spyware detection alert

Need a geek? You've come to the right place! Geeks to Go offers free, quality technical support, in a non-technical way. Volunteers are waiting to help. Friendly, technology experts who have knowledge to share, and find reward in helping others. Feel free to browse the site as a guest. However, to reply to a topic, or start a new one, you'll need to register (also removes advertising). New here? Visit our Welcome Guide. Infected with a Virus, Spyware, or Trojan? Read our Malware and Spyware Cleaning Guide.

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

2 Pages

1 2 >

spyware detection alert, Stupid spyware!

Options

jkhypilot View Member Profile	Nov 6 2006, 06:52 PM Post #1
Member Posts: 19 OS: XP Pro sevice pack 2	In the bottom right tray is this annoying little red circle with a yellow exclamation point in it. I , like many other frustrated people on this board can’t get rid of the problem with the usual spy ware removal programs. When I click on it it opens this window. Attached File(s) Doc1.doc ( 136K ) Number of downloads: 41

Flrman1 View Member Profile	Nov 6 2006, 07:07 PM Post #2
Malware Assassin Posts: 6,596 OS: XP Home, XP Pro, Vista	Hi Welcome to GTG! Please post the following logs: * Click here to download HJTsetup.exe Save HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue. Put a check by Create a desktop icon then click Next again. Continue to follow the rest of the prompts from there. At the final dialogue box click Finish and it will launch Hijack This. Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. Come back here to this thread and Paste the log in your next reply. DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required. * Also open Hijack This and click on the "Open the Misc Tools section" button. Click on the "Open Uninstall Manager" button. Click the "Save List" button. After you click the "Save List" button, you will be asked where to save the file. Pick a place to save it then the list should open in notepad. Copy and paste that list here. * Click here to download SmitfraudFix.zip and save it to your desktop. Unzip (extract) the contents of SmitfraudFix.zip to a new SmitfraudFix folder on your desktop. Open the SmitfraudFix folder and double-click the smitfraudfix.cmd file. Select option #1 - Search by typing 1 and press "Enter" A text file will appear, which lists the infected files that it finds, if any. Copy and paste the contents of that report into your next reply to this thread. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. Come back here and copy and paste these three logs. Don't attach the logs please: Hijack This log Uninstall list Smitfraudfix log

jkhypilot View Member Profile	Nov 6 2006, 08:08 PM Post #3
Member Posts: 19 OS: XP Pro sevice pack 2	Logfile of HijackThis v1.99.1 Scan saved at 7:39:03 PM, on 11/6/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Trend Micro\Antivirus\pccguide.exe C:\Program Files\Trend Micro\Antivirus\PCClient.exe C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Steam\Steam.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\WINDOWS\ATKKBService.exe C:\WINDOWS\VVNFUg\command.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe C:\Program Files\Trend Micro\Antivirus\tmproxy.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\alg.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Hijackthis\HijackThis.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Antivirus\pccguide.exe" O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Antivirus\PCClient.exe" O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe" /run O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvmog.dll,startup O4 - HKLM\..\Run: [lbmpmmc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\lbmpmmc.dll,ksfzzdg O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - Startup: Registration .LNK = C:\Program Files\Ubisoft\Dark Messiah of Might and Magic\RegistrationReminder.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Event Reminder.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1161631068046 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VVNFUg\command.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\tmproxy.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe The uninstall list will not save. Each time I click on the save list button it closes and never asks for a file save location.

jkhypilot View Member Profile	Nov 6 2006, 08:14 PM Post #4
Member Posts: 19 OS: XP Pro sevice pack 2	SmitFraudFix v2.119 Scan done at 20:13:29.35, Mon 11/06/2006 Run from C:\Documents and Settings\Rob\Desktop\New Folder\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\drvmog.dll FOUND ! C:\WINDOWS\system32\components\flx?.dll FOUND ! C:\WINDOWS\system32\components\flx??.dll FOUND ! C:\WINDOWS\system32\components\flx???.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Rob »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Rob\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Rob\FAVORI~1 C:\DOCUME~1\Rob\FAVORI~1\Antivirus Test Online.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\VirusBursters\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Flrman1 View Member Profile	Nov 6 2006, 08:27 PM Post #5
Malware Assassin Posts: 6,596 OS: XP Home, XP Pro, Vista	* Download the free version of AVG Anti-Spyware 7.5 here. Click on the "Download Now" button and save the setup file to your desktop. Doubleclick on the avgas-setup file to begin the installation. When the installation is complete, open AVG Anti-Spyware and update the definition files. On the main screen click on the "Update now" link and the update should begin immediately. If the update does not begin, select the "Start Update" button, the update will start and a progress bar will show the updates being installed. When the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab. Once in the Settings screen click on "Recommended actions" and then select "Quarantine". Under "Reports" Select "Automatically generate report after every scan" Un-Select "Only if threats were found" If you cannot download the updates, update manuallly according to the directions here. If you do the manual update, look under "Full database" and click the "Download now" button. DO NOT run a scan yet. You will do that later in safe mode. * Click here for info on how to boot to safe mode if you don't already know how. * Now copy these instructions to notepad and save them to your desktop. You will need them to refer to. * Restart your computer into safe mode now. Perform the following steps in safe mode: * Run AVG Anti-Spyware: Launch AVG Anti-Spyware by double-clicking the icon on your desktop. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan". It will then begin the scanning process, be patient it may take a while for the scan to complete. When the scan is complete, you must select an action. Select "Apply all actions" Next select the "Reports" icon at the top. Select the "Save report as" button in the lower left hand of the screen Save the report as a text file and save it to your desktop. Close AVG Anti-Spyware. * Run the SmitfraudFix: Open the SmitfraudFix folder again and double-click the smitfraudfix.cmd file. Select option #2 - Clean by typing 2 and press "Enter" to delete the infected files. You will receive this prompt: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and press "Enter" and it will begin cleaning the infection. Next the tool will check to see if wininet.dll is infected. You may be prompted to replace the infected wininet.dll file if it is found. Answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process. If it doesn't restart your computer automatically when it is finished, restart it back to Windows normally yourself. A text file will appear onscreen, with results from the cleaning process. Copy and paste the contents of that report into your next reply to this thread along with a new Hijack This log. If the report doesn't open after you restart back to Windows normally, the report can be found at the root of the system drive, usually C:\rapport.txt.

jkhypilot View Member Profile	Nov 6 2006, 09:34 PM Post #6
Member Posts: 19 OS: XP Pro sevice pack 2	And the servey says! ------------------------------------------------------ AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 9:06:46 PM 11/6/2006 + Scan result: C:\Program Files\VSAdd-in\VSAdd-in.dll -> Adware.Agent : Cleaned. C:\WINDOWS\VVNFUg\asappsrv.dll -> Adware.CommAd : Cleaned. C:\WINDOWS\VVNFUg\command.exe -> Adware.CommAd : Cleaned. C:\Program Files\Common Files\{A4461FB9-0960-1033-0713-060823060001}\services.dll -> Adware.Softomate : Cleaned. :mozilla.215:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.280:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.370:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.77:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.78:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.79:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.81:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.82:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.83:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.84:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.85:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.86:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.89:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.90:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.91:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.92:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.228:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.229:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.484:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.485:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.486:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.278:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.279:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.158:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.159:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.160:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.161:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. :mozilla.33:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.470:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.471:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.472:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.204:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned. :mozilla.305:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.25:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.131:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Enhance : Cleaned. :mozilla.133:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Enhance : Cleaned. :mozilla.186:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.316:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.317:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.318:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.319:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.320:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.321:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.322:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.276:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.174:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.175:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.176:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.177:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.44:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.45:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.46:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.47:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.48:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.16:C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\bnrpjdte.default\cookies.txt -> TrackingCookie.Findwhat : Cleaned. :mozilla.178:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Findwhat : Cleaned. :mozilla.464:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned. :mozilla.465:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned. :mozilla.52:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Goclick : Cleaned. :mozilla.53:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Goclick : Cleaned. :mozilla.108:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.117:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.120:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.203:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.230:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.235:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.511:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.151:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.154:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.155:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.156:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.255:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.256:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@ehg-pcsecurityshield.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.68:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.454:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned. :mozilla.497:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.498:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.170:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.171:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.172:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.375:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.28:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.29:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.30:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.31:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.376:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned. :mozilla.377:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned. :mozilla.267:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.268:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.56:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.57:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.58:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.59:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.60:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.61:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.62:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.63:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.401:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.123:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.124:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.125:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.126:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.127:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.128:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.129:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.130:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.405:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.406:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.407:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.408:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.409:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.416:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Spylog : Cleaned. :mozilla.51:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.420:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.421:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.422:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.426:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.427:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.428:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.429:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.430:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.431:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.432:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.95:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.96:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.97:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.98:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.99:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.198:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.461:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.195:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.196:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.197:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\Rob\Cookies\rob@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\WINDOWS\system32\winbfi32.dll -> Trojan.Agent.vg : Cleaned. ::Report end SmitFraudFix v2.119 Scan done at 21:07:56.45, Mon 11/06/2006 Run from C:\Documents and Settings\Rob\Desktop\New Folder\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\drvmog.dll FOUND ! C:\WINDOWS\system32\components\flx?.dll FOUND ! C:\WINDOWS\system32\components\flx??.dll FOUND ! C:\WINDOWS\system32\components\flx???.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Rob »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Rob\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Rob\FAVORI~1 C:\DOCUME~1\Rob\FAVORI~1\Antivirus Test Online.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\VirusBursters\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Logfile of HijackThis v1.99.1 Scan saved at 9:31:05 PM, on 11/6/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Trend Micro\Antivirus\pccguide.exe C:\Program Files\Trend Micro\Antivirus\PCClient.exe C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe C:\Program Files\Trend Micro\Antivirus\tmproxy.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Hijackthis\HijackThis.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Antivirus\pccguide.exe" O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Antivirus\PCClient.exe" O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe" /run O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvmog.dll,startup O4 - HKLM\..\Run: [lbmpmmc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\lbmpmmc.dll,ksfzzdg O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - Startup: Registration .LNK = C:\Program Files\Ubisoft\Dark Messiah of Might and Magic\RegistrationReminder.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Event Reminder.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1161631068046 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VVNFUg\command.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\tmproxy.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe When I ran the smitfraudfix, I was never asked to clean the registry. All it did was generate the report.

Flrman1 View Member Profile	Nov 7 2006, 06:02 PM Post #7
Malware Assassin Posts: 6,596 OS: XP Home, XP Pro, Vista	Did you not run the Smitfraudfix like these directions say?: QUOTE(flrman1 @ Nov 6 2006, 09:27 PM) [snapback]829625[/snapback] * Run the SmitfraudFix: Open the SmitfraudFix folder again and double-click the smitfraudfix.cmd file. Select option #2 - Clean by typing 2 and press "Enter" to delete the infected files. You will receive this prompt: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and press "Enter" and it will begin cleaning the infection. Next the tool will check to see if wininet.dll is infected. You may be prompted to replace the infected wininet.dll file if it is found. Answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process. If it doesn't restart your computer automatically when it is finished, restart it back to Windows normally yourself. A text file will appear onscreen, with results from the cleaning process. Copy and paste the contents of that report into your next reply to this thread along with a new Hijack This log. If the report doesn't open after you restart back to Windows normally, the report can be found at the root of the system drive, usually C:\rapport.txt. The log that you posted was the log from running option 1 just like you posted the first time, not option 2 like my directions say. Running option 1 doesn't fix anything. Option 1 only creates a log to show what infected files are there. Option 2 does the cleaning. Before we do anything else you need to boot to safe mode and follow those directions quoted above and run option 2 just as it says. Come back here after that and post the new c:\rapport.txt file and a new Hijack This log.

jkhypilot View Member Profile	Nov 7 2006, 10:50 PM Post #8
Member Posts: 19 OS: XP Pro sevice pack 2	Thanks for your patients with me. I have started in safe mode by using F8 and thru the msconfig menu. I made sure to select option 2 in the smitfraudfix menu and each time all it will do is create the log. I am never prompted to enter “Y” to clean. Is there anything to turn off or on in the msconfig menu? I am logged in as administrator. Thanks, Rob.

Flrman1 View Member Profile	Nov 8 2006, 11:27 AM Post #9
Malware Assassin Posts: 6,596 OS: XP Home, XP Pro, Vista	I'm not sure what is going on so I want you to try redownloading the smifraudfix again. First delete the old folder and files. The only thing I can think of right off hand other than the download being bad is that maybe you didn't unzip the smitfraudfix.zip file. Make sure it is unzipped before you run the fix.

jkhypilot View Member Profile	Nov 8 2006, 11:52 AM Post #10
Member Posts: 19 OS: XP Pro sevice pack 2	I deleted all the smitfraudfix files and downloaded them again, extracted all files saved them to my desktop, rebooted in safe mode ran the fix, (option 2) I still do not get the option to clean the registry.

Flrman1 View Member Profile	Nov 9 2006, 09:03 AM Post #12
Malware Assassin Posts: 6,596 OS: XP Home, XP Pro, Vista	* Click here to download smitRem.exe. Save the file to your desktop. It is a self extracting file. Doubleclick the smitRem.exe and it will extract the files to a smitRem folder on your desktop. Do not do anything with it yet. You will run the RunThis.bat file later in safe mode. If the link to SmitRem above is not working try this one. * Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode. * Restart your computer into safe mode now. Perform the following steps in safe mode: * Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. * Run AVG Anti-Spyware: Launch AVG Anti-Spyware by double-clicking the icon on your desktop. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan". It will then begin the scanning process, be patient it may take a while for the scan to complete. When the scan is complete, you must select an action. Select "Apply all actions" Next select the "Reports" icon at the top. Select the "Save report as" button in the lower left hand of the screen Save the report as a text file and save it to your desktop. Close AVG Anti-Spyware. * Go to Control Panel > Internet Options. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK. * Next go to Control Panel > Display. Click on the "Desktop" tab then click the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" you should see an entry checked called something like "Security info" or similar. If it is there, select that entry and click the "Delete" button. Click OK then Apply and OK. * Restart back into Windows normally now. * Run ActiveScan online virus scan here When the scan is finished, save the results from the scan! SmitRem creates a log file with the results of it's fix in C:\smitfiles.txt. Go to your C drive and locate the smitfiles.txt file. Copy and paste the contents of the smitfiles.txt file in your next reply here along with a new HiJackThis log and the results from ActiveScan

jkhypilot View Member Profile	Nov 9 2006, 10:03 AM Post #13
Member Posts: 19 OS: XP Pro sevice pack 2	smitrm.exe AVG ran fine. I still have the icon with the occasional popup in the tray. Also, sometimes I get a message saying that DEP has activated for internet explorer. I have never used explorer with computer. --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 9:41:40 AM 11/9/2006 + Scan result: C:\Program Files\VSAdd-in\VSAdd-in.dll -> Adware.Agent : Cleaned. :mozilla.63:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.64:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.86:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.87:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.88:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.89:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.41:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.106:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.103:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned. :mozilla.59:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned. :mozilla.43:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.44:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.71:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.72:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.73:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.84:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.90:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.91:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.85:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned. :mozilla.56:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.51:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.57:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.58:C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\hcyly9tr.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end Logfile of HijackThis v1.99.1 Scan saved at 9:58:14 AM, on 11/9/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe C:\Program Files\Trend Micro\Antivirus\tmproxy.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Trend Micro\Antivirus\pccguide.exe C:\Program Files\Trend Micro\Antivirus\PCClient.exe C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Steam\Steam.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Antivirus\pccguide.exe" O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Antivirus\PCClient.exe" O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe" /run O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvmog.dll,startup O4 - HKLM\..\Run: [lbmpmmc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\lbmpmmc.dll,ksfzzdg O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize O4 - Startup: Registration .LNK = C:\Program Files\Ubisoft\Dark Messiah of Might and Magic\RegistrationReminder.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Event Reminder.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1161631068046 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Antivirus\tmproxy.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Flrman1 View Member Profile	Nov 9 2006, 08:05 PM Post #14
Malware Assassin Posts: 6,596 OS: XP Home, XP Pro, Vista	We need to get the Smitfraudfix to run. When you boot to safe mode to run it are you doing exactly this?: Open the SmitfraudFix folder again and double-click the smitfraudfix.cmd file. Select option #2 - Clean by typing 2 and press "Enter" to delete the infected files. Are you selecting option 2 by pressing the 2 key on your keyboard and then hitttng the Enter key? I can only assume at this point that you aren't doing it exactly right. This post has been edited by flrman1: Nov 9 2006, 08:05 PM

jkhypilot View Member Profile	Nov 10 2006, 12:12 AM Post #15
Member Posts: 19 OS: XP Pro sevice pack 2	I am pretty sure I am doing it all correctly. I extracted all files from the smitfraudfix tool and saved them on my desktop. Rebooted in safe mode using the BOOT.INI tab in msconfig and selected /SAFEBOOT minimal. Opened the smitfraudfix tool and clicked on the smitfraudfix Windows NT command script icon. Clicked past the first page (press a key to continue) Selected option 2. Clean [safe mode recommended] enter The program runs for about 5 seconds then generates the rapport to the notepad. I suppose I could be selecting something wrong in the msconfig menu. On the safeboot option on the BOOT.INI tab I am given 4 different options to boot from such as network, dsrepair and such. I think the default “minimal” is correct. I have a NTFS {SATA} hard drive but that should have no Bering on extracting a zip file. Rob. P.S. I have had this computer for just over a week now and am new to XP pro.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Spyware Detection Alert 12	15 / 481	6th March 2007 - 08:11 PM Mr Tumnus started - last by don77
Virus, Spyware and Trojan Removal Help me to remove spyware(Fake alert) from my system	7 / 2,607	17th August 2008 - 07:11 AM sagarmr started - last by kahdah
Virus, Spyware and Trojan Removal virus and spyware virus alert by time & date 12	23 / 604	27th October 2008 - 06:54 PM nrcricardo started - last by kahdah
Virus, Spyware and Trojan Removal spyware found alert	0 / 72	10th January 2009 - 10:57 AM adam99 started - last by adam99