psguard [RESOLVED]
Started by
Valleysound
, Aug 02 2005 07:24 PM
-
This topic is locked
#1
Posted 02 August 2005 - 07:24 PM
Valleysound
-
- Member
-
- 4 posts
New Member
#2
Posted 02 August 2005 - 07:37 PM
greyknight17
-
- Visiting Consultant
-
- 16,560 posts
Malware Expert
Welcome to GTG.
Please read the first link in my signature and follow the steps outlined there. When you are ready, post the HijackThis log here.
Please read the first link in my signature and follow the steps outlined there. When you are ready, post the HijackThis log here.
#3
Posted 04 August 2005 - 07:03 PM
Valleysound
- Topic Starter
-
- Member
-
- 4 posts
New Member
I followed the instructions. Bitdefender would not load or run in safe mode. I had to go to regular mode. The Psguard icon comes back when I try to open a web session. A reg file won't end when I try to shut down.
Here's the log.
Logfile of HijackThis v1.99.1
Scan saved at 8:50:01 PM, on 8/4/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\windows\system32\winserver.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Program Files\HJT\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {D11CC706-CB90-46DD-A4DE-8A2F956267F8} - C:\WINDOWS\System32\ooml.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [PSGuard spyware remover] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\RunServices: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKCU\..\Run: [win32 system server] c:\windows\system32\winserver.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
O4 - Global Startup: D-Link REG Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Here's the log.
Logfile of HijackThis v1.99.1
Scan saved at 8:50:01 PM, on 8/4/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\windows\system32\winserver.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Program Files\HJT\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {D11CC706-CB90-46DD-A4DE-8A2F956267F8} - C:\WINDOWS\System32\ooml.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [PSGuard spyware remover] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\RunServices: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKCU\..\Run: [win32 system server] c:\windows\system32\winserver.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
O4 - Global Startup: D-Link REG Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
#4
Posted 04 August 2005 - 09:20 PM
greyknight17
-
- Visiting Consultant
-
- 16,560 posts
Malware Expert
I suggest getting Service Pack 4 as soon as you can for Windows 2000 
Download CWShredder http://www.greyknigh.../CWShredder.exe
Right click a blank part of your desktop & select New->Folder. Call it SPFix. Go to http://www.derbilk.de/404.html and download SpSeHjfix. Get the one that's specified for your Operating System. So if you have Windows 98, get the one that's listed for Windows 98.
Disconnect from the net and close all programs. Run SpSeHjfix and click on 'Start Disinfection'. When it's finished it will reboot your machine to finish the cleaning process. The tool creates a log of the fix which will appear in the folder.
If it doesn't find any of the SE files or any hidden reinstallers it will say system clean and not go on to next stage.
Now run the CWShredder and hit the Fix button.
Reboot and post the log that was created by SpSeHjfix. Hold off on the HijackThis log until you do the below steps (at the end, then post HijackThis log).
Download smitRem at http://noahdfear.gee.../click.php?id=1 and save the file to your desktop.
Please download Ewido Security Suite at http://www.ewido.net/en/download/ and read the Ewido setup instructions at http://rstones12.gee.../ewidosetup.htm. Install it, and update the definitions to the newest files. Do NOT run a scan yet.
If you have not already installed Ad-Aware SE 1.06, follow the download and setup instructions at http://rstones12.gee...areSE_setup.htm. Otherwise, check for updates. Don't run it yet!
Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {D11CC706-CB90-46DD-A4DE-8A2F956267F8} - C:\WINDOWS\System32\ooml.dll (file missing)
O4 - HKLM\..\Run: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [PSGuard spyware remover] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\RunServices: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKCU\..\Run: [win32 system server] c:\windows\system32\winserver.exe
Run the smitRem.exe tool you downloaded earlier. Follow the prompts on the screen. Wait for the tool to complete and disk cleanup to finish.
Delete these if found:
C:\WINDOWS\System32\ooml.dll
C:\WINDOWS\System32\intell32.exe
C:\Program Files\PSGuard\
c:\windows\system32\winserver.exe
The tool will create a log named smitfiles.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
Open Ad-aware and do a full scan. Remove all it finds.
Run Ewido:
* Click on scanner.
* Click on Complete System Scan and the scan will begin.
* NOTE: During some scans with ewido it is finding cases of false positives.
* You will need to step through the process of cleaning files one-by-one.
* If Ewido detects a file you KNOW to be legitimate, select none as the action.
* Do NOT select 'Perform action on all infections'.
* If you are unsure of any entry found, select none for now.
* When the scan is finished, click the Save report button at the bottom of the screen.
* Save the report to your desktop.
Close Ewido.
Next go to Control Panel->Display->Desktop->Customize Desktop->Web-> Uncheck 'Security Info' if present.
Reboot back into Windows and go to http://www.pandasoft...n_principal.htm to do a full system scan. Make sure the autoclean box is checked. Save the scan log and post it along with a new HijackThis log, the contents of the smitfiles.txt log and the Ewido log.
Download CWShredder http://www.greyknigh.../CWShredder.exe
Right click a blank part of your desktop & select New->Folder. Call it SPFix. Go to http://www.derbilk.de/404.html and download SpSeHjfix. Get the one that's specified for your Operating System. So if you have Windows 98, get the one that's listed for Windows 98.
Disconnect from the net and close all programs. Run SpSeHjfix and click on 'Start Disinfection'. When it's finished it will reboot your machine to finish the cleaning process. The tool creates a log of the fix which will appear in the folder.
If it doesn't find any of the SE files or any hidden reinstallers it will say system clean and not go on to next stage.
Now run the CWShredder and hit the Fix button.
Reboot and post the log that was created by SpSeHjfix. Hold off on the HijackThis log until you do the below steps (at the end, then post HijackThis log).
Download smitRem at http://noahdfear.gee.../click.php?id=1 and save the file to your desktop.
Please download Ewido Security Suite at http://www.ewido.net/en/download/ and read the Ewido setup instructions at http://rstones12.gee.../ewidosetup.htm. Install it, and update the definitions to the newest files. Do NOT run a scan yet.
If you have not already installed Ad-Aware SE 1.06, follow the download and setup instructions at http://rstones12.gee...areSE_setup.htm. Otherwise, check for updates. Don't run it yet!
Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {D11CC706-CB90-46DD-A4DE-8A2F956267F8} - C:\WINDOWS\System32\ooml.dll (file missing)
O4 - HKLM\..\Run: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [PSGuard spyware remover] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\RunServices: [win32 system server] c:\windows\system32\winserver.exe
O4 - HKCU\..\Run: [win32 system server] c:\windows\system32\winserver.exe
Run the smitRem.exe tool you downloaded earlier. Follow the prompts on the screen. Wait for the tool to complete and disk cleanup to finish.
Delete these if found:
C:\WINDOWS\System32\ooml.dll
C:\WINDOWS\System32\intell32.exe
C:\Program Files\PSGuard\
c:\windows\system32\winserver.exe
The tool will create a log named smitfiles.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
Open Ad-aware and do a full scan. Remove all it finds.
Run Ewido:
* Click on scanner.
* Click on Complete System Scan and the scan will begin.
* NOTE: During some scans with ewido it is finding cases of false positives.
* You will need to step through the process of cleaning files one-by-one.
* If Ewido detects a file you KNOW to be legitimate, select none as the action.
* Do NOT select 'Perform action on all infections'.
* If you are unsure of any entry found, select none for now.
* When the scan is finished, click the Save report button at the bottom of the screen.
* Save the report to your desktop.
Close Ewido.
Next go to Control Panel->Display->Desktop->Customize Desktop->Web-> Uncheck 'Security Info' if present.
Reboot back into Windows and go to http://www.pandasoft...n_principal.htm to do a full system scan. Make sure the autoclean box is checked. Save the scan log and post it along with a new HijackThis log, the contents of the smitfiles.txt log and the Ewido log.
#5
Posted 05 August 2005 - 06:45 AM
Valleysound
- Topic Starter
-
- Member
-
- 4 posts
New Member
The other logs will be here in a few hours.
(8/5/05 8:32:01 AM) SPSeHjFix started v1.1.2
(8/5/05 8:32:01 AM) OS: Win2000 Service Pack 1 (5.0.2195)
(8/5/05 8:32:01 AM) Language: english
(8/5/05 8:32:01 AM) Win-Path: C:\WINDOWS
(8/5/05 8:32:01 AM) System-Path: C:\WINDOWS\System32
(8/5/05 8:32:01 AM) Temp-Path: C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\
(8/5/05 8:32:11 AM) Disinfection started
(8/5/05 8:32:11 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:11 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:11 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:11 AM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\valley~1\locals~1\temp\se.dll/space.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page:
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\valley~1\locals~1\temp\se.dll/space.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL:
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(8/5/05 8:32:11 AM) Stealth-String not found
(8/5/05 8:32:11 AM) No locked Files to delete. End without Reboot
(8/5/05 8:32:14 AM) Disinfection started
(8/5/05 8:32:14 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:14 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:14 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:14 AM) Bad IE-pages: (none)
(8/5/05 8:32:14 AM) Stealth-String not found
(8/5/05 8:32:14 AM) No locked Files to delete. End without Reboot
(8/5/05 8:32:14 AM) Disinfection started
(8/5/05 8:32:14 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:15 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:15 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:15 AM) Bad IE-pages: (none)
(8/5/05 8:32:15 AM) Stealth-String not found
(8/5/05 8:32:15 AM) No locked Files to delete. End without Reboot
(8/5/05 8:32:52 AM) Disinfection started
(8/5/05 8:32:52 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:52 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:52 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:52 AM) Bad IE-pages: (none)
(8/5/05 8:32:52 AM) Stealth-String not found
(8/5/05 8:32:52 AM) No locked Files to delete. End without Reboot
(8/5/05 8:33:06 AM) Disinfection started
(8/5/05 8:33:06 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:33:06 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:06 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:06 AM) Bad IE-pages: (none)
(8/5/05 8:33:06 AM) Stealth-String not found
(8/5/05 8:33:06 AM) No locked Files to delete. End without Reboot
(8/5/05 8:33:17 AM) SPSeHjFix started v1.1.2
(8/5/05 8:33:17 AM) OS: Win2000 Service Pack 1 (5.0.2195)
(8/5/05 8:33:17 AM) Language: english
(8/5/05 8:33:17 AM) Win-Path: C:\WINDOWS
(8/5/05 8:33:17 AM) System-Path: C:\WINDOWS\System32
(8/5/05 8:33:17 AM) Temp-Path: C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\
(8/5/05 8:33:20 AM) Disinfection started
(8/5/05 8:33:20 AM) Bad-Dll(IEP): (not found)
(8/5/05 8:33:20 AM) Bad-Dll(IEP) in BHO: (not found)
(8/5/05 8:33:20 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:20 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:20 AM) Bad IE-pages: (none)
(8/5/05 8:33:20 AM) Stealth-String not found
(8/5/05 8:33:20 AM) Not infected->END
(8/5/05 8:45:42 AM) SPSeHjFix started v1.1.2
(8/5/05 8:45:42 AM) OS: Win2000 Service Pack 1 (5.0.2195)
(8/5/05 8:45:42 AM) Language: english
(8/5/05 8:45:42 AM) Win-Path: C:\WINDOWS
(8/5/05 8:45:42 AM) System-Path: C:\WINDOWS\System32
(8/5/05 8:45:42 AM) Temp-Path: C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\
(8/5/05 8:45:45 AM) Disinfection started
(8/5/05 8:45:45 AM) Bad-Dll(IEP): (not found)
(8/5/05 8:45:45 AM) Bad-Dll(IEP) in BHO: (not found)
(8/5/05 8:45:46 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:45:46 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:45:46 AM) Bad IE-pages: (none)
(8/5/05 8:45:46 AM) Stealth-String not found
(8/5/05 8:45:46 AM) Not infected->END
(8/5/05 8:32:01 AM) SPSeHjFix started v1.1.2
(8/5/05 8:32:01 AM) OS: Win2000 Service Pack 1 (5.0.2195)
(8/5/05 8:32:01 AM) Language: english
(8/5/05 8:32:01 AM) Win-Path: C:\WINDOWS
(8/5/05 8:32:01 AM) System-Path: C:\WINDOWS\System32
(8/5/05 8:32:01 AM) Temp-Path: C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\
(8/5/05 8:32:11 AM) Disinfection started
(8/5/05 8:32:11 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:11 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:11 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:11 AM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\valley~1\locals~1\temp\se.dll/space.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page:
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\valley~1\locals~1\temp\se.dll/space.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL:
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(8/5/05 8:32:11 AM) Stealth-String not found
(8/5/05 8:32:11 AM) No locked Files to delete. End without Reboot
(8/5/05 8:32:14 AM) Disinfection started
(8/5/05 8:32:14 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:14 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:14 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:14 AM) Bad IE-pages: (none)
(8/5/05 8:32:14 AM) Stealth-String not found
(8/5/05 8:32:14 AM) No locked Files to delete. End without Reboot
(8/5/05 8:32:14 AM) Disinfection started
(8/5/05 8:32:14 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:15 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:15 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:15 AM) Bad IE-pages: (none)
(8/5/05 8:32:15 AM) Stealth-String not found
(8/5/05 8:32:15 AM) No locked Files to delete. End without Reboot
(8/5/05 8:32:52 AM) Disinfection started
(8/5/05 8:32:52 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:32:52 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:52 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:32:52 AM) Bad IE-pages: (none)
(8/5/05 8:32:52 AM) Stealth-String not found
(8/5/05 8:32:52 AM) No locked Files to delete. End without Reboot
(8/5/05 8:33:06 AM) Disinfection started
(8/5/05 8:33:06 AM) Bad-Dll(IEP): c:\docume~1\valley~1\locals~1\temp\se.dll
(8/5/05 8:33:06 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:06 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:06 AM) Bad IE-pages: (none)
(8/5/05 8:33:06 AM) Stealth-String not found
(8/5/05 8:33:06 AM) No locked Files to delete. End without Reboot
(8/5/05 8:33:17 AM) SPSeHjFix started v1.1.2
(8/5/05 8:33:17 AM) OS: Win2000 Service Pack 1 (5.0.2195)
(8/5/05 8:33:17 AM) Language: english
(8/5/05 8:33:17 AM) Win-Path: C:\WINDOWS
(8/5/05 8:33:17 AM) System-Path: C:\WINDOWS\System32
(8/5/05 8:33:17 AM) Temp-Path: C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\
(8/5/05 8:33:20 AM) Disinfection started
(8/5/05 8:33:20 AM) Bad-Dll(IEP): (not found)
(8/5/05 8:33:20 AM) Bad-Dll(IEP) in BHO: (not found)
(8/5/05 8:33:20 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:20 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:33:20 AM) Bad IE-pages: (none)
(8/5/05 8:33:20 AM) Stealth-String not found
(8/5/05 8:33:20 AM) Not infected->END
(8/5/05 8:45:42 AM) SPSeHjFix started v1.1.2
(8/5/05 8:45:42 AM) OS: Win2000 Service Pack 1 (5.0.2195)
(8/5/05 8:45:42 AM) Language: english
(8/5/05 8:45:42 AM) Win-Path: C:\WINDOWS
(8/5/05 8:45:42 AM) System-Path: C:\WINDOWS\System32
(8/5/05 8:45:42 AM) Temp-Path: C:\DOCUME~1\VALLEY~1\LOCALS~1\Temp\
(8/5/05 8:45:45 AM) Disinfection started
(8/5/05 8:45:45 AM) Bad-Dll(IEP): (not found)
(8/5/05 8:45:45 AM) Bad-Dll(IEP) in BHO: (not found)
(8/5/05 8:45:46 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:45:46 AM) UBF: 4 - UBB: 3 - UBR: 5
(8/5/05 8:45:46 AM) Bad IE-pages: (none)
(8/5/05 8:45:46 AM) Stealth-String not found
(8/5/05 8:45:46 AM) Not infected->END
Edited by Valleysound, 05 August 2005 - 08:15 AM.
#6
Posted 05 August 2005 - 12:39 PM
Valleysound
- Topic Starter
-
- Member
-
- 4 posts
New Member
Here's some other scans.
Pandasoftware:
Incident Status Location
Adware:adware/psguard No disinfected Windows Registry
Virus:Trj/Agent.TZ Disinfected C:\WINDOWS\SYSTEM32\winserv.dll
Virus:Trj/Dermon.C Disinfected C:\WINDOWS\SYSTEM32\winserver.exe
Ewido:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 9:43:16 AM, 8/5/2005
+ Report-Checksum: EF73F764
+ Scan result:
No infected objects found.
::Report End
Smitrem:
Testing presence of HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD ---------
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD
HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD\PSGuard
Deleting ShudderLTD ----------
Checking if HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD is still present ------
Deleting leftovers in registry ------
leftovers deleted!
HiJackthis:
Logfile of HijackThis v1.99.1
Scan saved at 2:39:46 PM, on 8/5/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\HJT\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
O4 - Global Startup: D-Link REG Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Can you tell me if I should shut down some of the antivirus programs too.
Pandasoftware:
Incident Status Location
Adware:adware/psguard No disinfected Windows Registry
Virus:Trj/Agent.TZ Disinfected C:\WINDOWS\SYSTEM32\winserv.dll
Virus:Trj/Dermon.C Disinfected C:\WINDOWS\SYSTEM32\winserver.exe
Ewido:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 9:43:16 AM, 8/5/2005
+ Report-Checksum: EF73F764
+ Scan result:
No infected objects found.
::Report End
Smitrem:
Testing presence of HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD ---------
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD
HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD\PSGuard
Deleting ShudderLTD ----------
Checking if HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD is still present ------
Deleting leftovers in registry ------
leftovers deleted!
HiJackthis:
Logfile of HijackThis v1.99.1
Scan saved at 2:39:46 PM, on 8/5/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\HJT\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus G Wireless Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exe
O4 - Global Startup: D-Link REG Utility.lnk = C:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\Reg.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Can you tell me if I should shut down some of the antivirus programs too.
Edited by Valleysound, 05 August 2005 - 12:41 PM.
#7
Posted 05 August 2005 - 07:53 PM
greyknight17
-
- Visiting Consultant
-
- 16,560 posts
Malware Expert
Delete these two files:
C:\WINDOWS\SYSTEM32\winserv.dll
C:\WINDOWS\SYSTEM32\winserver.exe
My suggestion is to upgrade Windows to Service Pack 4 and also update to IE 6.0 and get the updates for that also. That should provide you with more security.
You only have ONE antivirus program installed there and it's the one I asked you to install also. So no, I have to say keep it on unless you don't mind uninvited trojans/viruses coming into your computer
Your log is clean.
To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.
Are there any problems now? If not, you should be set to go.
C:\WINDOWS\SYSTEM32\winserv.dll
C:\WINDOWS\SYSTEM32\winserver.exe
My suggestion is to upgrade Windows to Service Pack 4 and also update to IE 6.0 and get the updates for that also. That should provide you with more security.
You only have ONE antivirus program installed there and it's the one I asked you to install also. So no, I have to say keep it on unless you don't mind uninvited trojans/viruses coming into your computer
Your log is clean.
To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.
Are there any problems now? If not, you should be set to go.
#8
Posted 22 August 2005 - 08:38 PM
greyknight17
-
- Visiting Consultant
-
- 16,560 posts
Malware Expert
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
