This topic is locked
I'm sure I don't have enough protection on this PC - the PCcillin 2002 is out of date, and I never use it anyway. (It was my Mom's idea, she swore it was the best!) Are there any special tips I need to know in order to fully uninstall it? I've read in other posts that Grisoft AVG is good; I downloaded the installer, but was waiting for my system to be clean before installing it. (Didn't want conflicts during this ordeal.) I know there is a firewall that comes standard with XP - is it any good? A friend of mine uses it, and I noticed that once she activated the firewall, her daughter could no longer play the flash games that load in popups from Neopets. Besides that, a couple weeks ago, something went completely wonky on her system, her firewall was disabled, her spyware and scanning programs shut down, and then she lost her internet connection. After an hour on the phone with Charter Internet tech support, they told her there was nothing they could do. She's not very good with computers anyway, but wouldn't listen to me when I told her it was probably a virus or trojan on her system and that there are ways to clean it up. Instead, she just completely reformatted her HD. Well, probably she didn't - I think she may just be calling it that. She probably used (likely infected) restore points or something. She may end up in the same trouble again. Perhaps I should go on her PC and run a HijackThis log for her, to make sure she's really clean. The point of all that is - if something THAT bad got onto her system WITH the protection she was running, is the Win XP firewall any good? I hear a lot about ZoneAlarm, but it looks complicated to me, and I don't know if it will disable the things we like to do on this PC (like the Neopets games, downloading mp3's and games and movies). Is a firewall absolutely necessary? Any advice in that department?
Onward and upward: Trust cleanup - yes, I was infected with that a couple months ago. SpyBot & AdAware I thought removed it all, because there were no more signs of it (the popups, the desktop icons, the Favorites URLs, all gone)... though maybe the popups weren't entirely gone, I'm thinking. I've had popups since forever. I got this PC (used) 7 months ago, and immediately DL'ed and scanned with AdAware and SpyBot, and thought I cleared up the issues (there were over 800 problems between the two - SpyBot found over 500, fixed all but the Cmd Service - and AdAware found and cleaned another 300) And I think that may be why someone got rid of this otherwise fantastic and very-nearly-top-of-the-line PC at a dirt-cheap price! I didn't know then how nefarious these advertisers are with their malware and the way they sneak in lil bits of almost invisible baddies that keep generating this crap - but I'm learning.
Avenger log
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\qmawpurb
*******************
Script file located at: \??\C:\Documents and Settings\nxbwjlkm.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\local.html deleted successfully.
File C:\WINDOWS\SYSTEM32\tisa.dll not found!
Deletion of file C:\WINDOWS\SYSTEM32\tisa.dll failed!
Could not process line:
C:\WINDOWS\SYSTEM32\tisa.dll
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\lut.dat deleted successfully.
File C:\WINDOWS\SYSTEM32\tisa.cnf not found!
Deletion of file C:\WINDOWS\SYSTEM32\tisa.cnf failed!
Could not process line:
C:\WINDOWS\SYSTEM32\tisa.cnf
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\ticads.exe not found!
Deletion of file C:\WINDOWS\SYSTEM32\ticads.exe failed!
Could not process line:
C:\WINDOWS\SYSTEM32\ticads.exe
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\tctool.exe not found!
Deletion of file C:\WINDOWS\SYSTEM32\tctool.exe failed!
Could not process line:
C:\WINDOWS\SYSTEM32\tctool.exe
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\ticont.dll not found!
Deletion of file C:\WINDOWS\SYSTEM32\ticont.dll failed!
Could not process line:
C:\WINDOWS\SYSTEM32\ticont.dll
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\tpopup.exe not found!
Deletion of file C:\WINDOWS\SYSTEM32\tpopup.exe failed!
Could not process line:
C:\WINDOWS\SYSTEM32\tpopup.exe
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\tconini.dat deleted successfully.
File C:\WINDOWS\SYSTEM32\lcch.dat deleted successfully.
File C:\WINDOWS\onlineshopping.ico not found!
Deletion of file C:\WINDOWS\onlineshopping.ico failed!
Could not process line:
C:\WINDOWS\onlineshopping.ico
Status: 0xc0000034
File C:\WINDOWS\removeadware.ico not found!
Deletion of file C:\WINDOWS\removeadware.ico failed!
Could not process line:
C:\WINDOWS\removeadware.ico
Status: 0xc0000034
File C:\WINDOWS\sexpersonals.ico not found!
Deletion of file C:\WINDOWS\sexpersonals.ico failed!
Could not process line:
C:\WINDOWS\sexpersonals.ico
Status: 0xc0000034
File C:\WINDOWS\local.html not found!
Deletion of file C:\WINDOWS\local.html failed!
Could not process line:
C:\WINDOWS\local.html
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\tu.exe not found!
Deletion of file C:\WINDOWS\SYSTEM32\tu.exe failed!
Could not process line:
C:\WINDOWS\SYSTEM32\tu.exe
Status: 0xc0000034
File C:\WINDOWS\SYSTEM32\ttu.exe not found!
Deletion of file C:\WINDOWS\SYSTEM32\ttu.exe failed!
Could not process line:
C:\WINDOWS\SYSTEM32\ttu.exe
Status: 0xc0000034
File C:\WINDOWS\se_spoof.dll not found!
Deletion of file C:\WINDOWS\se_spoof.dll failed!
Could not process line:
C:\WINDOWS\se_spoof.dll
Status: 0xc0000034
File C:\WINDOWS\inetloader.dll not found!
Deletion of file C:\WINDOWS\inetloader.dll failed!
Could not process line:
C:\WINDOWS\inetloader.dll
Status: 0xc0000034
File C:\Windows\mxd.exe not found!
Deletion of file C:\Windows\mxd.exe failed!
Could not process line:
C:\Windows\mxd.exe
Status: 0xc0000034
File C:\Windows\tse.exe not found!
Deletion of file C:\Windows\tse.exe failed!
Could not process line:
C:\Windows\tse.exe
Status: 0xc0000034
File C:\Windows\trustinbar.exe not found!
Deletion of file C:\Windows\trustinbar.exe failed!
Could not process line:
C:\Windows\trustinbar.exe
Status: 0xc0000034
File C:\Windows\ads.js not found!
Deletion of file C:\Windows\ads.js failed!
Could not process line:
C:\Windows\ads.js
Status: 0xc0000034
File C:\WINDOWS\videoslots.ico deleted successfully.
Folder C:\Program Files\TrustIn Popups not found!
Deletion of folder C:\Program Files\TrustIn Popups failed!
Could not process line:
C:\Program Files\TrustIn Popups
Status: 0xc0000034
Folder C:\Program Files\TrustIn Bar not found!
Deletion of folder C:\Program Files\TrustIn Bar failed!
Could not process line:
C:\Program Files\TrustIn Bar
Status: 0xc0000034
Folder C:\Program Files\TrustIn Contextual not found!
Deletion of folder C:\Program Files\TrustIn Contextual failed!
Could not process line:
C:\Program Files\TrustIn Contextual
Status: 0xc0000034
Folder C:\Program Files\TrustIn Popups not found!
Deletion of folder C:\Program Files\TrustIn Popups failed!
Could not process line:
C:\Program Files\TrustIn Popups
Status: 0xc0000034
Folder C:\Program Files\TrustIn Search not found!
Deletion of folder C:\Program Files\TrustIn Search failed!
Could not process line:
C:\Program Files\TrustIn Search
Status: 0xc0000034
Completed script processing.
*******************
Finished! Terminate.
Kaspersky Online Scan
A slightly shorter scan... but now the file is 2.01 MB - just a shade bigger. I tried uploading the txt file to my Charter webspace for you. It uploads and retrieves just fine - except that it's all jammed up, without the proper spacing or returns. So that would make it extremely hard for you to read. So I got a lil creative and saved the reults as an .html file and uploaded it to my Charter webspace for you to retrieve <a href= "http://webpages.char...html">here.</a>
In case you wanted it but forgot to mention it, and because it's fairly simple, I did another HJT log.
Logfile of HijackThis v1.99.1
Scan saved at 5:58:09 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Photodex\CompuPicPro\ScsiAccess.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ScreenshotCaptor\ScreenshotCaptor.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\HP_Owner\My Documents\ForComputerWork\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Alcohol Toolbar Helper - {0ACF00E0-C1E4-4F6B-B290-10AC7505C47A} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [PWRISOVM.EXE] "C:\Program Files\PowerISO\PWRISOVM.EXE"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Smart Evrox] C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\~AceTemp\crack\evrox.exe e
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.l...lscbase5059.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1146371638484
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1146604840093
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-sec.../ols3/fscax.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.game...aploader_v6.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\CompuPicPro\ScsiAccess.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Awaiting my next orders, Sir
Edited by TraeSher, 01 August 2006 - 04:06 PM.
Sign In
Create Account
