HELP PLZ! PLZ! [RESOLVED]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

3 Pages

1 2 3 >

HELP PLZ! PLZ! [RESOLVED]

Options

sumguy View Member Profile	Dec 26 2007, 01:47 AM Post #1
Member Posts: 54 From: California OS: windows xp	Hello geeks2go! My friends computer is so SLOW. Not only that, on normal mode, everything is messed up, i mean the computer can't even read the flash drive! This all started when he got a virus, did a scan with SuperAntiSpyware, and rebooted. After reboot, the windows never loaded, and a screen came, saying that windows failed to load, then gave the option of "Last Known Good Configuration" and so he chose it. After that, the desktop background only showed! No icons, no taskbar. Many wierd tasks too. Such as wtfctrl? or something. HERES THE HIJACK THIS LOG!! HELP = GREATLY APPRECIATED. PS: dont thnk there is internet. THIS HIJACK THIS LOGFILE WAS DONE IN SAFE MODE BECAUSE NORMAL MODE WON't WORK! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:33:48 PM, on 12/25/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon.exe O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [avast!] C:\DOCUME~1\Nes\Desktop\avast\install\ashDisp.exe O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe" O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Documents and Settings\Nes\Desktop\avast\install\aswUpdSv.exe (file missing) O23 - Service: avast! Antivirus - Unknown owner - C:\Documents and Settings\Nes\Desktop\avast\install\ashServ.exe (file missing) O23 - Service: avast! Mail Scanner - Unknown owner - C:\Documents and Settings\Nes\Desktop\avast\install\ashMaiSv.exe (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Documents and Settings\Nes\Desktop\avast\install\ashWebSv.exe (file missing) O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 7221 bytes ---------------------- Also, at the startup, a shutdown box comes up. Countdown = 60 s...i simply did a shutdown -a in cmd to turn it off. The message says Initiate :NT authority/System. and in the description it says services.exe was unexpectedly terminated. This post has been edited by sumguy: Dec 26 2007, 01:59 AM

Rorschach112 View Member Profile	Dec 26 2007, 05:52 AM Post #2
GeekU Teacher Posts: 34,385 From: Dublin OS: XP	Hello Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding. Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, the Advanced Options Menu should appear; Select the first option, to run Windows in Safe Mode, then press Enter. Choose your usual account. Open the extracted SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the forum). Finally paste the contents of the Report.txt back on the forum. Do the following from Normal Mode Please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. If your anti-virus or firewall complains, please allow this script to run as it is not malicious. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

sumguy View Member Profile	Dec 26 2007, 05:26 PM Post #4
Member Posts: 54 From: California OS: windows xp	TOO MUCH IN THE LAST POST, SO HERES EXTRA.TXT from DSS -----------------------------------EXTRA Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel® Pentium® 4 CPU 3.00GHz CPU 1: Intel® Pentium® 4 CPU 3.00GHz Percentage of Memory in Use: 68% Physical Memory (total/avail): 502.07 MiB / 156.86 MiB Pagefile Memory (total/avail): 1227.25 MiB / 941.63 MiB Virtual Memory (total/avail): 2047.88 MiB / 1921.48 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 69.82 GiB total, 35.97 GiB free. D: is CDROM (No Media) E: is Removable (FAT) \\.\PHYSICALDRIVE0 - HDS728080PLA380 - 74.5 GiB - 3 partitions \PARTITION0 - Unknown - 31.35 MiB \PARTITION1 (bootable) - Installable File System - 69.82 GiB - C: \PARTITION2 - Unknown - 4.64 GiB \\.\PHYSICALDRIVE1 - MicroAdv QuickiDrive128M USB Device - 117.66 MiB - 1 partition \PARTITION0 (bootable) - MS-DOS V4 Huge - 124.73 MiB - E: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. FirstRunDisabled is set. FW: Trend Micro PC-cillin Internet Security (Firewall) v12 (Trend Micro, Inc.) AV: avast! antivirus 4.7.1001 [VPS 000746-2] v4.7.1001 (ALWIL Software) AV: Trend Micro PC-cillin Internet Security v12.7.1017 (Trend Micro, Inc.) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe::Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe::Enabled:America Online 9.0" "C:\\Program Files\\Lexmark 2500 Series\\app4r.exe"="C:\\Program Files\\Lexmark 2500 Series\\App4R.exe::Enabled:Lexmark Imaging Studio" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe::Enabled:Windows Live Messenger 8.1 (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe::Enabled:AOL Loader" "C:\\Program Files\\Common Files\\AOL\\1139646943\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1139646943\\ee\\aolsoftware.exe::Enabled:AOL Services" "C:\\Program Files\\Common Files\\AOL\\1139646943\\ee\\aim6.exe"="C:\\Program Files\\Common Files\\AOL\\1139646943\\ee\\aim6.exe::Enabled:AIM" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe::Enabled:Windows Messenger" "C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe::Enabled:avginet.exe" "C:\\Program Files\\WinAntiVirus Pro 2006\\Updater.exe"="C:\\Program Files\\WinAntiVirus Pro 2006\\Updater.exe::Enabled:updater.exe" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe::Enabled:America Online 9.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe::Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\DOCUME~1\\Nes\\LOCALS~1\\Temp\\win27B.exe"="C:\\DOCUME~1\\Nes\\LOCALS~1\\Temp\\win27B.exe::Enabled:win27B" "C:\\Program Files\\Lexmark 2500 Series\\lxddmon .exe"="C:\\Program Files\\Lexmark 2500 Series\\lxddmon .exe::Enabled: " -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Nes\Application Data CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=NAREN ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Nes LOGONSERVER=\\NAREN NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0403 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SonicCentral=C:\Program Files\Common Files\Sonic Shared\Sonic Central\ SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Nes\LOCALS~1\Temp TMP=C:\DOCUME~1\Nes\LOCALS~1\Temp USERDOMAIN=NAREN USERNAME=Nes USERPROFILE=C:\Documents and Settings\Nes windir=C:\WINDOWS __COMPAT_LAYER=EnableNXShowUI -- User Profiles --------------------------------------------------------------- Margie (admin)* Nes (admin) Herschel (admin) Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Documents and Settings\Nes\Desktop\ConverterUninstall.exe /CONVERTER --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks\|RealPlayer\|6.0 --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205} --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6} --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382} --> C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629} --> MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095} --> MsiExec.exe /I{95D9B4D8-B091-4fab-80EA-313EB4B82FD6} --> MsiExec.exe /I{EB997E90-5EB0-4eb5-90D0-90B1D2F0CA03} --> MsiExec.exe /I{F543B12A-13F5-487E-9314-F7D25E1BBE3E} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf 123 DVD Converter --> "C:\Documents and Settings\Nes\My Documents\My Music\123 DVD Converter\unins000.exe" Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 8.1.0 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003} Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log AIM 6 --> C:\Program Files\AIM6\uninst.exe AIM Facebook Plugin 0.0.8 --> C:\Documents and Settings\Nes\My Documents\Facebook Plugin\aim_facebook_uninstall.exe AIM Fight List 1.0.0.1 --> C:\DOCUME~1\Nes\MYDOCU~1\AIMFIG~1\UNWISE.EXE C:\DOCUME~1\Nes\MYDOCU~1\AIMFIG~1\INSTALL.LOG AIM MusicLink 2.0.0.4 --> C:\PROGRA~1\AIMMUS~1\UNWISE.EXE C:\PROGRA~1\AIMMUS~1\INSTALL.LOG AOLIcon --> MsiExec.exe /I{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C} Avanquest update --> C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe -runfromtemp -l0x0009 -removeonly avast! Antivirus --> rundll32 C:\DOCUME~1\Nes\Desktop\avast\install\Setup\setiface.dll,RunSetup AvPropPlugin 1.0.0.1 --> C:\PROGRA~1\AVPROP~1\UNWISE.EXE C:\PROGRA~1\AVPROP~1\INSTALL.LOG Buddy Icon Maker 1.0.0.1 --> C:\PROGRA~1\BUDDYI~1\UNWISE.EXE C:\PROGRA~1\BUDDYI~1\INSTALL.LOG CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" CiD Help --> C:\DOCUME~1\Nes\APPLIC~1\Gluefunk\Audio Internet Save.exe -uninstall Colorizer 1.0.0.1 --> C:\PROGRA~1\COLORI~1\UNWISE.EXE C:\PROGRA~1\COLORI~1\INSTALL.LOG Conexant D850 56K V.9x DFVc Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1\HXFSETUP.EXE -U -Idel200fk.inf CopySafe Plugin --> C:\PROGRA~1\Copysafe\UNWISE.EXE C:\PROGRA~1\Copysafe\INSTALL.LOG Cucusoft DVD to iPod + iPod Video Converter Suite 6.2.5.16 --> "C:\Documents and Settings\Nes\My Documents\My Music\ipod-converter\unins000.exe" Dell Digital Jukebox Driver --> C:\Program Files\Dell\Digital Jukebox Drivers\DrvUnins.exe /s Dell Driver Reset Tool --> MsiExec.exe /I{5905F42D-3F5F-4916-ADA6-94A3646AEE76} DellSupport --> MsiExec.exe /X{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D} Digital Content Portal --> MsiExec.exe /I{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33} Digital Line Detect --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanelAnyText DivX Codec --> C:\Documents and Settings\Nes\Desktop\DivXCodecUninstall.exe /CODEC DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER DivX Converter --> C:\Documents and Settings\Nes\Desktop\ConverterUninstall.exe /CONVERTER DivX Player --> C:\Documents and Settings\Nes\Desktop\DivXPlayerUninstall.exe /PLAYER DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN DVD Ripper 4 --> C:\Documents and Settings\Nes\Desktop\DVD Ripper 4\Uninstall.exe EarthLink setup files --> MsiExec.exe /X{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE} EducateU --> MsiExec.exe /I{A683A2C0-821C-486F-858C-FA634DB5E864} ESPNMotion --> C:\PROGRA~1\ESPNMO~1\UNWISE.EXE /u C:\PROGRA~1\ESPNMO~1\INSTALL.LOG GameSpy Arcade --> C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG GemMaster Mystic --> "C:\Program Files\GemMaster\uninstallgemmaster.exe" Get High Speed Internet! --> MsiExec.exe /I{7A3F0566-5E05-4919-9C98-456F6B5CF831} Google AFE --> regsvr32 /u /s "c:\Program Files\GoogleAFE\GoogleAE.dll" Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar6.dll" High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Intel® Graphics Media Accelerator Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2776 PCI\VEN_8086&DEV_2772 Intel® PRO Network Connections Drivers --> Prounstl.exe Intel® PROSet for Wired Connections --> MsiExec.exe /I{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA} J2SE Runtime Environment 5.0 Update 8 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150080} Java 2 Runtime Environment, SE v1.4.2_03 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030} K-Lite Codec Pack 2.27 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe" Learn2 Player (Uninstall Only) --> C:\Program Files\Learn2.com\StRunner\stuninst.exe Lexmark 2500 Series --> C:\Program Files\Lexmark 2500 Series\Install\x86\Uninst.exe Lexmark Fax Solutions --> C:\Program Files\Lexmark Fax Solutions\Install\x86\Uninst.exe /R:faxunst Lexmark Toolbar --> regsvr32.exe /s /u "C:\Program Files\Lexmark Toolbar\toolband.dll" LimeWire 4.12.11 --> "C:\Documents and Settings\Nes\My Documents\LimeWire\uninstall.exe" Macromedia Flash Player --> MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c} MC Web --> C:\WINDOWS\unvise32.exe C:\uninstal.log Microsoft Digital Image Standard 2006 --> "C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=PREM VERSION=11 Microsoft Halo Trial --> "C:\Program Files\Microsoft Games\Halo Trial\UNINSTAL.EXE" /runtemp /addremove Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe" Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9} Microsoft Office XP Professional --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0050048383C9} Microsoft Plus! Digital Media Edition Installer --> MsiExec.exe /X{6E45BA47-383C-4C1E-8ED0-0D4845C293D7} Microsoft Plus! Photo Story 2 LE --> MsiExec.exe /X{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B} MixMeister CD-R Drivers --> MsiExec.exe /I{4367BF53-8748-4122-8516-85E4375925AF} MixMeister Studio Demo 7.0.5 --> "C:\Documents and Settings\Nes\Desktop\MixMeister Studio\unins000.exe" mobile PhoneTools --> MsiExec.exe /X{F4756F45-E373-45E0-A023-F3DD4A04AA90} mobile PhoneTools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F18E8A0F-BE99-4305-96A5-6C0FD9D7D999}\setup.exe" -l0x9 MobTime Cell Phone Manager V3.6.4 --> "C:\Documents and Settings\Nes\My Documents\My Music\MobTime Cell Phone Manager\unins000.exe" Modem Helper --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel Motorola Driver Installation --> MsiExec.exe /I{3324A5DC-C7F6-430A-ACC8-F251CD8F4FC7} Motorola Phone Tools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}\setup.exe" -l0x9 -removeonly Movie Converter V2 (remove only) --> C:\Documents and Settings\Nes\Desktop\Movie Converter V2\uninst.exe -c Mozilla Firefox (2.0.0.11) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe MP3 Converter Simple --> C:\DOCUME~1\Nes\MYDOCU~1\MP3CON~1\UNWISE.EXE C:\DOCUME~1\Nes\MYDOCU~1\MP3CON~1\INSTALL.LOG MP3 Cutter Joiner 1.17 --> "C:\Program Files\SuperAudiotool\MP3 Cutter Joiner\unins000.exe" MPEG Encoder 3 --> C:\Documents and Settings\Nes\My Documents\MPEG Encoder 3\Uninstall.exe Nero - Burning Rom (Web installer) --> C:\WINDOWS\UNNERO.exe /UNINSTALL Nero ShowTime CE --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL Netscape Internet Service --> C:\Program Files\Netscape Internet Service\install.exe -r {FFC3B772-C00A-42da-90A6-A87F4AFD73D9} Netscape Web Accelerator --> C:\Program Files\Netscape Internet Service\Netscape Web Accelerator\accinst.exe -r {FFC3B772-C00A-42da-90A6-A87F4AFD73E0} NetWaiting --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanelAnyText NetZeroInstallers --> MsiExec.exe /X{352310C3-E46B-42D3-8F32-54721FDD72D9} Otto --> "C:\Program Files\EnglishOtto\uninstallotto.exe" PowerDVD 5.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall QuickBooks Simple Start Special Edition --> msiexec.exe /I {F543B12A-13F5-487E-9314-F7D25E1BBE3E} UNIQUE_NAME="atomlimited" QBFULLNAME="QuickBooks Simple Start Special Edition" ADDREMOVE=1 QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks\|RealPlayer\|6.0 Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Sierra Account Wizard --> C:\DOCUME~1\Nes\MYDOCU~1\ACCOUN~1\UNWISE.EXE C:\DOCUME~1\Nes\MYDOCU~1\ACCOUN~1\INSTALL.LOG SmartSoft Video Converter --> "C:\Documents and Settings\Nes\My Documents\SmartSoftVideoConverterPro\unins000.exe" Sonic DLA --> MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6} Sonic Encoders --> MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011} Sonic RecordNow Audio --> MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382} Sonic RecordNow Copy --> MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629} Sonic RecordNow Data --> MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205} Sonic Update Manager --> MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E} Steam --> C:\DOCUME~1\Nes\MYDOCU~1\UNWISE.EXE C:\DOCUME~1\Nes\MYDOCU~1\INSTALL.LOG SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} Trend Micro PC-cillin Internet Security 12 --> MsiExec.exe /X{7698EDA5-A90F-4205-99CB-8FF6F9048ED9} Update Rollup 2 for Windows XP Media Center Edition 2005 --> C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe Usb to Serial Driver 1.12.25 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F46E168-E0F4-45EA-81F5-80488334B609}\Setup.exe" -l0x9 Viewpoint Manager (Remove Only) --> C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe /u /k Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u Viewpoint Toolbar --> C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\Uninstaller.exe /u /k /url "http://www.viewpoint.com/pub/uninstallcompleted.html" Virtual DJ - Atomix Productions --> C:\DOCUME~1\Nes\MYDOCU~1\VIRTUA~1\UNWISE.EXE C:\DOCUME~1\Nes\MYDOCU~1\VIRTUA~1\INSTALL.LOG WebCyberCoach 3.2 Dell --> "C:\Program Files\WebCyberCoach\b_Dell\WCC_Wipe.exe" "WebCyberCoach ext\wtrb" /inf "engine.inf,RealUninstallSection,,4" /infcfg "enginecf.inf,RealUninstallSection,,4" Winamp --> "C:\Documents and Settings\Nes\My Documents\Winamp\UninstWA.exe" Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F} Windows XP Media Center Edition 2005 KB908246 --> "C:\WINDOWS\$NtUninstallKB908246$\spuninst\spuninst.exe" Windows XP Media Center Edition 2005 KB908250 --> WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe WordPerfect Office 12 --> MsiExec.exe /I{AF19F291-F22F-4798-9662-525305AE9E48} XviD 1.1 final uninstall --> "C:\Program Files\XviD\unins000.exe" Yahoo! Photos Easy Upload Tool 1v7 --> C:\WINDOWS\system32\regsvr32 /u /s "C:\WINDOWS\cache\YDropper.dll" Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe YASA DVD to MPEG Converter v3.6 (build 042) --> C:\DOCUME~1\Nes\MYDOCU~1\MYMUSI~1\YASADV~1\UNWISE.EXE C:\DOCUME~1\Nes\MYDOCU~1\MYMUSI~1\YASADV~1\INSTALL.LOG -- Application Event Log ------------------------------------------------------- Event Record #/Type20754 / Error Event Submitted/Written: 12/25/2007 11:53:58 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application services.exe, version 5.1.2600.2180, faulting module services.exe, version 5.1.2600.2180, fault address 0x00008e40. Processing media-specific event for [services.exe!ws!] Event Record #/Type20751 / Error Event Submitted/Written: 12/25/2007 05:35:07 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application services.exe, version 5.1.2600.2180, faulting module services.exe, version 5.1.2600.2180, fault address 0x00008e40. Processing media-specific event for [services.exe!ws!] Event Record #/Type20747 / Error Event Submitted/Written: 12/24/2007 04:25:22 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application services.exe, version 5.1.2600.2180, faulting module services.exe, version 5.1.2600.2180, fault address 0x00008e40. Processing media-specific event for [services.exe!ws!] Event Record #/Type20744 / Error Event Submitted/Written: 12/21/2007 07:02:37 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application services.exe, version 5.1.2600.2180, faulting module services.exe, version 5.1.2600.2180, fault address 0x00008e40. Processing media-specific event for [services.exe!ws!] Event Record #/Type20741 / Error Event Submitted/Written: 12/21/2007 06:56:46 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application services.exe, version 5.1.2600.2180, faulting module services.exe, version 5.1.2600.2180, fault address 0x00008e40. Processing media-specific event for [services.exe!ws!] -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type109285 / Error Event Submitted/Written: 12/26/2007 03:06:54 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C} Event Record #/Type109284 / Error Event Submitted/Written: 12/26/2007 03:06:53 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C} Event Record #/Type109283 / Error Event Submitted/Written: 12/26/2007 03:06:52 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C} Event Record #/Type109282 / Error Event Submitted/Written: 12/26/2007 03:06:51 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C} Event Record #/Type109281 / Error Event Submitted/Written: 12/26/2007 03:06:50 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1058" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C} -- End of Deckard's System Scanner: finished at 2007-12-26 15:09:19 ------------

Rorschach112 View Member Profile	Dec 26 2007, 05:46 PM Post #5
GeekU Teacher Posts: 34,385 From: Dublin OS: XP	Bit more to do You have two anti-virus programs, Avast and Trend Micro, this can cause a lot of problems so please go to start > control Panel > Add or Remove Programs > Remove Avast or Trend Micro Internet Security 1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present): O2 - BHO: (no name) - {1AFCD1D7-C06B-48DB-874D-FB5F99BDB60F} - C:\WINDOWS\system32\mllmm.dll O2 - BHO: (no name) - {5B17AFFD-3491-4318-B941-0E867D8B94D2} - C:\WINDOWS\inf\gvamcd.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) O20 - Winlogon Notify: gebya - C:\WINDOWS\system32\gebya.dll (file missing) O20 - Winlogon Notify: gvamcd - C:\WINDOWS\inf\gvamcd.dll (file missing) O20 - Winlogon Notify: wineij32 - wineij32.dll (file missing) 2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis. Please download OTMoveIt by OldTimer. Save it to your desktop. Please double-click OTMoveIt.exe to run it. Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\Program Files\WinAntiVirus Pro 2006 C:\DOCUME~1\\Nes\LOCALS~1\Temp\win27B.exe C:\WINDOWS\system32\aybeg.tmp C:\WINDOWS\system32\aybeg.bak1 C:\WINDOWS\system32\aybeg.bak2 C:\WINDOWS\inf\dcmavg.tmp C:\WINDOWS\inf\dcmavg.bak1 C:\WINDOWS\inf\dcmavg.bak2 C:\WINDOWS\system32\opqss.tmp C:\WINDOWS\system32\mllmm.dll C:\fjrnkqwn.exe C:\Install C:\WINDOWS\system32\njprckha C:\WINDOWS\system32\drvkegr.dll C:\Program Files\SecCenter C:\Program Files\Gcxwkfaq C:\Program Files\parehuvg C:\WINDOWS\system32\mllmm.exe C:\WINDOWS\system32\mmllm.ini2 C:\DOCUME~1\Nes\APPLIC~1\Gluefunk\Audio Internet Save.exe C:\WINDOWS\avp .exe C:\WINDOWS\system32\drvkeg.dll C:\Documents and Settings\All Users\Application Data\dilozmfa.dll C:\WINDOWS\lsass .exe C:\Program Files\Outerinfo C:\Program Files\SecCenter C:\WINDOWS\system32\mgrs.exe C:\Program Files\parehuvg C:\Program Files\Save Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste. Click the red Moveit! button. Close OTMoveIt If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. Please "Copy" the results from the "Results" window (to the right) and then "Paste" them into your next reply on the forum. Note : If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at : C:\_OTMoveIt\MovedFiles\******_**.log (where "****_****" is the "date_time") Click "Exit" to close OTMoveIt. Reboot and post a new DSS log

sumguy View Member Profile	Dec 26 2007, 07:50 PM Post #6
Member Posts: 54 From: California OS: windows xp	Well, for the hijack this: O2 - BHO: (no name) - {1AFCD1D7-C06B-48DB-874D-FB5F99BDB60F} - C:\WINDOWS\system32\mllmm.dll - WASNT THERE O2 - BHO: (no name) - {5B17AFFD-3491-4318-B941-0E867D8B94D2} - C:\WINDOWS\inf\gvamcd.dll (file missing) - NOT THERE O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) - NOT THERE O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) - FIXED O20 - Winlogon Notify: gebya - C:\WINDOWS\system32\gebya.dll (file missing) - NOT THERE O20 - Winlogon Notify: gvamcd - C:\WINDOWS\inf\gvamcd.dll (file missing) - NOT THERE O20 - Winlogon Notify: wineij32 - wineij32.dll (file missing) - NOT THERE MOVEIT LOG : File/Folder C:\Program Files\WinAntiVirus Pro 2006 not found. File/Folder C:\DOCUME~1\\Nes\LOCALS~1\Temp\win27B.exe not found. C:\WINDOWS\system32\aybeg.tmp moved successfully. C:\WINDOWS\system32\aybeg.bak1 moved successfully. C:\WINDOWS\system32\aybeg.bak2 moved successfully. C:\WINDOWS\inf\dcmavg.tmp moved successfully. C:\WINDOWS\inf\dcmavg.bak1 moved successfully. C:\WINDOWS\inf\dcmavg.bak2 moved successfully. C:\WINDOWS\system32\opqss.tmp moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\mllmm.dll C:\WINDOWS\system32\mllmm.dll NOT unregistered. File move failed. C:\WINDOWS\system32\mllmm.dll scheduled to be moved on reboot. C:\fjrnkqwn.exe moved successfully. C:\Install moved successfully. C:\WINDOWS\system32\njprckha moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\drvkegr.dll C:\WINDOWS\system32\drvkegr.dll NOT unregistered. C:\WINDOWS\system32\drvkegr.dll moved successfully. C:\Program Files\SecCenter moved successfully. C:\Program Files\Gcxwkfaq moved successfully. C:\Program Files\parehuvg moved successfully. C:\WINDOWS\system32\mllmm.exe moved successfully. C:\WINDOWS\system32\mmllm.ini2 moved successfully. File/Folder C:\DOCUME~1\Nes\APPLIC~1\Gluefunk\Audio Internet Save.exe not found. File/Folder C:\WINDOWS\avp .exe not found. File/Folder C:\WINDOWS\system32\drvkeg.dll not found. File/Folder C:\Documents and Settings\All Users\Application Data\dilozmfa.dll not found. File/Folder C:\WINDOWS\lsass .exe not found. File/Folder C:\Program Files\Outerinfo not found. File/Folder C:\Program Files\SecCenter not found. File/Folder C:\WINDOWS\system32\mgrs.exe not found. File/Folder C:\Program Files\parehuvg not found. File/Folder C:\Program Files\Save not found. Created on 12/26/2007 17:30:42 Then the new DSS log IS IN A NEW POST

Rorschach112 View Member Profile	Dec 27 2007, 04:49 AM Post #8
GeekU Teacher Posts: 34,385 From: Dublin OS: XP	Do this Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop. Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program. Under Additional Scans on the bottom right, check the boxes for Reg - Disabled MS Config Items. Now click the Run Scan button on the toolbar. When the scan is complete Notepad will open with the report file loaded in it. Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it. Use the Add Reply button and Copy/Paste the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report. Make sure you attach the report in your reply.

Rorschach112 View Member Profile	Dec 27 2007, 01:54 PM Post #10
GeekU Teacher Posts: 34,385 From: Dublin OS: XP	Bit left to do You can restart your PC when you need to Start WinPFind3U. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button. QUOTE [Kill Explorer] [Unregister Dlls] [Win32 Services - Non-Microsoft Only] YY -> (aswUpdSv) avast! iAVS4 Control Service [Win32_Own \| Auto \| Stopped] -> %UserDesktop%\avast\install\aswUpdSv.exe YY -> (avast! Antivirus) avast! Antivirus [Win32_Own \| Auto \| Stopped] -> %UserDesktop%\avast\install\ashServ.exe YY -> (avast! Mail Scanner) avast! Mail Scanner [Win32_Own \| On_Demand \| Stopped] -> %UserDesktop%\avast\install\ashMaiSv.exe YY -> (avast! Web Scanner) avast! Web Scanner [Win32_Own \| On_Demand \| Stopped] -> %UserDesktop%\avast\install\ashWebSv.exe [Registry - Non-Microsoft Only] < Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run YN -> avast! -> %SystemDrive%\DOCUME~1\Nes\Desktop\avast\install\ashDisp.exe YN -> IntelliPoint -> %ProgramFiles%\Microsoft IntelliPoint\point32.exe YN -> WatchDog -> %ProgramFiles%\mobile PhoneTools\WatchDog.exe < Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run YN -> trust readme -> %SystemDrive%\DOCUME~1\Nes\APPLIC~1\Gluefunk\Audio Internet Save.exe < Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ YN -> gebya -> %System32%\gebya.dll YN -> gvamcd -> %SystemRoot%\inf\gvamcd.dll YN -> wineij32 -> wineij32.dll < BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ YN -> {5B17AFFD-3491-4318-B941-0E867D8B94D2} [HKLM] -> %SystemRoot%\inf\gvamcd.dll [Reg Data - Value does not exist] YN -> {7E853D72-626A-48EC-A868-BA8D5E23E045} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] YY -> {EF86E00F-C968-4B8E-9EE6-FD52B84C3B76} [HKLM] -> %System32%\mllmm.dll [Reg Data - Value does not exist] < Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ YN -> WebBrowser\\{74CC49F7-EB32-4A08-B204-948962A6E3DB} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] < Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ YN -> {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> Reg Data - Key not found [MenuText: Sun Java Console] YN -> {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -> Reg Data - Value does not exist [ButtonText: Real.com] YN -> {e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> Reg Data - Key not found [MenuText: @xpsp3res.dll,-20001] [Registry - Additional Scans - Non-Microsoft Only] < Disabled MSConfig Registry Items [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ YN -> avp -> %SystemRoot%\avp .exe YN -> CTDrive -> %System32%\drvkeg.DLL YN -> DellSupport -> %ProgramFiles%\Dell Support\DSAgnt.exe YN -> dilozmfa -> regsvr32 /u "%AllUsersAppData%\dilozmfa.dll YY -> Load -> %System32%\mllmm.exe YN -> lsass -> %SystemRoot%\lsass .exe YN -> Outerinfo -> %ProgramFiles%\Outerinfo\Outerinfo.exe YN -> SC2 -> %ProgramFiles%\SecCenter\scprot4.exe YN -> smgr -> mgrs.exe YN -> ufancxsz -> Files\parehuvg\lsbmxqhu.DLL YN -> WhenUSave -> %ProgramFiles%\Save\Save.exe [Files/Folders - Created Within 30 days] NY -> mllmm.dll -> %System32%\mllmm.dll NY -> mllmm.exe -> %System32%\mllmm.exe NY -> mmllm.ini -> %System32%\mmllm.ini NY -> mmllm.ini2 -> %System32%\mmllm.ini2 NY -> RCX46.tmp -> %System32%\RCX46.tmp NY -> RCX47.tmp -> %System32%\RCX47.tmp NY -> RCX48.tmp -> %System32%\RCX48.tmp NY -> RCX4A.tmp -> %System32%\RCX4A.tmp NY -> RCX4B.tmp -> %System32%\RCX4B.tmp NY -> RCX50.tmp -> %System32%\RCX50.tmp NY -> RCX59.tmp -> %System32%\RCX59.tmp NY -> RCX70.tmp -> %System32%\RCX70.tmp [Files/Folders - Modified Within 30 days] NY -> A5BE54899191CF91.job -> %SystemRoot%\tasks\A5BE54899191CF91.job NY -> mllmm.dll -> %System32%\mllmm.dll NY -> mllmm.exe -> %System32%\mllmm.exe NY -> mmllm.ini -> %System32%\mmllm.ini NY -> mmllm.ini2 -> %System32%\mmllm.ini2 NY -> RCX46.tmp -> %System32%\RCX46.tmp NY -> RCX47.tmp -> %System32%\RCX47.tmp NY -> RCX48.tmp -> %System32%\RCX48.tmp NY -> RCX4A.tmp -> %System32%\RCX4A.tmp NY -> RCX4B.tmp -> %System32%\RCX4B.tmp NY -> RCX50.tmp -> %System32%\RCX50.tmp NY -> RCX59.tmp -> %System32%\RCX59.tmp NY -> RCX70.tmp -> %System32%\RCX70.tmp [File String Scan - Non-Microsoft Only] NY -> UPX! , UPX0 , -> %System32%\aswBoot.exe NY -> @Alternate Data Stream - 26 bytes -> %System32%\ydhvhfdl.exe:Zone.Identifier [Empty Temp Folders] [Start Explorer] [Reboot] The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new WinPFind3u scan(attach the WinPFind3 scan report). I will review the information when it comes back in. Then try run DSS again

Rorschach112 View Member Profile	Dec 27 2007, 03:42 PM Post #13
GeekU Teacher Posts: 34,385 From: Dublin OS: XP	Hello Please download VundoFix.exe to your desktop Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting. Also post a new DSS log

sumguy View Member Profile	Dec 27 2007, 03:45 PM Post #14
Member Posts: 54 From: California OS: windows xp	I'm going to go grab lunch, then i will proceed to do the VundoFix. Be right Back

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

3 Pages

1 2 3 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal PLZ HELP! [RESOLVED]	9 / 856	15th December 2007 - 03:43 PM tmac2488 started - last by miekiemoes
Virus, Spyware and Trojan Removal My Hijackthis PLZ help me! [RESOLVED] 123	35 / 1,248	25th February 2008 - 02:52 AM dirtyendz started - last by kahdah
Virus, Spyware and Trojan Removal Bagle Worm, cant access Antivirus/hijackthis!plz help [RESOLVED] 123» 8	114 / 3,448	30th March 2008 - 12:54 PM verve started - last by RatHat
Virus, Spyware and Trojan Removal Computer Infected With Trojan Horse....PLZ Help ASAP! [RESOLVED]	7 / 1,497	2nd April 2008 - 11:31 AM LizethZ7304 started - last by miekiemoes