|
|
#1
24th Aug 2009, 10:07
|
|||
|
|||
|
okay so i had windows system suite i think its called and i scan with malware bytes and it said its rogue program. so i got rid of it by malware bytes. but my system is all mess up.. ie hangs or freezes (says not responding for aobut 15 secs) and firefox takes forever to start. most programs and windows i open says not responding for like a minute. here is some logs.
Superanti spyware: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 08/24/2009 at 11:28 AM Application Version : 4.27.1002 Core Rules Database Version : 4068 Trace Rules Database Version: 2008 Scan type : Complete Scan Total Scan Time : 00:43:12 Memory items scanned : 369 Memory threats detected : 0 Registry items scanned : 3890 Registry threats detected : 0 File items scanned : 25726 File threats detected : 2 Adware.Tracking Cookie C:\Documents and Settings\Administrator\Cookies\administrator@colle ctive-media[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@ad.yi eldmanager[2].txt malware bytes: Malwarebytes' Anti-Malware 1.40 Database version: 2688 Windows 5.1.2600 Service Pack 3 8/24/2009 11:48:23 AM mbam-log-2009-08-24 (11-48-23).txt Scan type: Quick Scan Objects scanned: 82729 Time elapsed: 8 minute(s), 37 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:01:03 PM, on 8/24/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Trend Micro\HijackThis\juice.exe.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec...amp;gc=1&q= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirec...p;gc=1&q=%s O1 - Hosts: 74.125.45.100 4-open-davinci.com O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com O1 - Hosts: 74.125.45.100 privatesecuredpayments.com O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com O1 - Hosts: 74.125.45.100 getantivirusplusnow.com O1 - Hosts: 74.125.45.100 secure-plus-payments.com O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com O1 - Hosts: 74.125.45.100 www.getavplusnow.com O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com O1 - Hosts: 64.86.17.32 google.ae O1 - Hosts: 64.86.17.32 google.as O1 - Hosts: 64.86.17.32 google.at O1 - Hosts: 64.86.17.32 google.az O1 - Hosts: 64.86.17.32 google.ba O1 - Hosts: 64.86.17.32 google.be O1 - Hosts: 64.86.17.32 google.bg O1 - Hosts: 64.86.17.32 google.bs O1 - Hosts: 64.86.17.32 google.ca O1 - Hosts: 64.86.17.32 google.cd O1 - Hosts: 64.86.17.32 google.com.gh O1 - Hosts: 64.86.17.32 google.com.hk O1 - Hosts: 64.86.17.32 google.com.jm O1 - Hosts: 64.86.17.32 google.com.mx O1 - Hosts: 64.86.17.32 google.com.my O1 - Hosts: 64.86.17.32 google.com.na O1 - Hosts: 64.86.17.32 google.com.nf O1 - Hosts: 64.86.17.32 google.com.ng O1 - Hosts: 64.86.17.32 google.ch O1 - Hosts: 64.86.17.32 google.com.np O1 - Hosts: 64.86.17.32 google.com.pr O1 - Hosts: 64.86.17.32 google.com.qa O1 - Hosts: 64.86.17.32 google.com.sg O1 - Hosts: 64.86.17.32 google.com.tj O1 - Hosts: 64.86.17.32 google.com.tw O1 - Hosts: 64.86.17.32 google.dj O1 - Hosts: 64.86.17.32 google.de O1 - Hosts: 64.86.17.32 google.dk O1 - Hosts: 64.86.17.32 google.dm O1 - Hosts: 64.86.17.32 google.ee O1 - Hosts: 64.86.17.32 google.fi O1 - Hosts: 64.86.17.32 google.fm O1 - Hosts: 64.86.17.32 google.fr O1 - Hosts: 64.86.17.32 google.ge O1 - Hosts: 64.86.17.32 google.gg O1 - Hosts: 64.86.17.32 google.gm O1 - Hosts: 64.86.17.32 google.gr O1 - Hosts: 64.86.17.32 google.ht O1 - Hosts: 64.86.17.32 google.ie O1 - Hosts: 64.86.17.32 google.im O1 - Hosts: 64.86.17.32 google.in O1 - Hosts: 64.86.17.32 google.it O1 - Hosts: 64.86.17.32 google.ki O1 - Hosts: 64.86.17.32 google.la O1 - Hosts: 64.86.17.32 google.li O1 - Hosts: 64.86.17.32 google.lv O1 - Hosts: 64.86.17.32 google.ma O1 - Hosts: 64.86.17.32 google.ms O1 - Hosts: 64.86.17.32 google.mu O1 - Hosts: 64.86.17.32 google.mw O1 - Hosts: 64.86.17.32 google.nl O1 - Hosts: 64.86.17.32 google.no O1 - Hosts: 64.86.17.32 google.nr O1 - Hosts: 64.86.17.32 google.nu O1 - Hosts: 64.86.17.32 google.pl O1 - Hosts: 64.86.17.32 google.pn O1 - Hosts: 64.86.17.32 google.pt O1 - Hosts: 64.86.17.32 google.ro O1 - Hosts: 64.86.17.32 google.ru O1 - Hosts: 64.86.17.32 google.rw O1 - Hosts: 64.86.17.32 google.sc O1 - Hosts: 64.86.17.32 google.se O1 - Hosts: 64.86.17.32 google.sh O1 - Hosts: 64.86.17.32 google.si O1 - Hosts: 64.86.17.32 google.sm O1 - Hosts: 64.86.17.32 google.sn O1 - Hosts: 64.86.17.32 google.st O1 - Hosts: 64.86.17.32 google.tl O1 - Hosts: 64.86.17.32 google.tm O1 - Hosts: 64.86.17.32 google.tt O1 - Hosts: 64.86.17.32 google.us O1 - Hosts: 64.86.17.32 google.vu O1 - Hosts: 64.86.17.32 google.ws O1 - Hosts: 64.86.17.32 google.co.ck O1 - Hosts: 64.86.17.32 google.co.id O1 - Hosts: 64.86.17.32 google.co.il O1 - Hosts: 64.86.17.32 google.co.in O1 - Hosts: 64.86.17.32 google.co.jp O1 - Hosts: 64.86.17.32 google.co.kr O1 - Hosts: 64.86.17.32 google.co.ls O1 - Hosts: 64.86.17.32 google.co.ma O1 - Hosts: 64.86.17.32 google.co.nz O1 - Hosts: 64.86.17.32 google.co.tz O1 - Hosts: 64.86.17.32 google.co.ug O1 - Hosts: 64.86.17.32 google.co.uk O1 - Hosts: 64.86.17.32 google.co.za O1 - Hosts: 64.86.17.32 google.co.zm O1 - Hosts: 64.86.17.32 google.com O1 - Hosts: 64.86.17.32 google.com.af O1 - Hosts: 64.86.17.32 google.com.ag O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingle Instance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst_current.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/...can8/oscan8.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- End of file - 8939 bytes |
|
#2
25th Aug 2009, 10:40
|
|||
|
|||
|
Hello.
Before you begin the SDFix instructions you should copy these instructions in a Notepad file and save them to your desktop or print them for easy reference. Much of SDFix will be done in Safe mode and you will be unable to access this web page after booting into Safe mode. Download SDFix by AndyManchesta and save it to your desktop. When using this tool, you must use the Administrator's account or an account with Administrative rights * Now, double-click on the SDFix icon that should now be residing on your desktop. If a Open File - Security Warning box opens, click on the Run button. * A window will now open showing SDFix being extracted into the C:\SDFix folder. * Once the installation program has finished extracting SDFix, it will open a Notepad with further instructions. * DO NOT use it just yet. Reboot your computer in Safe Mode using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". When your computer has started in safe mode, and you see the desktop, close all open Windows. * Click on the Start button, click on the Run menu option, and type the following text from the Code Box into the Open: field then click the OK button. Code:
C:\SDFix\RunThis.bat * Type Y on your keyboard and then press Enter to begin the cleanup process. * It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot. * Press any Key and it will restart the PC. * When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. * Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt. * Copy and paste the contents of the results file Report.txt in your next reply. ---------- Download DDS from |HERE| or |HERE| or |HERE| and save it to your desktop. Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it) * XP users Double click on dds to run it. * If your antivirus or firewall try to block DDS then please allow it to run. * When finished DDS will open two (2) logs. 1) DDS.txt 2) Attach.txt * Save both logs to your desktop. * Please copy and paste the entire contents of both logs in your next reply. Note: DDS will instruct you to post the Attach.txt log as an attachment. Please just post it as you would any other log by copy and pasting it into the reply.
__________________
 |
