#1
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
[Resolved]Please help with Registry Virus. Runtime error at....
my Hijack This log:SP2 (WinNT 5.01.2600)http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab http://web1.shutterfly.com/downloads/Uploader.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Oct 2002
Location: Amsterdam
Posts: 29
Computer Experience:
Hi,
#3
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi artmonk81Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following (if present): Intelli Mouse Pro Version 2.0B scan only . Check the boxes next to all the entries listed below. O4 - HKLM\..\RunOnce: [*Intelli Mouse Pro Version 2.0B*] C:\WINDOWS\system32\splm\ncsjapi32.exe close all windows other than HiJackThis , then click Fix Checked. HJT .'Show Hidden Files/Folders' option, like this:Start. My Computer. Tools menu and click Folder Options. View Tab . Under the Hidden files and folders heading select Show hidden files and folders. Hide protected operating system files (recommended) option. Yes to confirm. OK .Reboot into safe mode. folders C:\WINDOWS\system32\splm After that, Reboot .HJT Log into this Thread.
#4
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab http://web1.shutterfly.com/downloads/Uploader.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
#5
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi artmonk81Symantec - Norton 'Show Hidden Files/Folders' option, like this:Start. My Computer. Tools menu and click Folder Options. View Tab . Under the Hidden files and folders heading select Show hidden files and folders. Hide protected operating system files (recommended) option. Yes to confirm. OK .Reboot into safe mode. Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following (if present): Intelli Mouse Pro Version 2.0B scan only . Check the boxes next to all the entries listed below. O4 - HKLM\..\RunOnce: [*Intelli Mouse Pro Version 2.0B*] C:\WINDOWS\system32\splm\ncsjapi32.exe close all windows other than HiJackThis , then click Fix Checked. HJT .folders C:\WINDOWS\system32\splm After that, Reboot .HJT Log into this Thread.
#6
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab http://web1.shutterfly.com/downloads/Uploader.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
#7
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi download the OTMoveIt2 by OldTimer Save it to your desktop .
Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator ).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy ):
Code:
C:\Program Files\Common Files\Authentium
C:\WINDOWS\system32\splm Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste .
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.Close OTMoveIt2
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post and a New HJT log.
#8
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab http://web1.shutterfly.com/downloads/Uploader.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
#9
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi artmonk81
Quote:
may i ask what this did? because for now I no longer get those error messages.
This is the source of most the problems plus the multiple security suites.Verizon Internet Security Suite Here disable realtime protection applications as they sometimes interfere with the tool. this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
#10
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
ComboFix 08-08-21.02 - RAF 2008-08-22 21:11:59.1 - NTFSx86WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! js - STARTUP.HOMEPAGE - www.google.com http://www.gmer.net
#11
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi artmonk81HostsXpert 3.7 - Hosts File Manager Unzip HostsXpert - Hosts File Manager to a convenient folder such as C:\HostsXpert
Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
Click "Make Hosts Writable?" in the upper right corner (If available).
Click Backup / Restore then Create Backup
Click Restore Microsoft's Hosts file and then click OK.
Click the X to exit the program.
Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
sc stop dvpapi contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
C:\WINDOWS\avscan.ini
C:\WINDOWS\validate.inf
C:\WINDOWS\joke.gif
Folder::
C:\WINDOWS\system32\splm
C:\Program Files\Common Files\Authentium
Registry::
{-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Intelli Mouse Pro Version 2.0B\StubPath}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*Intelli Mouse Pro Version 2.0B*]
[-HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Intelli Mouse Pro Version 2.0B]
[-HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Intelli Mouse Pro Version 2.0B*]
[-HKEY_USERS\Software\Microsoft\Windows\nScan32\ExecuteDate] Please post the Combofix log and a New HJT log.
#12
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ig/dell?hl=en&...us&ibd=0060928 https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab http://web1.shutterfly.com/downloads/Uploader.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net
#13
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi artmonk81
Quote:
would like to get to know as much as possible about computers. can you recommend any books i should read?
I would post this question in the General Discussions forum, you will get better answers from more knowledgeable people about that there then I would be able to give you.ATF Cleaner by Atribune and save it to your Desktop.Windows Temp Kaspersky WebScanner Click on “Accept” If your pop –up blocker blocks any windows from opening. Click Run on the window that opens .Windows Vista users you must open the web browser using the Run as Administrator command.The program will launch and then begin downloading the latest definition files:
Under Scan on the left side.Click on My Computer
This will start the program and scan your system.
Click the “Scan Report” On the left side.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected. Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file . Click OK to save the file.:
Save the text file to your desktop.
Copy and paste that information in your next post.
#14
Member
Profile: Join Date: Aug 2008
Posts: 8
Computer Experience:
--------------------------------------------------------------------------------
#15
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi artmonk81 Please double-click OTMoveIt2.exe to run it.
Click on the CleanUp! button. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
This step removes the files, folders, and shortcuts created by the tools I had you download and run.
All times are GMT +1. The time now is 04:43 .
