 0.3.7 Dan Elwell's Broadband Speed Test Desktop Direct Show Ogg Vorbis Filter (remove only) EPSON Printer Software ESP810 Problem Solver ffdshow (remove only) FileSpecs plug-in for Ad-Aware SE FLV Player 1.3.3 Google Video Player HexDump plug-in for Ad-Aware SE HijackThis 1.99.1 J2SE Runtime Environment 5.0 Update 3 Kaspersky Online Scanner LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) LogMeIn LSP Explorer plug-in for Ad-Aware SE Macromedia Flash Player 8 Mavis Beacon Teaches Typing Deluxe 11 Messenger-Control plug-in for Ad-Aware SE Microsoft Office Professional Edition 2003 Mozilla Firefox (2.0.0.1) MSN Toolbar Nero Suite OE/W Messengerctrl plug-in for Ad-Aware SE Panda ActiveScan QuickTime SoulSeek Client 156c Tweak-SE plug-in for Ad-Aware SE ViewSonic Monitor Drivers ViewSonic Windows XP Signed Files VobSub v2.23 (Remove Only) Windows Live Messenger Windows Live Sign-in Assistant WinZip XviD MPEG-4 Video Codec All accounted for Andy!

andydf View Member Profile	Dec 28 2006, 03:22 PM Post #12
Visiting Staff Posts: 1,651 From: Northampton UK OS: xp pro	Hi syeak Sorry about the delay in replying, i'm having major hardware issues with my own pc at the moment. Have you any idea why there are programs from Computer Associates EZtrust antivirus running on your pc. did you have this installed previously? It is not showing in your uninstall list, which I was expecting to see. Andy PS Hopefully i will be back up and running full speed asap.

« Next Oldest · Malware Removal - HijackThis� Logs Go Here · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members: