Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Spyware- Malware [RESOLVED]


  • This topic is locked This topic is locked

#16
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log, and we'll clean up what's left. :tazz:

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

+++++++++++++++

Are you still redirected to redzip.com?
  • 0

Advertisements


#17
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
When the computer rebooted and continued to run L2 - it finished and displayed the results and then locked up. I saw it said that it was killing rundll.exe
  • 0

#18
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
okay, at this moment what is your status? how is your system running? try rebooting again.
  • 0

#19
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Things seem to be working fine before and after I rebooted. I am not be redirected yet.

Here is the HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 8:47:39 AM, on 8/26/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Eagle Point Software\EGPT\Program\egpt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Bentley\Program\MicroStation\ustation.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Temp\HijackThis.exe

O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1125001154640
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installen...gine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = age.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = age.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = age.net
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FLEXMlm Service 1 - Macrovision Corporation - C:\FLEXLM\bin\lmgrd.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
  • 0

#20
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
very good, that is good to hear :tazz:

were you able to acquire the results from the L2Mfix? can you post them.

please re-run only the HOSTER tool again, the instructions are found on post#12 of this topic.

let us verify if you will not be redirected to redzip.com

please scan now with Panda Scan, then save the results, Post it.

please post a new hijackthis log.
  • 0

#21
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
I still can't get Panda Scan to run. I am not being redirected as of yet. I am still getting these windows security popups. What next?
  • 0

#22
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
Search for the jobs:

Open notepad and copy and paste next in it:

dir %Windir%\tasks /a h > files.txt
notepad files.txt

Save this as findjobs.bat , choose to save it as *all files and place it on your desktop.

Doubleclick on findjobs.bat and post the content of the txtfile you get in your next reply.
(NOTE: You can delete this file afterwards.)

++++++++++++++++
let us try another online scan if it will work:
Please do an online scan with Kaspersky Webscanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Standard
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
    Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
++++++++++++++++
can you give me the details of the windows security popups that appeared?
  • 0

#23
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Here is the log from Mcafee

08/30/2005 07:49:35 AM -- Scan Started: 8/30/2005 7:49:35 AM
08/30/2005 08:57:27 AM -- "C:\WINNT\system32\hclean32.exe" "QHosts-17" "5"
08/30/2005 08:59:24 AM -- "C:\WINNT\system32\rdsndin.exe" "Spy-Agent.i" "5"
08/30/2005 02:59:06 PM -- -------------------
08/30/2005 02:59:06 PM -- Total files scanned: 368517
08/30/2005 02:59:06 PM -- Files detected: 2
08/30/2005 02:59:06 PM -- Scan Done: 8/30/2005 2:59:06 PM


findjobs.bat

Volume in drive C is Local Disk
Volume Serial Number is FC5A-E248

Directory of C:\WINNT\tasks

08/30/2005 04:14a <DIR> .
08/30/2005 04:14a <DIR> ..
05/08/2001 08:00a 65 desktop.ini
08/29/2005 07:56a 392 McAfee.com Scan for Viruses - My Computer (STATION7-king).job
08/30/2005 07:56a 476 McAfee.com Update Check (AGE-dking).job
08/30/2005 07:57a 492 McAfee.com Update Check (STATION7-Administrator).job
08/30/2005 07:53a 476 McAfee.com Update Check (STATION7-David).job
08/22/2005 02:09p 476 McAfee.com Update Check (STATION7-dking).job
08/30/2005 07:57a 476 McAfee.com Update Check (STATION7-Guest).job
08/30/2005 04:14a 474 McAfee.com Update Check (STATION7-king).job
08/30/2005 07:53a 478 McAfee.com Update Check (STATION7-PUBLIC).job
08/26/2005 08:43a 6 SA.DAT
10 File(s) 3,811 bytes

Directory of C:\Documents and Settings\king\Desktop


Kaspersky Anti-Virus Web Scanner - while the scan was running I click on a link at reset the virus scan. Let me know if I need to run it again.
  • 0

#24
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

Please read the instructions for About:Buster then download it to a safe location where you can easily remember it.
Please Download the stand-alone version of CoolWebShredder
Download Cleanup.

Save all of these files somewhere you will remember like to the Desktop.

Run the CleanUp! installer. You dont need to do anything with it right now. Do NOT run it yet.

Update About:Buster
  • Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
  • Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
  • Click "OK" at the prompt with instructions.
  • Click "Update" and then "Check For Update" to begin the update process.
  • If any updates exist please download them by clicking "Download Update" then click the X to close that window.
  • Now close About:Buster
Update CWShredder
  • Open CWShredder and click I AGREE
  • Click Check For Update
  • Close CWShredder
Click HERE to download Pocket Killbox by Option^Explicit. Double-click Killbox.exe to run it.

Select "Delete on Reboot".

Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C

C:\WINNT\system32\hclean32.exe
C:\WINNT\system32\rdsndin.exe



Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually.

Restart in SAFE MODE and Run those files through Killbox once more to be sure nothing survived.

This time place a tick by any of these selections available

"Standard File Kill"
"End Explorer Shell while Killing File"
"Unregister .dll before Deleting"


If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

While you are still in SAFE MODE.
Please run about:buster by RubbeRDuckY:
  • Click Begin Removal.
  • Click Yes to allow it to shutdown explorer.exe.
  • It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
  • When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
  • Reboot your computer into safe mode again
In the event you get an error message then do the following:
Start > Run then paste this in the dialog box

regsvr32 C:\Windows\System32\COMCTL32.OCX

Run about:buster again following the same instructions as above, this time without the restart at the end

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

Now run CleanUp!. Click CleanUp and allow it to delete all the temporary files. Reboot your computer into normal windows.

Let us test if you can now have online virus scans:

Please run an on-line virus scan at Kaspersky Online Scan or if that doesnt work, you can have an On-line scan at this sites:
Trend Micro or Panda Scan or BitDefender.
(Please post the results of the scan(s) in your next reply)

After all that, please post back with how things went as well as the logs requested and a new HiJackThis log.

Good Luck!
  • 0

#25
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Friday, September 02, 2005 12:47:40
Operating System: Microsoft Windows 2000 Professional, Service Pack 2 (Build 2195)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 2/09/2005
Kaspersky Anti-Virus database records: 138717
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 198580
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 7336 sec
No malware has been detected. The sections that have been scanned are CLEAN.

Scan process completed.

Scan started on [9/2/2005] at [10:14:29 AM]
------------------------------------------------
No Ads Found!
------------------------------------------------
No Files Found!
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 10:14:30 AM


AboutBuster 5.0 reference file 31
Scan started on [9/2/2005] at [10:14:58 AM]
------------------------------------------------
No Ads Found!
------------------------------------------------
No Files Found!
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 10:14:58 AM


AboutBuster 5.0 reference file 31
Scan started on [9/2/2005] at [10:15:47 AM]
------------------------------------------------
No Ads Found!
------------------------------------------------
No Files Found!
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 10:15:47 AM


AboutBuster 5.0 reference file 31
Scan started on [9/2/2005] at [10:20:30 AM]
------------------------------------------------
No Ads Found!
------------------------------------------------
No Files Found!
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 10:20:31 AM



Logfile of HijackThis v1.99.1
Scan saved at 12:51:02 PM, on 9/2/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Eagle Point Software\EGPT\Program\egpt.exe
C:\Bentley\Program\MicroStation\ustation.exe
C:\Temp\HijackThis.exe

O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1125001154640
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installen...gine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = age.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = age.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = age.net
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FLEXMlm Service 1 - Macrovision Corporation - C:\FLEXLM\bin\lmgrd.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe


It seem to go fine... I didn't have any errors.
  • 0

Advertisements


#26
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
Please close all remaining windows, disconnect from the internet, open HijackThis then click SCAN. Please put a check on the following items listed below:

O1 - Hosts: localhost 127.0.0.1

Make sure to double check the items you have selected, then click Fix Checked.

Install MVPS Hosts File The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer

Other than that I dont see any presence of malware. Shall we proceed with some tips to prevent future re-infections? :tazz:
  • 0

#27
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
MCAFEE FOUND THIS.

09/06/2005 10:07:49 AM -- Scan Started: 9/6/2005 10:07:49 AM
09/06/2005 10:42:59 AM -- "C:\WINNT\system32\rdsndin.exe" "Spy-Agent.i" "5"
09/06/2005 02:49:20 PM -- -------------------
09/06/2005 02:49:20 PM -- Total files scanned: 398345
09/06/2005 02:49:20 PM -- Files detected: 1
09/06/2005 02:49:20 PM -- Scan Done: 9/6/2005 2:49:20 PM
  • 0

#28
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
open hijackthis > config > misc tools > delete file on reboot

search for the file:
C:\WINNT\system32\rdsndin.exe

agree with the reboot.

let me know how it goes :tazz:
  • 0

#29
2dlking

2dlking

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
I think it is deleted, I can't find it now. I still have a program that I can't open. I have reinstalled it but with no luck. Does spyware keep programs from opening up?
  • 0

#30
kool808

kool808

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,690 posts
yes it is possible, what is the program? If you have clean logs from all the scans and diagnosis it could also be from a corrupted installation.

post a new hijackthis log. :tazz:
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP