1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Virus \ spyware?

Discussion in 'Malware and Virus Removal Archive' started by laasunde, 2008/04/18.

  1. 2008/04/18
    laasunde

    laasunde Inactive Thread Starter

    Joined:
    2002/01/14
    Messages:
    89
    Likes Received:
    0
    [Resolved] Virus \ spyware?

    Keep getting this popup with reference to different applications.

    "Application Error - userInit.exe" - "The instruction at "0x7c901010 "
    reference memory at "0x052f273C ". The memory could not be "read ".
    Click on OK to terminate the program."

    Posted this post in WinXP forum.

    Did the Kaspersky scan last night and got the following result. Quite a few files are locked, is this normal ? Only three files are 'infected'. What should I do with these files?


    Here is HijackThis log. A number of entries here I have a no clue what are doing?
    Should I perhaps perform some sort of cleanup or is everything ok?
    What do you guys think?
     
    laasunde,
    #1
  2. 2008/04/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi laasunde :)

    Locked objects are quite normal, and I see none of them that appear to be malicious.

    Are you using the BluesPortScanner? It's detected as malicious due to it's behavior and abilities.

    You appear to have a couple of unknowns though ........ tied to your Winsock stack.

    O10 - Unknown file in Winsock LSP: ptmp2004.dll
    O10 - Unknown file in Winsock LSP: ws2lspx.dll


    Please see if you can locate those two dll files, then upload them to my submission channel for analysis. Leave a link back to this topic. Thanks!
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/04/21
    laasunde

    laasunde Inactive Thread Starter

    Joined:
    2002/01/14
    Messages:
    89
    Likes Received:
    0
    Both files have been uploaded.

    Much appreciated :)
     
    laasunde,
    #3
  5. 2008/04/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    One of those files references xuebrothers. Did you install MyWeb from xuebrothers?
    http://www.xuebrothers.net/myweb/myweb.htm

    The other mentions Socket Spy, which implies part of a tool that monitors TCP and UDP port connections. Have you got any such application?
     
    noahdfear,
    #4
  6. 2008/04/22
    laasunde

    laasunde Inactive Thread Starter

    Joined:
    2002/01/14
    Messages:
    89
    Likes Received:
    0
    Fairly certain I had IP & Socket Monitor from xuebrothers and also Socket Spy installed at some point. Both have been uninstalled some time ago.

    Do you reckon they have left some garbage on computer?

    How do I 'fix' this ?

    Thanks for your help.
     
    laasunde,
    #5
  7. 2008/04/23
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Yes, they have left files in the Winsock stack. The Winsock stack is what enables data transmission in and out of your computer. If the stack gets broken you will lose internet connectivity and connectivity to any networked computers. We can remove them from the stack with a tool.

    • Download LSPFix.exe
    • Save it to the desktop.
    • Close all open browser windows.
    • Open LSPFix, check the box 'I know what I'm doing'.
    • Select each entry for the following two files and use the >> button to move them to the Remove column.
    • Click Finish.
    • Reboot the machine.


    How many memory modules (sticks of RAM) does your computer have?
     
    noahdfear,
    #6
  8. 2008/05/05
    laasunde

    laasunde Inactive Thread Starter

    Joined:
    2002/01/14
    Messages:
    89
    Likes Received:
    0
    Followed your instructions and it appears the popups have gonna away.

    Cheers :)
     
    laasunde,
    #7
  9. 2008/05/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    That's good news! :)

    Please post a fresh HijackThis log for me, if you don't mind.
     
    noahdfear,
    #8
  10. 2008/05/16
    laasunde

    laasunde Inactive Thread Starter

    Joined:
    2002/01/14
    Messages:
    89
    Likes Received:
    0
    Sorry for the delay

     
    laasunde,
    #9
  11. 2008/05/17
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good. Scan with HijackThis and fix the following entry.

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    Everything seem to be working as it should now?
     
    noahdfear,
    #10
  12. 2008/05/19
    laasunde

    laasunde Inactive Thread Starter

    Joined:
    2002/01/14
    Messages:
    89
    Likes Received:
    0
    Everything is working now :)
     
    laasunde,
    #11
  13. 2008/05/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Glad to hear it. :)
     
    noahdfear,
    #12

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...