#1
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
Its Got Problems (trojans)
My sons computer is not working properly. In fact its pretty bad. He is blaming the 2 gig of RAM I installed in December. SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.toshibadirect.com/dpdstart http://www.toshibadirect.com/dpdstart http://us.rd.yahoo.com/customize/ie/...ch/search.html http://www.yahoo.com/ http ://www.toshibadirect.com/dpdstarthttp://lads.myspace.com/upload/MySpaceUploader1005.cab http://awbeta.net-nucleus.com/FIX/WinATS.cab
Didn't find the information you thought to find?Similar Threads
#2
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
Here is a DSS Log SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)dss .exehttp://www.toshibadirect.com/dpdstart http://www.toshibadirect.com/dpdstart http://us.rd.yahoo.com/customize/ie/...ch/search.html http://www.yahoo.com/ http ://www.toshibadirect.com/dpdstarthttp://lads.myspace.com/upload/MySpaceUploader1005.cab http://awbeta.net-nucleus.com/FIX/WinATS.cab ad .a8.netwww.aaa-livedoor.net #[Trojan-PSW.Win32.Maran.ei]www.abcsearcher.com #[Spamdexing][Microsoft.Strider]www.abx4.com #[Adware.ABXToolbar]www.acezip.net #[Win32/Adware.180Solutions]
#3
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
Last edited by Ranger SVO; 5th February 2008 at 16:45 .
#4
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,547
Computer Experience:
Hi Ranger SVOAdd/Remove Programs and remove the following (if present): Orbit or Orbitdownloader Please note any other programs that you dont recognize in that list and post them in your next response Here this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users right click Combofix.exe and select Run As Administrator.When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall CF log.
#5
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
No need to apologize to me at all, your spending your free time helping me.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Code:
<pre>
----a-w 344,064 2007-12-30 21:00:35 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
----a-w 185,896 2007-12-30 20:28:39 C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w 68,856 2007-12-30 21:01:26 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w 83,608 2007-12-30 21:00:59 C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe
----a-w 20,480 2007-12-30 21:01:13 C:\Program Files\Lexmark 2500 Series\lxddamon .exe
----a-w 291,760 2007-12-30 21:01:05 C:\Program Files\Lexmark 2500 Series\lxddmon .exe
----a-w 312,240 2007-12-30 21:01:13 C:\Program Files\Lexmark Fax Solutions\fm3032 .exe
----a-w 188,416 2007-12-30 21:00:52 C:\Program Files\ltmoh\Ltmoh .exe
----a-w 1,121,280 2007-12-30 21:01:04 C:\Program Files\McAfee\SpamKiller\MSKDetct .exe
----a-w 1,694,208 2007-12-30 21:01:42 C:\Program Files\Messenger\msmsgs .exe
----a-w 8,720,384 2007-12-30 21:01:53 C:\Program Files\MySpace\IM\MySpaceIM .exe
----a-w 448,512 2008-02-07 01:12:39 C:\Program Files\QuickTime\qttask .exe
----a-w 1,649,600 2007-12-30 21:01:29 C:\Program Files\SlySoft\AnyDVD\AnyDVD .exe
----a-w 761,946 2007-12-30 21:00:37 C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w 65,536 2007-12-30 21:01:15 C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd .exe
----a-w 122,880 2007-12-30 21:00:46 C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView .exe
----a-w 1,077,322 2007-12-30 21:00:45 C:\Program Files\TOSHIBA\Touch and Launch\PadExe .exe
----a-w 1,773,568 2007-12-30 21:00:44 C:\Program Files\TOSHIBA\Windows Utilities\Hotkey .exe
----a-w 151,552 2007-12-30 21:00:52 C:\TOSHIBA\IVP\ISM\pinger .exe
----a-w 15,360 2007-12-30 21:01:17 C:\WINDOWS\system32\ctfmon .exe
----a-w 155,648 2007-12-30 21:00:55 C:\WINDOWS\system32\NeroCheck .exe
----a-w 90,112 2007-12-30 21:01:05 C:\WINDOWS\system32\service .exe
</pre> http://www.gmer.net
#6
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
I just wanna say, take your time, my son fixed the virus problem by buying a new computer. So for now this is just an extra computer. Again, Thank you for takng the time to helpSP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.toshibadirect.com/dpdstart http://www.toshibadirect.com/dpdstart http://us.rd.yahoo.com/customize/ie/...ch/search.html http://www.yahoo.com/ http ://www.toshibadirect.com/dpdstarthttp://lads.myspace.com/upload/MySpaceUploader1005.cab http://awbeta.net-nucleus.com/FIX/WinATS.cab
#7
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,547
Computer Experience:
Hi Ranger SVOcontents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8B27CC68-110C-46a9-80D3-F3107DE6EB98}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C6D5A56-791E-4fe8-9D64-81781FA15D68}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9815DA81-2E0C-478c-90E4-06E474E704D0}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebbaaa]
RenV::
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched .exe
C:\Program Files\Lexmark 2500 Series\lxddamon .exe
C:\Program Files\Lexmark 2500 Series\lxddmon .exe
C:\Program Files\Lexmark Fax Solutions\fm3032 .exe
C:\Program Files\ltmoh\Ltmoh .exe
C:\Program Files\McAfee\SpamKiller\MSKDetct .exe
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\MySpace\IM\MySpaceIM .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD .exe
C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd .exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView .exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe .exe
C:\Program Files\TOSHIBA\Windows Utilities\Hotkey .exe
C:\TOSHIBA\IVP\ISM\pinger .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\NeroCheck .exe
C:\WINDOWS\system32\service .exe Please download ATF Cleaner This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program.Main choose: Select All Empty Selected button.
If you use Firefox browser Click Firefox at the top and choose: Select All Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser Click Opera at the top and choose: Select All Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Exit on the Main menu to close the program.Technical Support , double-click the e-mail address located at the bottom of each menu.CF log.
#8
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
Here is the ComboFix LogWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Code:
<pre>
----a-w 448,512 2008-02-07 01:12:39 C:\Program Files\QuickTime\qttask .exe
</pre> http://www.gmer.net
#9
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
I just noticed something new on the desktop, it a folder named %SystemDrive%
#10
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,547
Computer Experience:
Hi Ranger
Quote:
Any Idea as to what it is?
%SystemDrive% is the C drive for the machine, I have no idea why that would show up on your desktop?contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
RenV::
C:\Program Files\QuickTime\qttask .exe Please post the new Combofix log and I'll see what Dave says about that folder.
#11
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
I'll be more than happy to drag and drop it where it belongs. I dont know when It appeared on the desktop. It could have been there awhile. WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net
#12
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,547
Computer Experience:
Hi RangerJotti File Submission: Please go to Jotti's malware scan
Copy and paste the following file path into the "File to upload & scan" box on the top of the page: one at a time.C:\WINDOWS\PSEXESVC.EXE
Click on the submit button
Please post the results in your next reply.
#13
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
No its not a short cut. Can I send you a .zip copy of the folder?SystemCertificates , it contains a number of folders that are all empty.CrptnetUrlCache contains two folders, Content and MetaData which contain two system files each.
#14
Senior Member
Profile: Join Date: May 2006
Location: Abilene Texas
Posts: 268
Computer Experience:
I just completed a system search for AVSredirect and found nothing. I included all of C: and also included hidden system files and folders.
#15
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,547
Computer Experience:
Hi Ranger
Quote:
Can I send you a .zip copy of the folder?
No, I don't have a Vertual Machine so I can't do as Dave does.'Show Hidden Files/Folders' option, like this:Start. My Computer. Tools menu and click Folder Options. View Tab . Under the Hidden files and folders heading select Show hidden files and folders. Hide protected operating system files (recommended) option. Yes to confirm. OK .
All times are GMT +1. The time now is 08:40 .
