Infected by SurfSideKick 3 and Others(RESOLVED)

  1. 04-06-2006  #11
    Ramillies
    Ramillies is offline Newbie

    Re: Infected by SurfSideKick 3 and Others

    -------------------------------------------------------------------------------
    KASPERSKY ON-LINE SCANNER REPORT
    Sunday, June 04, 2006 1046 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 4/06/2006
    Kaspersky Anti-Virus database records: 198394
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 67438
    Number of viruses found: 17
    Number of infected objects: 48
    Number of suspicious objects: 0
    Duration of the scan process: 00:53:46

    Infected Object Name / Virus Name / Last Action
    C:\Program Files\Common Files\sуstem32\smss.exe Infected: Trojan-Downloader.Win32.PurityScan.co skipped
    C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdWare.Win32.MyWebSearch skipped
    C:\SS1001.exe Infected: Trojan-Dropper.Win32.Small.qn skipped
    C:\Trelew.exe/data0006 Infected: Trojan-Dropper.Win32.VB.mz skipped
    C:\Trelew.exe NSIS: infected - 1 skipped
    C:\warebundle.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
    C:\WINDOWS\Downloaded Program Files\btwebcontrol.dll Infected: not-a-virus: Dialer.Win32.BT.c skipped
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\QDow.dll Infected: Trojan-Downloader.Win32.QDown.a skipped
    C:\WINDOWS\Downloaded Program Files\QDow.dll Infected: Trojan-Downloader.Win32.QDown.a skipped
    C:\WINDOWS\drsmartload45a.exe Infected: Trojan-Downloader.Win32.Adload.bo skipped
    C:\WINDOWS\drsmartload46a.exe Infected: Trojan-Downloader.Win32.Adload.bo skipped
    C:\WINDOWS\drsmartload849a.exe Infected: Trojan-Downloader.Win32.Adload.bo skipped
    C:\WINDOWS\MTE3NDI6ODoxNg.exe Infected: Trojan-Downloader.Win32.Small.buy skipped
    C:\WINDOWS\QmFsbGFyZA\asappsrv.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
    C:\WINDOWS\QmFsbGFyZA\command.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
    C:\WINDOWS\system32\1024\ld27DB.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld2A58.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld2CC4.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld4F4F.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld4F9D.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld50DD.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld5100.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld5443.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld54DB.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ld56DA.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldA853.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldA9D5.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldAA7D.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldAE41.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldCF69.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldCFB7.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldD0AC.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldD173.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldD2D6.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldD5FA.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\1024\ldD61E.tmp Infected: Trojan-Downloader.Win32.Zlob.gn skipped
    C:\WINDOWS\system32\f3PSSavr.scr Infected: not-a-virus:AdWare.Win32.MyWebSearch skipped
    C:\WINDOWS\system32\HRODXPAT.DLL Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
    C:\WINDOWS\system32\mscornet.exe Infected: Trojan-Downloader.Win32.Zlob.ft skipped
    C:\WINDOWS\system32\o Infected: Trojan-Downloader.BAT.Ftp.ab skipped
    C:\WINDOWS\system32\TFTP2816 Infected: Net-Worm.Win32.Lovesan.a skipped
    C:\WINDOWS\WHCC2.exe/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
    C:\WINDOWS\WHCC2.exe/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
    C:\WINDOWS\WHCC2.exe/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
    C:\WINDOWS\WHCC2.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
    C:\WINDOWS\WHCC2.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
    C:\WINDOWS\WHCC2.exe RarSFX: infected - 5 skipped
    C:\WINDOWS\Οracle\mѕconfig.exe Infected: not-a-virus:AdWare.Win32.PurityScan.el skipped

    Scan process completed.
    Last edited by Ramillies; 04-06-2006 at 11:04 AM.
  2. 04-06-2006  #12
    Neal
    Neal is offline Dedicated Member
    Well good ol Kaspersky flushed a bunch of stuff out of the bushes. Some of those are false alarms tho.


    From post #6 run the purity scan uninstaller again please.


    Now reboot into safe mode by tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter.


    Run CCleaner from safe mode useing the windows tab only like before please.


    Reboot normal mode and...




    Please download the Killbox by Option^Explicit.

    Note:In the event you already have Killbox, this is a new version that I need you to download.
    • Save it to your desktop.
    • Please double-click Killbox.exe to run it.
    • Select
      • "Delete on Reboot
      • Then click on either the "All Files" button if there is more than 1 item to Delete.
    • Please copy the file path(s) below to the clipboard by highlighting ALL of them and pressing CTRL + C

      C:\Program Files\MSN Messenger\riched20.dll
      C:\SS1001.exe
      C:\Trelew.exe
      C:\warebundle.exe
      C:\WINDOWS\Downloaded Program Files\CONFLICT.1\QDow.dll
      C:\WINDOWS\drsmartload45a.exe
      C:\WINDOWS\drsmartload46a.exe
      C:\WINDOWS\drsmartload849a.exe
      C:\WINDOWS\MTE3NDI6ODoxNg.exe
      C:\WINDOWS\QmFsbGFyZA\asappsrv.dll
      C:\WINDOWS\QmFsbGFyZA\command.exe
      C:\WINDOWS\system32\1024\ld27DB.tmp
      C:\WINDOWS\system32\1024\ld2A58.tmp
      C:\WINDOWS\system32\1024\ld2CC4.tmp
      C:\WINDOWS\system32\1024\ld4F4F.tmp
      C:\WINDOWS\system32\1024\ld4F9D.tmp
      C:\WINDOWS\system32\1024\ld50DD.tmp
      C:\WINDOWS\system32\1024\ld5100.tmp
      C:\WINDOWS\system32\1024\ld5443.tmp
      C:\WINDOWS\system32\1024\ld54DB.tmp
      C:\WINDOWS\system32\1024\ld56DA.tmp
      C:\WINDOWS\system32\1024\ldA853.tmp
      C:\WINDOWS\system32\1024\ldA9D5.tmp
      C:\WINDOWS\system32\1024\ldAA7D.tmp
      C:\WINDOWS\system32\1024\ldAE41.tmp
      C:\WINDOWS\system32\1024\ldCF69.tmp
      C:\WINDOWS\system32\1024\ldCFB7.tmp
      C:\WINDOWS\system32\1024\ldD0AC.tmp
      C:\WINDOWS\system32\1024\ldD173.tmp
      C:\WINDOWS\system32\1024\ldD2D6.tmp
      C:\WINDOWS\system32\1024\ldD5FA.tmp
      C:\WINDOWS\system32\1024\ldD61E.tmp
      C:\WINDOWS\system32\f3PSSavr.scr
      C:\WINDOWS\system32\HRODXPAT.DLL
      C:\WINDOWS\system32\mscornet.exe
      C:\WINDOWS\system32\o
      C:\WINDOWS\system32\TFTP2816
      C:\WINDOWS\WHCC2.exe/data.rar/whAgent.exe
      C:\WINDOWS\WHCC2.exe/data.rar/whSurvey.exe
      C:\WINDOWS\WHCC2.exe/data.rar/webhdll.dll
      C:\WINDOWS\WHCC2.exe/data.rar/whiehlpr.dll
      C:\WINDOWS\WHCC2.exe/data.rar
      C:\WINDOWS\WHCC2.exe RarSFX


    • Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
    • Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
    If your computer does not restart automatically, please restart it manually.


    Post a new hijackthis log and tell me how your computer is running now.
  3. 05-06-2006  #13
    Ramillies
    Ramillies is offline Newbie
    Computer seems to be running ok now, much faster and no longer getting any adverts opening Internet explorer windows.

    Logfile of HijackThis v1.99.1
    Scan saved at 1:51:33 PM, on 6/5/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ltmsg.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb1 0.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\TrojanHunter 4.5\THGuard.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Logitech\SetPoint\KEM.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\hjt\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
    F2 - REG:system.ini: UserInit=userinit.exe
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
    O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb1 0.exe
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [Microsoft Windows Updater] msupdater.exe
    O4 - HKLM\..\Run: [DIAGENT] C:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.EXE startup
    O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 205 ADSL Router\Adsl\dslagent.exe
    O4 - HKLM\..\Run: [GSISETUP] C:\DOCUME~1\MARYBA~1\LOCALS~1\Temp\GsiInst.exe INSTALL C:\DOCUME~1\MARYBA~1\LOCALS~1\Temp\.\V205Res 13
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
    O4 - HKLM\..\RunServices: [Microsoft Windows Updater] msupdater.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/tech...l/LSSupCtl.cab
    O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirate...GameLoader.dll
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - https://register.btinternet.com/temp...control013.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    Last edited by Ramillies; 05-06-2006 at 06:49 PM.
  4. 05-06-2006  #14
    Neal
    Neal is offline Dedicated Member
    Save 20% on AVG Internet Security 2012 Suite!
    Clean log!!



    If you are no longer having any more trouble here is some preventative measures for you.

    Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.

    http://www.d-a-l.com/help/showthread.php?t=32403

    Flush your restore points in ME and XP, by turning System Restore off and then back on.
    This will create a fresh restore point.

    Explained Here:
    Windows XP: service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

    Explained Here
    Microsoft ME:
    http://service1.symantec.com/SUPPORT...rc=sec_doc_nam


    RegProtect

    This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry.

    You have the option of allowing(good) items or blocking(bad)items.

    http://www.diamondcs.com.au/index.php?page=regprot


    To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:

    1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser.
    http://v5.windowsupdate.microsoft.co....aspx?ln=en-us

    http://www.microsoft.com/windows/ie/default.asp


    2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!.
    AVG: http://free.grisoft.com/doc/1

    Avast: http://www.avast.com/eng/avast_4_home.html


    3. In addtion to using Ad-aware consider using another free malware scanning/removal program:
    Windows Defender

    http://www.microsoft.com/athome/secu...e/default.mspx


    4. Consider using a free firewall if you are not already using one. Some good free ones are:
    Kerio
    http://www.sunbelt-software.com/Kerio.cfm

    OutPost Personal Firewall:
    Outpost



    5. Consider using an alternate free browser for general web surfing but you must use IE for windows update.
    Mozilla Firefox: www.mozilla.org/products/firefox/


    6. Consider increasing your browser security by using these programs:
    SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
    SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:

    http://www.javacoolsoftware.com/spywareblaster.html


    If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/


    IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here:
    https://netfiles.uiuc.edu/ehowes/www/resource.htm


    Block access to Untrustworthy Sites

    You can prevent your computer from visiting a myriad of untrustworthy sites and ad-servers by installing a customised hosts file. One of the best available is the: MVPS Hosts File. Simply follow the instructions to install the file in the correct location. This will not only make surfing safer but will improve website load times and block popups from many of the large ad-servers.


    Mcafee SiteAdvisor

    Surf the Net safer with SiteAdvisor, SiteAdvisor notifies you of safe sites or dangerous sites before you ever go there with a simple green check or a red x or a yellow caution when you do a Google search. Just put your cursor on the green check or red X or caution and recieve information about the site.

    SiteAdvisor works with Internet Explorer and FireFox.

    SiteAdvisor

    See what it looks like Here


    *Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free
+ Reply to Thread
Page 2 of 2 FirstFirst 1 2
« Windows Explorer (XP) hangs when opening 'Program Files' | Help Help »