Over 1 million tech questions and answers.

Leftover Malware from a Previous Fix

Q: Leftover Malware from a Previous Fix

I have previously posted in this forum about my computer on this thread: http://www.bleepingcomputer.com/forums/t/239917/google-redirect/. The google redirection issue described there was resolved, but there are still a few symptoms that indicate the computer may not be completely fixed. I was working with Blade81 via private message but we were unable to solve these symptoms. They are:When I log into the "Steve" account, I see this error message:
RUNDLL
Error loading C:/DOCUME~1/Steve/protect.dll
The specified module could not be found.
(Note that the combofix in the previous thread was done to the Donna account)The antivirus program auto-update does not seem to be working. I can do a manual update, and I can see that automatic updates are enabled, but they do not seem to be executing.Uploading actions, such as sending an email or uploading pictures to Picasa, seem to take longer than they should.I have run DDS on the "Steve" account since it is the one that has the error message. Thanks in advance for any help you can provide.DDS (Ver_09-07-30.01) - NTFSx86 Run by Steve at 21:08:58.73 on Wed 09/02/2009Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1679 [GMT -5:00]AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exesvchost.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\brss01a.exeC:\Program Files\Avira\AntiVir Desktop\sched.exesvchost.exeC:\Program Files\Avira\AntiVir Desktop\avguard.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\system32\Brmfrmps.exeC:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\WINDOWS\system32\igfxpers.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\ScanSoft\PaperPort\pptd40nt.exeC:\Program Files\Brother\ControlCenter2\brctrcen.exeC:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Avira\AntiVir Desktop\avgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\iPod\bin\iPodService.exeC:\Documents and Settings\Steve\Desktop\dds.scr============== Pseudo HJT Report ===============uStart Page = hxxp://www.excite.com/uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=usuSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=usuDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=usuInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=usuInternet Settings,ProxyOverride = *.localBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dllBHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLLBHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dllBHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No FileTB: {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - No FileEB: {0EBACAF2-E0F9-47A9-98CF-0ECCE30B654C} - No FileuRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /backgrounduRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenteruRun: [net] "c:\windows\system32\net.net"uRun: [autochk] rundll32.exe c:\docume~1\steve\protect.dll,[email protected]: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exemRun: [IgfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXEmRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstallmRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -bootmRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exemRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exemRun: [SetDefPrt] c:\program files\brother\brmfl04a\BrStDvPt.exemRun: [ControlCenter2.0] c:\program files\brother\controlcenter2\brctrcen.exe /autorunmRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exemRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startupmRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /minStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\status~1.lnk - c:\program files\brother\brmfcmon\BrMfcWnd.exeIE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlIE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.htmlIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlIE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.htmlIE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlIE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.htmlIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLLIE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dllDPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cabDPF: {8CE3BAE6-AB66-40B6-9019-41E5282FF1E2} - hxxps://accounting.quickbooks.com/c1/v15.559/qboax8.cabDPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cabDPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cabNotify: igfxcui - igfxdev.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll================= FIREFOX ===================FF - ProfilePath - c:\docume~1\steve\applic~1\mozilla\firefox\profiles\uk5xth5z.default\FF - prefs.js: browser.startup.homepage - hxxp://excite.com/FF - plugin: c:\program files\google\picasa3\npPicasa3.dllFF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dllFF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}---- FIREFOX POLICIES ----c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");============= SERVICES / DRIVERS ===============R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-27 11608]R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-27 108289]R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-27 185089]R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-27 55656]R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]R3 WlanUIG;2Wire 802.11g USB Driver;c:\windows\system32\drivers\WlanUIG.sys [2007-8-2 347648]=============== Created Last 30 ================2009-08-27 21:24 55,656 a------- c:\windows\system32\drivers\avgntflt.sys2009-08-27 21:24 --d----- c:\program files\Avira2009-08-27 21:24 --d----- c:\docume~1\alluse~1\applic~1\Avira2009-08-21 09:04 --d----- c:\program files\iTunes2009-08-12 16:18 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx2009-08-12 16:17 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll2009-08-10 22:12 1,089,593 -------- c:\windows\system32\dllcache\ntprint.cat2009-08-10 22:01 --d----- c:\windows\system32\XPSViewer2009-08-10 22:01 1,676,288 -------- c:\windows\system32\xpssvcs.dll2009-08-10 22:01 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll2009-08-10 22:01 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe2009-08-10 22:01 575,488 -------- c:\windows\system32\xpsshhdr.dll2009-08-10 22:01 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll2009-08-10 22:01 117,760 -------- c:\windows\system32\prntvpt.dll2009-08-10 22:01 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll2009-08-10 22:01 --d----- C:\a3e87840892266bf99b042d22009-08-10 22:00 --d----- c:\windows\SxsCaPendDel2009-08-05 04:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll==================== Find3M ====================2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll2009-07-19 18:48 11,067,392 -------- c:\windows\system32\dllcache\ieframe.dll2009-07-19 08:18 5,937,152 -------- c:\windows\system32\dllcache\mshtml.dll2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll2009-07-17 14:01 58,880 -------- c:\windows\system32\dllcache\atl.dll2009-07-13 23:43 10,841,088 a------- c:\windows\system32\dllcache\wmp.dll2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll2009-07-13 23:43 286,208 a------- c:\windows\system32\dllcache\wmpdxm.dll2009-07-03 12:09 915,456 a------- c:\windows\system32\wininet.dll2009-07-03 12:09 915,456 -------- c:\windows\system32\dllcache\wininet.dll2009-07-03 12:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll2009-07-03 12:09 1,208,832 -------- c:\windows\system32\dllcache\urlmon.dll2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll2009-07-03 12:09 1,985,536 -------- c:\windows\system32\dllcache\iertutil.dll2009-07-03 12:09 25,600 -------- c:\windows\system32\dllcache\jsproxy.dll2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll2009-07-03 12:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll2009-07-03 12:09 386,048 -------- c:\windows\system32\dllcache\iedkcs32.dll2009-07-03 06:01 173,056 -------- c:\windows\system32\dllcache\ie4uinit.exe2009-06-25 03:25 730,112 a------- c:\windows\system32\lsasrv.dll2009-06-25 03:25 301,568 a------- c:\windows\system32\kerberos.dll2009-06-25 03:25 147,456 a------- c:\windows\system32\schannel.dll2009-06-25 03:25 136,192 a------- c:\windows\system32\msv1_0.dll2009-06-25 03:25 56,832 a------- c:\windows\system32\secur32.dll2009-06-25 03:25 54,272 a------- c:\windows\system32\wdigest.dll2009-06-25 03:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll2009-06-25 03:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll2009-06-25 03:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll2009-06-25 03:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll2009-06-25 03:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll2009-06-25 03:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll2009-06-24 06:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys2009-06-16 09:36 119,808 a------- c:\windows\system32\t2embed.dll2009-06-16 09:36 81,920 a------- c:\windows\system32\fontsub.dll2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll2009-06-12 07:31 76,288 a------- c:\windows\system32\telnet.exe2009-06-12 07:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll2009-06-10 09:19 2,066,432 -------- c:\windows\system32\dllcache\mstscax.dll2009-06-10 09:13 84,992 a------- c:\windows\system32\avifil32.dll2009-06-10 09:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll2009-06-10 01:14 132,096 a------- c:\windows\system32\wkssvc.dll2009-06-10 01:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll2006-09-13 21:02 6,967,072 ac------ c:\program files\gaim-1.5.0.exe2006-09-04 18:06 13,526,432 ac------ c:\program files\RealPlayer10-5GOLD_rs.exe2006-08-21 08:22 12,690,386 ac------ c:\program files\VSE800EPO.zip2006-07-27 22:25 5,119,896 ac------ c:\program files\Firefox Setup 1.5.0.5.exe2006-07-27 19:33 15,253,376 ac------ c:\program files\DivXInstaller.exe2009-02-15 21:56 56 ---shr-- c:\windows\system32\A3A382AC08.sys2009-02-15 21:56 1,786 ac-sh--- c:\windows\system32\KGyGaAvL.sys2008-09-18 12:58 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091820080919\index.dat============= FINISH: 21:09:43.21 ===============

RELEVANCY SCORE 200
Preferred Solution: Leftover Malware from a Previous Fix

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: Leftover Malware from a Previous Fix

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructions that pop up for posting the results.Close the program window, and delete the program from your desktop.Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

Read other 9 answers
RELEVANCY SCORE 66

Here's the error message I sometimes get when browsing a mapped network drive:

Z:\SomeFolder is not accessible.

The specified server cannot perform the requested operation.

Also some files just don't show up in explorer when browsing the mapped network drive. I know they are there because I can see and open them in explorer on the PC hosting the network share.

First some information: The network consists of a workgroup of two PC's (Tiger and nForce) both running Windows XP Professional 32 bit SP2. Both PC's have two NICs, 1-Gbit NICs with a direct cable between the two PCs (10.0.0.1 and 10.0.0.2) for fast Windows networking, and 100-Mbit NICs connected both to a port in a NAT router/switch for internet access (192.168.1.101 and 192.168.1.102, router 192.168.1.1).

The problem started after completely reinstalling Windows on the Tiger PC (with format of C). The reinstall was performed with only the C disk present. The other disks (F, G and H) were reconnected after the installation was complete. The problem occurs when mapping to shares on those drives. Shares created on the newly installed C drive don't give the problem.

After a lot of searching I've found what I think may be the cause, but unfortunately I still don't have a solution.

In the "Group or user names:" box on the security tab of the file property dialogue boxes of files that don't show in the mapped drive there is an unkown user named S-1-5-21 followed by four more cipher groups of le... Read more

A:leftover user from previous install cause of network sharing problem?

Bumping this to the top because I still don't have an answer.

Read other 5 answers
RELEVANCY SCORE 56

Ok, finally got Smitfraud-C.Core Service and Virtumonde cleaned out. DriveCleaner2006 does not seem to want to go away now. Had some WinAntiSpyware as well. The only thing that seems to be hanging on at this point is the DriveCleaner. Here is the HijackThis log. Thanks for your help!Logfile of HijackThis v1.99.1Scan saved at 3:24:28 AM, on 7/26/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16473)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exec:\program files\safeandsecure\safeandsecure\app\CurtainsSysSvcNt.exeC:\Program Files\Common Files\Command Software\dvpapi.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\McAfee\Common Framework\FrameworkService.exeC:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\ctfmon.exe... Read more

A:Leftover Stuff From Malware

Welcome to BleepingComputer, I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.I recommend that you "track this topic" to be notified when a reply has been made. At the top if this thread choose Options > Track This Topic and then select Immediate Email Notification.RegardsPOADB.

Read other 14 answers
RELEVANCY SCORE 56

Last Thursday, I'm sure a file from WinMX while my AVG was off(that's a long story) caused a browser hijack. Anyway, I read though your and other forums and followed some of the suggestions given to others with similar ills. After a lot of trail and error I seem to no longer have browser hijacking ( i.e.. new window opening with "url.urtbk" in the address) but I'm not sure if all is well. There may still be leftovers. My browser still runs slower than normal and I fear a redirect is in my future. Here's my current HijackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:56:51 PM, on 7/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx... Read more

A:Malware leftover blues

I now have Java SE installed (files in my registry leftover fron Windows Cleanup Utility prevented installation)
 

Read other 1 answers
RELEVANCY SCORE 56

So my dad was using the pc and installed malware by mistake. I ran malwarebyes and removed the malware but every time he signs into his account on startup this error pops up. I tried to find it's folder but couldn't see it so how can I remove it please?

A:Cannot delete this malware leftover

Originally Posted by Edward


So my dad was using the pc and installed malware by mistake. I ran malwarebyes and removed the malware but every time he signs into his account on startup this error pops up. I tried to find it's folder but couldn't see it so how can I remove it please?



Hi Edward.
Do you have Ccleaner installed on the computer?
If so, please navigate to the TOOLS selection on the left, then go across the tabs to SCHEDULED TASKS. Look in that window for the DLL call and highlight it, and select DISABLE. Reboot the computer.

Read other 3 answers
RELEVANCY SCORE 55.6

I've tried many times but they wont go away. I have a screenshot of the issue.

I've had a previous issue where I was losing disk space for no reason. I don't know if this had anything to with it, but I still have that issue even though I've tried everything. I've backed up my personal data so it's no big issue.

The issue right now is that I can't remove some of the malware that Hitmanpro had detected. I can't find them anywhere on the computer and CltMngSvc isn't even on the task manager.
 

Read other answers
RELEVANCY SCORE 55.6

I am getting the following error reportGeneric Host Process for Win32 Services has encountered a problem and needs to close.C:DOCUME~1MELOCALS~1TempWER5602.dir00svchost.exe.mdmpC:DOCUME~1MELOCALS~1TempWER5602.dir00appcompat.txtWhen I first realized I had a problem, AVG stopped working so I unistalled it and downloaded Spybot and ran that in Safe Mode. This seemed to repair some of the problem as it found many infected files. I reinstalled AVG. Ran that and it to found infections. I then had problems running certain things like disk defragmenter and task manager. Unistalled Spybot and installed Malwarebytes. This corrected almost everything. AVG is now telling me that my atapi.sys is infected and it can't do anything to it. Here is a list of what is in my AVG virus vault."Infection";"Trojan horse SHeur3.ARI";"C:Documents and SettingsMemvhasyvimk.exe";"";"2/28/2010, 3:23:08 PM""Infection";"Trojan horse BackDoor.Generic12.AMHS";"C:lsass.exe";"";"2/28/2010, 3:29:17 PM""Infection";"Trojan horse SHeur3.ATW";"C:WINDOWSTempiufg.tmpsvchost.exe";"";"3/1/2010, 4:41:17 AM""Infection";"Trojan horse FakeAV.SL";"C:WINDOWSsystem32sshnas21.dll";"";"3/2/2010, 5:32:06 AM""Infection";"Trojan horse FakeAV.SY";"C:WINDOWSsystem32_VOIDkdkxcqwpwc.dll";""... Read more

A:Have leftover problems from either a virus or malware

Thank you Pandy for getting me in the right forum. I am having trouble getting the rest of my reports to post.

Read other 12 answers
RELEVANCY SCORE 54.8

I got infected with the subject malware and managed to remove enough of the pieces that my Dell is operational again (Windows XP Home SP2). However, I still have two problems I haven't been able to eliminate. One, just to the right of the time in my toolbar, I keep seeing the msg "VIRUS ALERT!" and it also appears in various other places. The larger issue though, is that although I have 3 hard drives (C, D and F), since the malware problem, the only hard drive that "My Computer" shows is F. Using Acronis partition software, that software sees the other drives and all the files are still there. Although I've lost some desktop icons that used to be there, if I go into All Programs and tell the system to start a program that resides on one of the "unseen by Windows" drives, the program starts up and runs just fine.

How do I restore the ability of My Computer to show me all the installed drives (I'm guessing it's some trick in the registry). Thanks for any assistance.

Ted

A:Antivirus 2008 Malware Leftover Issue

Download and install TweakUI (the download is on the right hand side of the screen). Run TweakUI and then click on My Computer > Drives and place a check next to the drives you want to unhide.

Read other 2 answers
RELEVANCY SCORE 54.8

So whenever i use Rkill it detects a bunch of malware domains on the HOSTS file after sometime that are (probably) leftovers from the last time my computer got infected but i also get sometime while visit new websites that CloudFlare is establishing a secure connetction or something (i dont remember because it happened long ago and i didnt pay attention to it because it got me to the site i wanted to go to with no problems but i lost my trust in things of such nature from cloudflare since last time.
The whole file ( i cant post attachments here )
 
Rkill 2.8.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2016 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html
 
Program started at: 08/22/2016 04:09:22 AM in x86 mode.
Windows Version: Windows 7 Professional Service Pack 1
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * No issues found.
 
Checking Windows Service Integrity: 
 
 * Windows Defender (WinDefend) is not Running.
   Startup Type set to: Di... Read more

A:Leftover malware domains in the HOSTS file

Reset the Hosts file back to the default?

Read other 4 answers
RELEVANCY SCORE 54.4

After I followed some instructions to remove the system diagnosis malware, some others remained and I don't know how to remove them.
I followed the instructions on pasting the DDS log, but had a problem with gmer.exe. When I opened gmer.exe, I was only allowed to check some of the settings, I can only check services, registry, files and ADS.

DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.3.1
Run by Yongbin at 17:58:05 on 2012-09-14
Microsoft Windows 7 Home Premium 6.1.7601.1.936.86.1033.18.3835.2614 [GMT -7:00]
.
AV: 360杀毒 *Disabled/Updated* {A0FD413B-F662-C08C-7B21-F57CED225A55}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files (x86)\360\360Safe\deepscan\Zh... Read more

A:Malware removal leftover (google redirect and sound ads)

I forgot to mention, there are some chinese programs in that DDS list. I looked over it and the programs with Chinese characters are virus scan, firewall protection, Chinese character input, and video player.

Read other 46 answers
RELEVANCY SCORE 47.6

Mod Edit:  Prior AII topic at http://www.bleepingcomputer.com/forums/t/561908/can-able-to-change-my-proxy-settings-in-internet-options/ - Hamluis.
 
I think I have something changing my DNS server settings.
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-08-2016 01
Ran by Dallas (administrator) on DALLAS-PC (26-08-2016 11:29:06)
Running from C:\Users\Dallas\Downloads
Loaded Profiles: Dallas (Available Profiles: Dallas & DefaultAppPool)
Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSv... Read more

Read other answers
RELEVANCY SCORE 47.2

Hello, The Symptoms are: When computer boots it comes up with the error message "error loading p2esocks_1025.dll-The specified module could not be found."Yet this has occured after I started having problems upgrading to IE6 several months ago.IE5: -Outlook Express will not open when I click on email links on web pages when I click on them (when browsing with IE5)."Outlook Express could not be started. The application was unable to open the outlook express message store. Your computer maybe out of memory or the disk is full". (this shouldn't be the case perhaps some component is missing?)IE6When I try to upgrade to IE6 it does not open any web pages and displays the result: "res://c:WINNT/system32/shdoclc.dll/dnserror.htm"This started after I had trouble some months ago with the "Iwantsearch" malware hijacking my home page etc.I am including 2 HiJackThis reports incase neccessary (one with IE5 loaded and one with IE6 loaded) as I do not understand whats going on).Could you please help. I really need to get this sorted out and start to earn some Bleeping Money!Thank you,G. ogfile of HijackThis v1.99.1Scan saved at 23:10:43, on 02/03/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\csrss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT ... Read more

A:IE6 Upgrade problems from previous malware

Please post a fresh log. Both logs are old.

Read other 2 answers
RELEVANCY SCORE 46.4

From the previous post - http://www.bleepingcomputer.com/forums/topic464525.html/page__gopid__2799398#entry2799398DDS - .DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORKInternet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.1Run by User at 9:21:05 on 2012-08-10Microsoft Windows 7 Home Premium 6.1.7600.0.1252.65.1033.18.8146.6838 [GMT 8:00].AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows&#... Read more

A:From the Previous (Windows 7 problem). Malware Removal Log

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/464584 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

Read other 2 answers
RELEVANCY SCORE 46

Continued from - http://www.techsupportforum.com/f284...it-517105.html

The thread was closed due to inactivity just a few minutes ago.
It seems as if the jump/redirect malware is gone! (Yay)
However I can't update my version of windows Vista using Control Panel/Windows update. It goes to download new updates, but sits on 0 kB/s and 0% done, this never happened before I was infected.

Is there a normal procedure to fix this? Or is there a place to manually download the windows updates?
Thanks~!

[EDIT] Sorry about not posting reports or anything like that, I stuck them in the original post and I'm not sure where to post this particular problem, because I still think it's malware-related. If not, please move this thread. (If that's what is normally done)

[EDIT x2] The error code reported from this problem is C0150004.

A:Continuation of a previous problem >> Jump/Redirect malware

Bumping for for almost 2 weeks of inactivity.
Is this the wrong place to post something like this?

Read other 3 answers
RELEVANCY SCORE 46

Hi there. I've been having lots of problems with my Toshiba Satellite Pro (see spec below). A very helpful CatByte talked me through running various programmes and tests to remove malware but I still have the same problems (mainly that my hard drive memory is decreasing daily). It also takes a long time to shut down with lots of boxes prompting me to close programmes that I can't see running. The laptop also freezes at least once a day (forcing me to manually switch it off) and sometimes it hybernates while I'm working (and pressing keys). The laptop's audio is still mute (I use a usb soundcard but when I go back to the laptops internal card there's no sound at all). CatByte deducted, after the last set of logs that it's not a malware issue and that I should "stat a new thread in the hardware forum for your OS and hopefully our expert techs will be able to resolve the remaining issues for you".

File system NTFS
Windows XP version 5.1 (2002 service pack 2)
Intel 2 CPU
[email protected] 2.00GHz
2.0GHz, 0.99GB of RAM
Hard drive 93.1GB

The previous threads are:

Logs for dds and Gmer

and

http://www.techsupportforum.com/foru...ue-550694.html

Thanks a lot,
Seamus

A:After 2 previous threads (dealing with malware) my problems continue

Hi Oberjeen,

Also try scanning your computer with a good program called "HitmanPRO". I've had good luck removing malware in customer's computer using this program. Here is the link: Hitman Pro 3 - SurfRight

Good luck and hope your get your computer problem fix.

Read other 13 answers
RELEVANCY SCORE 46

Hey there,

So, I'm not sure what exactly my problem is. Recently I had become infected with some malware (TDSS.sys and UACd.sys) and I took measures to remove them as best as I could. Further scans don't seem to find anything else, but I can't be certain I've gotten everything as I'm still having some strange behavior.

Initially, I noticed that I had something because my google seaches were being redirected when I would click on any search result (windowsclick.com, I believe) and in investigating and trying to fix that I found the TDSS rootkit and then later UACd. Spybot S&D would catch the TDSS infections and remove them, but they would come right back after opening a new browser, so I found Malwarebytes Anti-Malware and scanned my computer and seemed to successfully remove the TDSS and windowsclick problems.

Just the other day though I got a BSOD while browsing the internet (unfortunately, I didn't get a chance to read/copy it) and ever since then programs are constantly crashing on me. Internet explorer, AIM, iTunes, windows media player, winamp, to name a few, will crash immediately after they load. Always the same programs.

So, to make sure I didn't have anything else, I also downloaded GMER and scanned with that and found UACd.sys. After some searching I found out that ComboFix could remove the UACd rootkit and so I downloaded and ran that and seemingly took care of UACd, yet my problem still persists.

My only conclusions are t... Read more

A:Programs keep crashing, not sure if it's related to previous malware removal

Usually with UAC, you're better off reinstalling the OSSince you have done everything in your post, I'd suggest posting in our HJT forum for more in-depth helpPlease read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". If you cannot complete a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day. Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the HJT Team.Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as... Read more

Read other 3 answers
RELEVANCY SCORE 44.8

Hi, I picked up malware. I've read the previouse posts on this one. I've got [email protected] I'm including my HijackThis because what I've read said that's it's best to let the experts review my logfile first. Any help would be greatly appreciated. Kids have homework to do and I won't let them near the computer right now. Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:17:06 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS... Read more

Read other answers
RELEVANCY SCORE 43.2

My Firefox just crashed, and while I have the restore sessions options selected, it only saved/restored one of several windows. Is there anyway to load the session prior to the last one? (The SessionSaver extension used to have this option, presumably for this very reason.)
 

A:Firefox: Previous - previous session restore

After much fruitless searching for an answer , I started messing around in my Firefox profile. In the end, with Firefox still open, I made a backup of my original profile, then closed Firefox, and in the new default profile I deleted the file "sessionstore.js" then renamed "sessionstore.bak" >>> "sessionstore.js" and restarted. Seems to work!
 

Read other 1 answers
RELEVANCY SCORE 39.6

hey guys. I have peerguardian 2 and everytime i start my computer someone called offeroptimizer.com/static.callinghome.biz[spy], st. also i was looking with spysweeper at my items that startup with windows and i noticed there is something called ShowWnd.exe and i googeld it and some things said it was malicious and some said it was not. Maybe you could help me out. Heres my Hijackthis log. Thanks.Logfile of HijackThis v1.99.1Scan saved at 4:20:18 PM, on 5/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files&#... Read more

A:HJT-Leftover

Welcome leftover to Bleeping Computer.*Restart the computer.*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.*Use the arrow keys to select the Safe mode menu item*press Enter.***We need to make sure all hidden files are showing so please:* Click Start. * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View Tab. * Under the Hidden files and folders heading select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK.***Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exeClick on Fix Checked when finished and exit HijackThis.***Open Windows Explorer.Find and delete this file:C:\Windows\System32\ShowWnd.exe***Reboot the computer to normal mode.Please post back in this topic with a fresh log using HijackThis.

Read other 16 answers
RELEVANCY SCORE 39.2

Hi again,

So I copied the code from http://forums.techguy.org/business-a...heet-easy.html to get my link to go back to the previous active sheet.

I would like an ammendment that allows the link to go back to not only the previous sheet, but also the previous cell where the hyperlink you clicked on to navigate away from the first sheet was located. In effect, when you returned via the macro described in the link above, you would know where you clicked because the cell would be highlighted.

Any help on what changes need to be made so that this can be done would be greatly appreciated.

-CG
 

A:Solved: Macro add-on, previous sheet to previous sheet and cell

Hi,

When you left the "Last Active Sheet" you were active in a cell when you left that sheet. Now when you click the button to take you back to the last sheet you will already be active in the last cell you were on.
 

Read other 3 answers
RELEVANCY SCORE 39.2

Hi I need help getting rid of some trojan/malware remains. Malwarebytes and tdsskiller don't find anything but I am still getting internet explorer redirects, windows firewall turned off & will not turn on and need help because it looks like I may have a rootkit hiding somewhere. I have included my dds files. Also avast is showing alot of "malicious URL blocked" messages and the process is C:\Windows\System32\ping.exe. I have ESAT, MBAM, SAS & HiJackThis logs. I have combofix, aswMBR & minitoolbox dl'd & ready to run but don't want to use them without your direction. I have windows 7 32 Thanks!

A:Win7Antispyware leftover fix

Update......running eset fixed the redirects but I wonder if I still have the rootkit. Eset said I had a variant of the Win32/Sirefef.DN trojan.

Read other 19 answers
RELEVANCY SCORE 39.2

Can anyone tell me if there is such a progamme that can detect leftover programmes on the pc. By that I mean, when you have installed a programme and then decide you don't want it, you delete it from the add/remove control but it always seems to leave some file behind.

Is there anything that would clean all those files up? Hope I am making sense.

Thanks
 

A:Leftover files?

Read other 14 answers
RELEVANCY SCORE 39.2

I got some kind of malware last week. I kept getting tons of pop-ups, which never bothered me before, and other things. One of those fake anti-spyware sites that took over my computer till I shut it down, etc.

So in the past week I have done the following:

I ran Stinger, Ad-Aware, Malicious Removal Tool, CC Cleaner, Housecall, HS Remove, cwshredder, Kill2Me, all of which found nothing, and did a System Restore which had no effect..

Then I ran Malwarebytes and Stopzilla both of which found some Trojans, Malwares, Ad cookies etc and deleted them. (No worms that I could see.)

Since then I still have the following problems:

When I load Firefox - before the page loads in the upper left hand corner I get the following box:

"Java Application Type Error: spElement is null." (A search of "spElement is null" on Google turns up nothing.)

When I click OK, the message box disappears and Firefox loads. Sometimes a few different pages load, Ask.Com, My * 10.Com, etc. A couple pages sometime try to load but there is a message box that says the locations couldn't be found. I click off those pages, I seem to be able to use Firefox without any further problems.

If I try and load Internet Explorer, a bunch pf pages try to load, all with the same internet address with numbers, letters, and symbols that I have never seen before (not a foreign language, but symbols which aren't on my keyboard, letters, etc) Luckily for each page that tries to loa... Read more

A:A few leftover's that I can't seem to shake??

I would do the following.....Use Rkill to stop the rootkit processes that start when the computer comes on. Then I run the Malwarebytes and SUPERAntiSpyware. Here are some DL links for the Rkill....LINK 1LINK 2LINK 3LINK 4Save it to your desktop and then double click to launch it (With Vista you need to right click and select run as administrator). You should see a little black window open and then close. If you see that box then it worked. If you don't see the black box then delete the file and use another download link and repeat the steps.After running Rkill update and run MBAM. Next I would install AFT Cleaner check the box for select all and then run it. Finally, I would run SUPERAntiSpyware. If you have more than one username then you will need to scan each user account seperately with this.

Read other 1 answers
RELEVANCY SCORE 39.2

HI, i removed a security program,and i now find that i have leftover files, i went into task manager found file location, but when i try to delete them, a popup say's i need permission. i am the only user on the pc and also administrater how do i obtain permision or is the another way to delete. i have vista premium 32-bit...thanks

A:Get rid of leftover files

Hi patch41, Take ownership of that file and then delete it.

Read other 5 answers
RELEVANCY SCORE 39.2

thank you for helping me,

Here is where we were working on Internet Explorer issues before I was told there was leftover malware items> http://forums.techguy.org/windows-xp/949714-internet-explorer-problem.html#post7597460

i ran the uninstaller then did the hijack this scan again.
i didn't see the two items you said i should check mark on the list.. so i looked back at the first log and they are listed, but now after the uninstall they are gone. because im not sure what to do, i didn't do the Norton uninstaller part yet.. this it the latest file after the uninstall.

i also noticed that when i would open any file the Search Settings v1.2.3 tried to open every time, and i had to hit the cancel button several times to close it. now that I've done the uninstall, it no longer does this. im guessing they are related somehow and i hope that this new information doesn't come too late..
thank you again for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:46, on 9/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17080)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\... Read more

A:Leftover infection

Search Settings seems to be gone alright.

As for Norton, it should be removed since you should never run more than one antivirus software at the time. They will work one against the other (Avira and Norton), cause your system to be slow and even freeze. Your computer will be even more vulnerable.

Your log is showing traces of past or present infection. After we're done here, we'll need to get you transfered to the Virus & Other Malware Removal forum.
 

Read other 1 answers
RELEVANCY SCORE 39.2

After finally getting the Windows 10 Anniversary Update to install, as expected, I had a WIndows.0ld file. Following instructions posted here and elsewhere, I used Disc Cleanup to remove most of that file.

There are still two folders remaining in Windows.old from System32, one in Drivers (IntcDaud.sys) and one in DriverStore (intcdaud.info.amd64xxxxx.) When I go directly to System32, both drivers appear in the same folders where they show in Wndows.old. Disc Cleanup no longer even recognizes Windows.old, so I cannot run it again to remove what appear to me to be extraneous entries.

Can I safely use Unlocker to try to remove the remaining Windows.old file, which likely would only work after a reboot? If not, is there some other method, short of using the Jaws of Life or a ten-pound sledge hammer to remove the leftover Windows.old file?

A:Windows.old leftover

Hello Not Myself,

Unlocker should work for you. If you like, OPTION THREE below should work as well.

Windows.old Folder - Delete in Windows 10

Read other answers
RELEVANCY SCORE 38.8

So I contracted Smitfraud-c, as named by Spybot, and like everyone else I couldn't get it off. My computer was just going nuts; adding desktop icons, opening my browser, countless prompts ostensibly notifying me of spyware removal tools, and actually running these fake programs. I tried a few smitfraud cleaners and other recommendations to no avail.
Finally I tried using HJT to "delete a file on reboot.." and deleted the dll associated with smitfraud-c. I think I determined the dll file with the SpybotSD recovery listings following a scan, or something like that. Anyway, after I did this SpybotSD was actually able to delete the Smitfraud-c object. After numerous scans with all of my clean-up tools, they are no longer picking up any more malware.
I was happy about this, however things still arent completely right: Boot-ups take a long time (malware is starting up and initiating its hijack, I think), my home page keeps changing, and I'm pretty sure I'm seeing browser hijacker entries in my HJT log.
Security and cleanup tools that I use: SpybotSD, AdawareSE, Spyware blaster, AVG, windows firewall, CCleaner, RegCleaner, Windows disk cleaner and every now and then I'll run rootkit scanners. Here's my HJT log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.e... Read more

A:smitfraud-c, leftover stuff

Read other 12 answers
RELEVANCY SCORE 38.8

Hi!
I created that XML using WSIM. However, if I leave the size field blank (partition: 4), I encounter an error during installation, claiming DiskConfiguration to be incorrect. Is there any way to do this, and how?
Also, after I fixed this, I got a message telling me drivers for HDD/SSD were missing. Since this doesn't seem to happen with the regular installer disks, how and which drivers I need to integrate?

Thanks in advance!
<?xml version="1.0" encoding="utf-8"?><unattend xmlns="urn:schemas-microsoft-com:unattend">    <settings pass="windowsPE">        <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">            <SetupUILanguage>                <UILanguage>de-DE</UILanguage>            </SetupUILanguage>            <InputLocale>de-DE</InputLocale>      &nbs... Read more

Read other answers
RELEVANCY SCORE 38.8

I had a trial program loaded, the program was past the trial period and I forgot to uninstall it. When I did uninstall the program I thought all traces of it where gone. That was about a couple of months ago.
I decided that I would like to use it the program and tried to download it. The program started to download, but never finished the download. Got a message that "old version" needed to be removed.
I've done a search for the program, couldn't find any trace of the program. Went into regedit>software..found something I'm not sure if its the program or not. The program in question FakeWebCam...found in regedit>software "fwc" with 9 keys with values. The initials match the program's name.
Should I delete that folder from regedit?
 

A:Solved: Leftover Program

I just installed it into a virtual machine and it created the fwc key with 9 values so that's probably the one to delete. Always a good idea to export a copy first just in case.

HTH

Jerry
 

Read other 3 answers
RELEVANCY SCORE 38.8

Need some help with this log please, guys. I have broadband but the last day or so the connection was extremely slow and sluggish. I then ran a Spybot search and came up with the wwwcoolsearch.leftover virus. I deleted it from Spybot but the system remained slow - sometimes taking 5 minutes or so to load a page. I then performed a system restore to three days ago and so far that seems to have solved the problem - speed of the broadband connection seems to be much faster now. I just want to make sure there's nothing in my HJT log that should warrant further investigation. If it's of any interest, on Monday I upgraded from ME to XP.



Logfile of HijackThis v1.99.1
Scan saved at 00:07:13, on 31/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcal... Read more

A:wwwcoolsearch.leftover Hijack log

OK, seems I typed too soon. System is back to slow this AM. HELP!

Read other 2 answers
RELEVANCY SCORE 38.8

This is not a big deal, but after cleaning up a mildly infected computer with Malwarebytes Professional, AdwCleaner and HitmanPro, I find I still have a running process for SearchProtect when I checked in Task Manager for anything else.  It is not showing it's using a lot of resources, but it is there.  The entry is located in the System 32 file.  I hesitate to remove anything from that file... Should I leave well enough alone or delete it?  Thanks!Edit: Topic moved from General Security to the more appropriate forum. ~ AnimalEdit: Topic moved from Am I Infected forum to the more appropriate forum. At the request of Malware Removal team member. ~ Animal

A:Leftover Conduit Entry

Hi & to Bleeping Computer Forums!My name is Jürgen and I will be assisting you with your Malware related problems.Before we move on, please read the following points carefully: My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.Perform everything in the correct order. Sometimes one step requires the previous one.If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.If I don't reply within 24 hours please PM me!Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.Step 1Please run a FRST scan. This will help us diagnose your problem.Please download Farbar Recovery Scan Tool and save it to your Desktop.(If you are not sure which version (32-/64-bit) applies to your system, d... Read more

Read other 14 answers
RELEVANCY SCORE 38.8

I am trying to clear out the last remnants of 2 spyware infections, spysherriff.exe and ibm0001.exe. I have gotten just about everything cleared out, but i still have a few items on my hijackthis log that i can not get rid of at all. I am not sure if this is related or not, but my internet just stops working after 20 minutes after i reboot. Called the ISP, they said my connection is okay, i can ping out, but i can not get a connection to anything, IE and firefox open as nothing, no page.this is the one entry that i can not get rid of.O20 - Winlogon Notify: avpe32 - C:\WINDOWS\SYSTEM32\avpe32.dllI have ran, Ewido, adaware, AVG, Spybot - Search & Destroy, kaspersky (which for some reason i can no longer get too). I run WIN XP's firewall, but i can not get to the settings, gives me an error saying "Due to an unidentified problem, Windows cannot display Windows Firewall Settings".Any help would be gladly appreciated, Thanks in advance.Logfile of HijackThis v1.99.1Scan saved at 6:20:24 PM, on 1/14/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32�... Read more

A:Hijackthis Log: Last Remnants Leftover

Hi,

Sorry for this delay. Post please a fresh hijackthis log if you still have problems.

Read other 5 answers
RELEVANCY SCORE 38.8

Hello

I am trying to help my friend again with her PC. I removed Adware and Kazaa a few months ago but someone installed Kazaa again so now I have to clean it up again. She promised her first born if it happens again.

I have installed the latest Windows security updates, cwshredder and Spybot but the browser is still not 100%. It is usable but there 4-5 ads when you launch. Here is her Hijack this file

Logfile of HijackThis v1.97.7
Scan saved at 7:00:14 AM, on 6/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Common files\updmgr\updmgr.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\WINDOWS\System32\mwvzapst.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\dhbrwsr.exe
C:\WINDOWS\odrbvzkha.exe
C:\documents and settings\user\local settin... Read more

A:Leftover Kazaa problems

Read other 11 answers
RELEVANCY SCORE 38.8

Howdy,

Now that I seem to have removed my root-kit I now wish to figure out how to remove what is leftover from a Virumonde infection that I had last year. I am no longer infected, but have 2 calls for dll files that are left in the registry, and cause an error on system start, generating error boxes. I am simply tired of them, but had to get my other issues taken care of first.

Hijack This and MB both allow me to delete the registry entries for both dlls, but they keep reappearing. I have researched this, only to find that it has something to do with the system restore function in XP. That doesn't make sense to me as I have turned system restore off, and it still happens. That leads me to believe that this problem is coming from somewhere else, but I have no idea how to track it down.

Thanks!
 

A:Leftover Virtumonde trash

Read other 16 answers
RELEVANCY SCORE 38.8

My old EIDE WD Caviar200AA is in a box.It was in a Compaq p.o.s.that died,last march.
My new" no-name" is running NTFS. and has 80 Gb Hdd.
How much hassle to add additional" slave" drive to new machine?
what are the snafu's out there? How do I start?
btw I'm new at this

Is the ole' 5600rpm drive seemingly tons slower than my 7200 in practice?

Can any of the fat32 stuff be left on that 20Gb or does it all have to be wiped?
 

A:should I install a leftover second- harddrive,20G

Read other 8 answers
RELEVANCY SCORE 38.8

I am reparing a machine for a friend. After installing and updating Mcafee, I found and removed multiple viruses. However, the desktop still has a long message on a black background that reads: WARNING You Are In Danger All that you ever do on your computer...... Can anyone tell me how to get this off the Desktop? Thanks.
 

A:Desktop Virus Leftover

http://www.processlibrary.com/processscan/ this may help once you reach desktop,however i would run all the anti spy you have make sure you have spybot,adaware etc,download iobit v2 free install run then go to tools start up and look through the registry entries which are starting with windows,also microsoft malicious removal tool may be usefull
http://www.iobit.com/AdvancedWindowsCarePersonal/download.htm
http://www.microsoft.com/security/malwareremove/default.mspx
 

Read other 1 answers
RELEVANCY SCORE 38.8

I used the Windows Police removal procedure as shown and successfully removed the program. THANKS - got my computer back! However, every time I start up my computer or a program now I get the following window notification "name of exec file - BAD IMAGE. Then it states that "globalroot\systemroot\system32\gasfkybospyfqm.dll" is not a valid Windows image. Please check it against your installation disk." I can click on OK and everything works but it comes up everytime something loads. Any information on getting rid of this screen would be appreciated. Also - all my RESTORE points have gone, I can't even get back into yesterday or last month. RESTORE is set to work so????

A:Windows Police leftover help please

Moved from HJT to a more appropriate forum. Tw

Read other 7 answers
RELEVANCY SCORE 38.8

There's been a lot of trojans/malware on this pc in the past and although I've usually managed to eliminate most of the threats, I'm pretty sure there are still some leftover bits and pieces, so I figured I'd try posting this log to see if anyone could help me clean it up a bit, as it's not my computer, obviously I don't want to go messing about in the registry by myself. Take your time, no rush ;)Logfile of Trend Micro HijackThis v2.0.4Scan saved at 03:36:58, on 27/07/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\AVG\AVG9\avgchsvx.exeC:\Program Files\AVG\AVG9\avgrsx.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDevice... Read more

A:Hijack This / Looking For Leftover Narsties

Hi,Please do the following:Please download DDS from either of these linksLINK 1 LINK 2and save it to your desktop.Disable any script blocking protection Double click dds to run the tool. When done, two DDS.txt's will open. Save both reports to your desktop.---------------------------------------------------Please include the contents of the following in your next reply:DDS.txtAttach.txt. NEXTPlease download aswMBR ( 511KB ) to your desktop.Double click the aswMBR.exe icon to run itClick the Scan button to start the scanOn completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Read other 18 answers
RELEVANCY SCORE 38.8

I downloaded a bad file on accident and got inundated with trojans and all kinds of other garbage. So I ran a full MBAM scan and cleaned it all out, mostly. When I open up my browser (Firefox) This is what I see on the top of my browserI also randomly get a page that says "CONNECTION RESET BY REMOTE SERVER. something about reasons for errors, then a link that says RUN THE COMPLETE SCAN." Obviously it's a ruse and I just hit refresh and it goes away. Any help is appreciated

A:I need some help cleaning up some leftover spyware. . .

Hello please run these as instructed and post back 2 logs. If you have SpyBot running please disable it for these.From your regular user account..Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..DO NOT run yet.Open SUPER from icon and install and Update itUnder Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.Now reboot into Safe Mode: How to enter safe mode(XP)Using the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Double-click ATF-Cleaner.exe to run the program.Under Main "Select Files to Delete" choose: Select All.Click the Empty Selected button.If you use Firefox or Opera browser click that browser at the top and choose: Select AllClick the Empty Selected button.If you would like to keep your saved passwords, please click No at the prompt.Click Exit on the Main menu to close the program.NOW Scan with... Read more

Read other 5 answers
RELEVANCY SCORE 38.8

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:20:52 PM, on 4/24/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\WINDOWS\system32\ezSP_Px.exeC:\Program Files\Verizon\McciTrayApp.exeC:\Program Files\ATT-SST\McciTrayApp.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Motive\McciCMService.exeC:\WINDOWS\System32\nvsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Viewpoint\Common\ViewpointService.exeC:\WINDOWS\wanmpsvc.exeC:\Program Files\Linksys\WUSB54GSC\WLService.exeC:\Program Files\Linksys\WUSB54GSC\WUSB54GSC.exeC:\WINDOWS\system... Read more

A:HJthis log - still have viruses leftover?

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below I will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructions... Read more

Read other 2 answers
RELEVANCY SCORE 38.8

I had been using WMP 6.4. Decided to try Version 7. Uninstalled and checked out Version 9. Wish I hadn't done either. I don't care for the extra features they added and should have just stayed with 6.4.

After searching, I've learned that those newer versions added lots of registry entry's that do not get removed with Add/Remove Programs.

When I run Spybot S&D, I still see entry's about Media Player and SDK. I have Win98SE, use Norton Windoctor and JV16 Powertools.

Is there a tool or guide to remove leftover WMP registry entries before putting 6.4 back on? I had deleted 6.4 from Explorer and ran the above before installing the other versions. I also have the Alternative versions, but need WMP for streaming.
 

A:Remove leftover WMP reg entries

Read other 8 answers
RELEVANCY SCORE 38.8

I had a virus/rootkit that I thought I had cleaned up. I'm still having the following issues though:
1. Blue screen trying to boot into safe mode (can't read reason)
2. Generic Host Process for Win32 Services has encountered a problem and needs to close message
3. Can't run full antivirus scan now without getting the above error, but it pops up at other times, like right now. When I get it, I have to restart my laptop - it won't do anything else.
4. Have the occasional extra pop up with an advertisement when I open up IE.
5. I couldn't post this on my laptop - I had to borrow someone else's for a few minutes to get this to go through. It just kept saying it couldn't diplay the page after I tried hitting submit.
6. My laptop is running much slower than normal.

Hope someone can help! I'm in the middle of a big project that needs files from my only computer, so this is the worst timing ever!

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Liz at 17:38:04.46 on Fri 05/13/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.894 [GMT -4:00]
.
AV: Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
.
============== Running Processes ===============
.
C:\WINDOWS\System32\svchost.exe -k Cognizance
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k ne... Read more

A:Leftover Problems from Rootkit

Hello and welcome to the forums!My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.I would be glad to take a look at your log and help you with solving any malware problems.If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed. If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
If I instruct you to download a specific tool in which you already have, please delete the copy that you hav... Read more

Read other 3 answers
RELEVANCY SCORE 38.8

hi, i have problems with malware, i have removed it on many occasions but it comes back, also i apparently still have previous anti virus things installed but i cant find them. Any help would be appreciated.. my HJT log follows..Thanks. Logfile of Trend Micro HijackThis v2.0.2Scan saved at 20:25, on 11/02/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\ESET\ESET Smart Security\ekrn.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\PnkBstrA.exeC:\WINDOWS\system32\svchost.exeC:... Read more

A:malware problems and previous av problems

Hi liquid72,Welcome to the BleepingComputer forums.We apologize for the delay in responding to your request for assistance. Every one of our team members is a volunteer and unfortunately, there are often just not enough to keep up with demand. Thank you so much for your patience.If your issue has been resolved or you have received help elsewhere, please post a reply here and let us know so that we can close this thread.If you still need assistance, my name is SpotCheckBilly (SCB for short) and I will be happy to help you.===Very Important===The instructions in this thread have been specifically designed for THIS USER'S MACHINE ONLY . You should not use these instructions to clean your machine. Doing so could cause irreparable damage to your machine. If you need assistance, please start your own thread.=================A few things which will make our fix go more smoothly.Please >> DO NOT<< run any scans/tools or other fixes unless I ask you to.Please DO NOT install any software while we are working.Please Do not skip any steps. With some infections skipping a step can be disastrous.If there is something you don't understand or or are unsure of -- please stop and take a moment to ask about it. If you are running P2P filesharing program(s). My recommendation is you uninstall it/them.Remove any cracked/pirated software. I will immediately stop helping you if I discover any.The most important thing to remember is to be patient. Very seldom can we remove the ... Read more

Read other 1 answers
RELEVANCY SCORE 38.4

I keep my computer pretty safe and secure, but recently I had a breakin and was confronted with the daunting task of Spy Sheriff taking over my desktop background.I took all of the steps needed to remove it, I believe, but now that I'm pretty sure it's gone, I'm not able to reset my desktop back. Here is my current HJT log.Logfile of HijackThis v1.99.1Scan saved at 11:11:42 PM, on 6/17/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Unable to get Internet Explorer version!Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exeC:\Program Files\Purdue University\Air Link\cvpnd.exeC:\Program Files\Ewiedo\Security\ewidoctrl.exeC:\Program Files\Common Framework\FrameworkService.exeC:\Program Files\McAfee\Mcshield.exeC:\Program Files\McAfee\VsTskMgr.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\WLTRYSVC.EXEC:\WINDOWS\System32\bcmwltry.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\BCMSMMSG.exeC:�... Read more

A:Spy Sherrif fixed, but problems leftover

Welcome berlinbm2004 to Bleeping Computer.Please read these instructions carefully. You may want to print them as we will perform most of this advise in safe mode. Be sure to follow ALL instructions!Open HijackThisGo to ?config?Go to ?misc tools?Press the button ?open uninstall manager?In the list find:SpySheriffPress ?delete this entry?.***Make sure you are disconnected from the Internet and that all programs and windows are closed. Run HiJackThis. Place a check next to the following items, if found, and click FIX CHECKED:O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O4 - HKCU\..\Run: [fBx9RTK3X] recunirl.exeO16 - DPF: {73F0FD85-BD47-4A95-86D1-DE38860462C1} - http://213.254.243.5/data/dialercab/IberoDialerHTML.cabO16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EGDA...ESS_1058_XP.cabClose HiJackThis.***Delete the following, in bold, if found:C:\Program Files\SpySheriff <-whole folderC:\Windows\Desktop.htmlC:\winstall.exe***Copy everything inside the quote box below (starting with REGEDIT4). Paste it into Notepad. Go up to "File > Save As", then click the drop-down box to change the "Save As Type" to "All Files". Save it as fixspy.reg on your desktop. *Make sure there is NO blank line above REGEDIT4REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\Windo... Read more

Read other 3 answers
RELEVANCY SCORE 38.4

I removed mcafee using add/remove programs under the control panel. although i got the message that the uninstall was successful, there are still some things in the start.ini referring to this program. should i remove these using regedit. also will it help in getting rid of a conflict i'm having with other programs already on my computer?
 

A:using regedit to remove leftover files

If you are not real familiar with the registry, I suggest you download RegEditPlus.. a freeware program which provides the same service as windows regedit, but provides backup in case you make an error.
Then, in registry click 'C' and Find, enter any references to McAfee and use the delete button at the extreme top of panel on any that are found.
Download at:
http://www.pcmag.com/article2/0,4149,53887,00.asp
or -
www.zdnet.de/download/library/deAVB-wc.htm
 

Read other 2 answers
RELEVANCY SCORE 38.4

I have installed a couple of Linux distros a copy of XP etc that have been removed from the system. The entries are still left showing up in the bootmenu. How do I delete these unwanted entries?

Note, currently I have Zorin 8 installed dual booting with Windows so it's grub's boot loader that shows up first. This is fine with me and the way I prefer it. On choosing to go to my windows bootmenu I then get the bootmenu screen with all the unwanted entries.

If I am not mistaken, I should be able to delete these entries so when choosing to boot Windows, the system then should boot right into windows without giving me that extra windows bootmenu screen ( because it's not needed - there will be no other choices in that menu to choose from)

How can I do this? Thanks (BTW, I don't want to use a 3rd party tool like BCDEdit)

A:How do I remove leftover entries from the Win 8 bootmenu?

Windows key + R. type msconfig and press Enter.
Click on the Boot tab.
Select the entries you want to remove and click the Delete button.

Read other 9 answers