A fatal error in IE has ocurred at 0028:C00IIE36 in VXD VMM (01) + 00010E36
Error was caused by Trojan-spy.html.smitfraud.c
- System can not function in normal mode. Please check your security settings
- Scan your PC with any available antivirus/antispyware
remover program to fix the problem. Even my antivirus Trend Micro Internet security is not displaying any virus.
I have a red round sign on the left corner next to where the time is diplayed and on clicking it takes me to
http://www.psguard.com/?aff=37&sub=0
and says that My computer is infected with virus. I downloaded psguard as well. Later i deleted this psguard and still this red glowing sign keeps on displaying !!!!! I am really confused with this.
i hv tried all the antispy softwares - sbybot,shredder ,cleanup and even tried to download spyblaster twice but cud not as it shows that the file is currupt due to bad sector or some virus !!!!!
My operating system is windows 98 se.
I tried Kaspersky free virus removal tool and it shows the following viruses in my comp :
KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Friday, July 01, 2005 03:14:34
Operating System: Microsoft Windows 98 SE
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 30/06/2005
Kaspersky Anti-Virus database records: 128518
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\WINDOWS\TEMP\
Scan Statistics:
Total number of scanned objects: 6595
Number of viruses found: 4
Number of infected objects: 7
Number of suspicious objects: 0
Duration of the scan process: 606 sec
Infected Object Name - Virus Name
C:\WINDOWS\SYSTEM\pcli.dll Infected: Trojan.Win32.StartPage.ix
C:\WINDOWS\SYSTEM\oleadm.dll Infected: Trojan.Win32.Agent.ff
C:\WINDOWS\SYSTEM\WININET.DLL Infected: Virus.Win32.Nsag.a
C:\WINDOWS\SYSTEM\intel32.exe Infected: Trojan.Win32.Agent.ff
C:\WINDOWS\TEMP\se.dll Infected: Trojan.Win32.StartPage.zd
C:\WINDOWS\uninstIU.exe Infected: Trojan.Win32.Agent.ff
C:\WINDOWS\TEMP\se.dll Infected: Trojan.Win32.StartPage.zd
Scan process completed.
i am again running the scan on - Select traget : MY computer
It shows @ 46% -
No of Virus found : 6
No of infected objects : 9
The hijackthis report is :
Logfile of HijackThis v1.99.1
Scan saved at 4:01:34 AM, on 07/01/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\SYSTEM\INTEL32.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\DOWNLOADS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
N1 - Netscape 4: user_pref("browser.startup.homepage", "www.in.indiatimes.com"); (C:\Program Files\Netscape\Users\fancydel\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {343B3EA1-E9C4-11D9-9AE0-000FA3294887} - C:\WINDOWS\SYSTEM\PCLI.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MagnifyingGlass] C:\WINDOWS\DESKTOP\FANCY\MY DOCUMENTS\MY DOCUMENTS\MY RECEIVED FILES\Magnifying Glass.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\SYSTEM\intel32.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Multimedia Hotkey Program.lnk = C:\Program Files\Multimedia Hotkey Program\MMKbd.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O12 - Plugin for .avi: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npavi32.dll
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.c...tacceptlang.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spys...rCabInstall.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...ebscan_ansi.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 203.94.243.70,203.94.227.70
O18 - Filter: text/html - {343B3EA0-E9C4-11D9-9AE0-000FCC65ED1C} - C:\WINDOWS\SYSTEM\PCLI.DLL
O18 - Filter: text/plain - {343B3EA0-E9C4-11D9-9AE0-000FCC65ED1C} - C:\WINDOWS\SYSTEM\PCLI.DLL
Pls help & advice what has to be done as i am really scared !!!!! Pls advice a simple procedure so that I can really get rid of this tension. I hv just one computer with ASDL connection and while running on safe mode i am unable to work on the internet. Pls i do not want to format my computer.
Thanks in advance
Nitin
Edited by 2nitin2, 30 June 2005 - 04:50 PM.
Sign In
Create Account
