Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

CWS.look2me is killing my pc [CLOSED]


  • This topic is locked This topic is locked

#1
jet_17

jet_17

    New Member

  • Member
  • Pip
  • 8 posts
Logfile of HijackThis v1.99.1
Scan saved at 10:02:37, on 21/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] DSLAGENT.EXE USB
O4 - HKLM\..\Run: [GsiFinal] rundll32 gspndll.dll,postInstall final
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Startup: Reboot.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1129654637156
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\hrp6057se.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: CWShredder Service - Unknown owner - C:\DOCUME~1\John\LOCALS~1\Temp\Rar$EX00.483\CWShredder.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe


Can anyone help?
  • 0

Advertisements


#2
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Hello and welcome to GeeksToGo! My name is Kat, and I will be helping you today. :tazz: Please either save these instructions to your desktop using Notepad, or print them for easy reference.

1. Please download WebRoot SpySweeper from HERE (It's a 2 week trial):
  • Click the Free Trial link under to "SpySweeper" to download the program.
  • Install it.
  • Once the program is installed, it will open.
  • It will prompt you to update to the latest definitions, click Yes.
  • Once the definitions are installed, click Sweep Now on the left side.
  • Click the Start button.
  • When it's done scanning, click the Next button.
  • Make sure everything has a check next to it, then click the Next button.
  • It will remove all of the items found.
  • Click Session Log in the upper right corner, copy everything in that window.
  • Click the Summary tab and click Finish.
  • Paste the contents of the session log you copied into your next reply.
2. please run this online virus scan: ActiveScan

3. Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and lastly a copy of the log from SpySweeper
  • 0

#3
jet_17

jet_17

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
********
10:48: | Start of Session, 21 October 2005 |
10:48: Spy Sweeper started
10:48: Sweep initiated using definitions version 559
10:48: Starting Memory Sweep
10:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:49: Found Adware: icannnews
10:49: Detected running threat: C:\WINDOWS\system32\hrp6057se.dll (ID = 83)
10:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:50: Detected running threat: C:\WINDOWS\system32\mxrapi.dll (ID = 83)
10:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:52: Memory Sweep Complete, Elapsed Time: 00:04:41
10:52: Starting Registry Sweep
10:53: Registry Sweep Complete, Elapsed Time:00:00:32
10:53: Starting Cookie Sweep
10:53: Found Spy Cookie: yieldmanager cookie
10:53: [email protected][2].txt (ID = 3751)
10:53: Found Spy Cookie: hbmediapro cookie
10:53: [email protected][2].txt (ID = 2768)
10:53: Found Spy Cookie: adtech cookie
10:53: john@adtech[2].txt (ID = 2155)
10:53: Found Spy Cookie: azjmp cookie
10:53: john@azjmp[2].txt (ID = 2270)
10:53: Found Spy Cookie: starware.com cookie
10:53: [email protected][1].txt (ID = 3442)
10:53: Found Spy Cookie: metareward.com cookie
10:53: john@metareward[1].txt (ID = 2990)
10:53: Found Spy Cookie: rn11 cookie
10:53: john@rn11[2].txt (ID = 3261)
10:53: Found Spy Cookie: reliablestats cookie
10:53: [email protected][1].txt (ID = 3254)
10:53: [email protected][1].txt (ID = 3442)
10:53: Found Spy Cookie: adserver cookie
10:53: [email protected][1].txt (ID = 2142)
10:53: Found Spy Cookie: zedo cookie
10:53: john@zedo[1].txt (ID = 3762)
10:53: Cookie Sweep Complete, Elapsed Time: 00:00:01
10:53: Starting File Sweep
10:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05: Found Adware: effective-i toolbar
11:05: e54e9d72-81ff-4afc-9ab7-6589be (ID = 59855)
11:05: 3ca39495-0a2f-40b1-ba9d-3cf1a2 (ID = 59838)
11:06: File Sweep Complete, Elapsed Time: 00:12:25
11:06: Full Sweep has completed. Elapsed time 00:17:48
11:06: Traces Found: 15
11:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:07: Removal process initiated
11:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:07: Quarantining All Traces: effective-i toolbar
11:07: Quarantining All Traces: icannnews
11:07: icannnews is in use. It will be removed on reboot.
11:07: C:\WINDOWS\system32\hrp6057se.dll is in use. It will be removed on reboot.
11:07: C:\WINDOWS\system32\mxrapi.dll is in use. It will be removed on reboot.
11:07: Quarantining All Traces: adserver cookie
11:07: Quarantining All Traces: adtech cookie
11:07: Quarantining All Traces: azjmp cookie
11:07: Quarantining All Traces: hbmediapro cookie
11:07: Quarantining All Traces: metareward.com cookie
11:07: Quarantining All Traces: reliablestats cookie
11:07: Quarantining All Traces: rn11 cookie
11:07: Quarantining All Traces: starware.com cookie
11:07: Quarantining All Traces: yieldmanager cookie
11:07: Quarantining All Traces: zedo cookie
11:07: Warning: Timed out waiting for explorer.exe
11:07: Warning: Timed out waiting for explorer.exe
11:07: Warning: Timed out waiting for explorer.exe
11:07: Warning: Quarantine process could not restart Explorer.
11:07: Removal process completed. Elapsed time 00:00:40
********
10:44: | Start of Session, 21 October 2005 |
10:44: Spy Sweeper started
10:44: Messenger service has been disabled.
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: Your spyware definitions have been updated.
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:48: | End of Session, 21 October 2005 |
  • 0

#4
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Please download ewido security suite it is a trial version of the program.
  • Install ewido security suite
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Once the updates are installed do the following:
  • Reboot into SAFE MODE . Do this by repeatedly tapping the F8 key as the computer begins to boot up. You will be taken to a screen where you can use your keyboard "arrow" keys to move the cursor and highlight "Safe Mode", then click the "enter" button.
  • Once in Safe Mode, you are going to run Ewido as follows. It is VERY IMPORTANT that you do not "multi task" while Ewido runs. Please do not open/run ANYTHING else during the scan...this includes all files, programs, folders, games, etc. ONLY have Ewido running.
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido security suite.
  • 0

#5
jet_17

jet_17

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 12:56:29, 21/10/2005
+ Report-Checksum: B813272

+ Scan result:

C:\Documents and Settings\John\Cookies\john@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\WINDOWS\system32\ARHPRXY.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\bPsesrv.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\en26l1fs1.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\fnl0213mg.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\h02olaf31d2.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ibwdial.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kjdusr.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mfxclu.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mytext35.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\n04s0ah7ed4.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\rabdyctl.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\rWsmxs.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\sdarddlg.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\shrio800.dll -> Spyware.Look2Me : Cleaned with backup


::Report End
  • 0

#6
jet_17

jet_17

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Logfile of HijackThis v1.99.1
Scan saved at 13:31:16, on 21/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
C:\Program Files\Microsoft Office\Office10\OSA.EXE
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Documents and Settings\John\Start Menu\Programs\Startup\Reboot.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] DSLAGENT.EXE USB
O4 - HKLM\..\Run: [GsiFinal] rundll32 gspndll.dll,postInstall final
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Startup: Reboot.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1129654637156
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: CWShredder Service - Unknown owner - C:\DOCUME~1\John\LOCALS~1\Temp\Rar$EX00.483\CWShredder.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe
  • 0

#7
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Hi again Jet! Your log is clean! How are things running now???
  • 0

#8
jet_17

jet_17

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
good, but on my avg anti-virus it displays a virus threat and sometimes it can't delete or heal .But this only happens when I leave my computer. any advice.


Thanks for helping me out, must appreciated
  • 0

#9
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Can you possibly copy and paste here what your anti virus is saying? What is the threat, the location, etc??

Are you using a firewall? If so, which one?
  • 0

#10
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP