I have Windows XP Home and I run IE. I have this stupid virus in the archives and I can't get rid of it. I've deleted the file called PopCap, but it still shows in the archives. I've included a HiJackThis log just in case that will help you figure this out.
View 8 Repliescant get the xp theme back on my system after removing a virus and using the restore feature on my xp cd. I did notice that my theme changed to the windows classic style while dealing with the virus. The virus changed my theme to classic and added a webpage as my background picture so I think that was the cause. What should I do to fix this problem of not being able to change my theme to xp.
Ps. The theme is available but when I choose it all it does is it changes my background picture and colors but my buttons and windows stay classic.
Please give advice on what to delete to clean up IE. Logfile of HijackThis v1.99.0 Scan saved at 8:16:49 PM, on 2/18/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
I'm being driven insane by this. An office laptop running XP Home was riddled with malware - spyfighter, pcadprotector, CSW.HomeSearch etc. I've managed to remove them all after a full day of hassle but I'm still left with a frustrating issue in that I cannot adjust the desktop background. The properties box is greyed out for backgrounds. We have a simple peer to peer network (workgroup in fact) and no internal security or policies. What can I do before I throw the thing out of the window?
View 10 Replies View RelatedIn an attempt to remove malware, I accidently deleted some registry keys and am unable to log back onto my user name. I had exported the entire registry (*.reg) prior to screwing with the registry. Can somebody help me figure out how to restore my registry to the previous condition. Doing an import doesn't work.
View 3 Replies View RelatedMy startup time has increased by at least 8 mins
my HJT log is:
Logfile of HijackThis v1.99.1
Scan saved at 11:33:54 PM, on 27/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSvcHst.exe
C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe
C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe
C:Program FilesNorton SystemWorksNorton GoBackGBPoll.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:PROGRA~1NORTON~1NORTON~1NPROTECT.EXE
C:Program FilesSpyware Doctorsdhelp.exe
C:WINDOWSsystem32 cpsvcs.exe
C:WINDOWSSystem32snmp.exe
C:PROGRA~1NORTON~1NORTON~1SPEEDD~1NOPDB.EXE
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindService.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:Program FilesJavajre1.5.0_11injusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:PROGRA~1TASKBA~1TaskBar.exe
C:Program FilesuTorrentutorrent.exe
C:Program FilesNorton SystemWorksNorton GoBackGBTray.exe
C:WINDOWSsystem32 askmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesMSN Messengerusnsvc.exe
C:Documents and Settings
.chanDesktopVundo Remove ToolshijackthisTJH.exe.exe
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0AcrobatActiveXAcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:PROGRA~1SPYWAR~1 oolsiesdsg.dll
O2 - BHO: (no name) - {61ACC408-B733-482E-BDF1-C020F10014FE} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_11inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:PROGRA~1SPYWAR~1 oolsiesdpb.dll
O2 - BHO: (no name) - {C47A9554-195A-4769-9B13-04F15B450A39} - (no file)
O2 - BHO: (no name) - {CF293022-3C24-4843-B47F-4F38D7334F4D} - (no file)
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [osCheck] "C:Program FilesNorton AntiVirusosCheck.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.5.0_11injusched.exe"
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Taskbar Hide] "C:PROGRA~1TASKBA~1TaskBar.exe" -Start
O4 - HKCU..Run: [�Torrent] "C:Program FilesuTorrentutorrent.exe"
O4 - HKCU..Run: [Spyware Doctor] "C:Program FilesSpyware Doctorswdoctor.exe" /Q
O4 - Global Startup: Norton GoBack.lnk = C:Program FilesNorton SystemWorksNorton GoBackGBTray.exe
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_11inssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_11inssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:PROGRA~1SPYWAR~1 oolsiesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:Program FilesNorton SystemWorksNorton CleanupWCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:Program FilesNorton SystemWorksNorton CleanupWCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:Program FilesPartyPokerRunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:Program FilesPartyPokerRunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb...LStreaming.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-48.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1160655278677
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:PROGRA~1MSNMES~1MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:PROGRA~1MSNMES~1MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - igfxsrvc.dll (file missing)
O20 - Winlogon Notify: mljjgda - mljjgda.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:WINDOWSsystem32WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:Program FilesSymantecLiveUpdateALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:Program FilesCommon FilesSymantec SharedccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:Program FilesNorton SystemWorksNorton GoBackGBPoll.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:Program FilesNorton AntiVirusisPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:PROGRA~1SymantecLIVEUP~1LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:Program FilesNeroNero 7Nero BackItUpNBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:PROGRA~1NORTON~1NORTON~1NPROTECT.EXE
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:Program FilesSpyware Doctorsdhelp.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1NORTON~1NORTON~1SPEEDD~1NOPDB.EXE
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedAppCoreAppSvc32.exe
I did remove virus efeected files and my PC is behaving badly, it responds very slow to commands and freezes. Here is the log. Can anybody help me to resore my computer
View 3 Replies View RelatedI'll try to remember, to the best of my ability, the sequence of events...Suffice it to say that I downloaded and tried to install something I shouldn't have. I Immediately tried to get out of the errors from AVG (free version) and stop the install. All seems good, then IE keeps opening to bogus ad sites. I realize I've got something. AVG and AdAware both fail in removing this Win32Trojan.tdss (I think AVG gave me this description). AVG tells me to reboot to remove it properly. Reboot throws me into "can't verify this installation of Windows". Boot in safe mode work, then I get the same error on reboot...even in safe mode.
I don't have the original Windows CD (separated from husband and software at the same time; cannot find any software now), but it's a Dell and it came with Windows XP Home (product key on box), but I installed XP Pro instead. Don't know what product key was used or how to get it.....
Error Code 0F00:0244
Error Code 0F00:1A44
Msg: Block 6442285....
I have the trojan horse virus. I'm running AVG Anti-Virus.
View 1 Replies View RelatedDoes any computer wiz out there know of an anti-virus site that will remove the rojan horse virus free? I know that all downloads are free,but once they find all the infected files,they won't remove them with out u paying for them
View 9 Replies View RelatedThere is little to no information on this little guy, but it looks like xcechinu.dll is a Virus, if this is legitimate or not, but I cant remove it with anything that i have at the moment
View 39 Replies View RelatedMy PC recently got a fairly nasty virus (W32-Sinowal-based Maximus! or something along those lines) so we had to get it wiped. A few days later, my computer was all messed up again. I can only boot up in Safe Mode, my sound doesn't work, and it is running slower than normal. I need to find out if I have another virus (although the guy who fixed it downloaded Norton Anti-Virus and it seemed fine for a few days) or if maybe my computer is just dying. It's about three years old and apparently it was outdated before we even bought it. Is there any way the virus could have affected the computer's hard drive or whatever (yeah, I don't quite know what I'm talking about) or have I maybe gotten another virus?
View 4 Replies View RelatedI had a trojan Virus in the computer. I think that I got rid of it, but I am not sure could anyone that can read a log please tell me if there is anything else left in the computer. The computer now doesn't stay on-line it disconnects itself. I called the company that provides me with my internet service, and they said that I need a filter for the phone line. The person told me that, that will take care of the problem of the internet disconnecting. I think that it could be the virus I had in the computer. I wasn't able to get on-line for at least a week, I had gone and checked the disk for errors and finally the anti-virus program was able to find the virus's.
View 1 Replies View RelatedMy anti-virus software keeps on detecting some virus from different folders from the C:WINDOWS emp folder, yet all folders are empty. It detects trojans from those empty folders . All folders from the temp folder are empty. Can't I just delete it all?
View 4 Replies View RelatedA few days back I noticed my Anti Virus was automatically disabled. It usually runs continously in the background but of late it was being disabled.I tried re installing but it was of no use. Now I find that a suspcious program 'Form1' is running when I use alt+tab.Could not find this on the task manager though When I try to run anti virus scans / Spybot / Ewido, my computer just freezes after starting the scan!I know somethings wrong but I dont know what
View 5 Replies View RelatedI recently was infected with a computer virus. Norton AntiVirus 2003 initially caught the virus and it supposedly deleted it, so I was not concerned with the message details. However, almost immediately after receiving the message I realized the virus was not completely removed. A DOS window popped up two or three times and then Norton shutdown. I tried opening Norton again but it would not open. I then tried uninstalling and reinstalling but it would not reinstall. I tried the Windows Update site and the page shows no conent. Any ideas on how to identify the virus so I can take steps to remove it?
View 6 Replies View RelatedI'm in need for a good antivirus program that don't take up much resources and works, right now i have mcafee virus scan but for some reason it sometiems disable it self so some suggestions? anything free is welcome, but if something is really good i'd buy it
View 8 Replies View RelatedI downloaded a prog and now when i open the computer it says : "windows shuttdown
and a ''cmd'' that says the same "-s -t VIRUS DETECTED
Hi just joined this forum today to see if anyone kind enought can help me out The problem is one of my drives has a virus,i have done a complete scan with online virus scans such as panda Trend micro housecall etc, i have used my norton program too but when these programs carry out a full system scan ,it gets to a certain point my
computer makes a clicking noise for a second then my screen freezes up i cant move the mouse pointer basicaly screen freezes. i know i have some infected files but i dont know which ones are infected as the virus scan dosnt finish and show end results
A family member was surfing the net for a television program she missed and a box popped up stating she had a virus. I never heard of it I guess it's some sort of spyware..
View 6 Replies View RelatedI got this weird little pain in the butt virus. symptoms are similiar to that of virus burster. Random annyoing popups trying to get you to install things. i checked my add/remove and i cant find any trace of it... im completely clueless. did virus scans and it deleted all infected files
View 14 Replies View RelatedI am looking to get the right anti-virus for my computer, however it already has a virus on it and i need to know what to do. It will not let me restore or anything. It took all the icons away
View 8 Replies View RelatedI am another victim of the trojan virus deleted (with Antivir) . I've read some post from JSntgRvr helping other guys to solve the problem. I hesitate to follow the same procedure to skip more problems...this the report from AV Antivir...
Begin scan in 'C:' <VAIO>
C:autorun.bat
[DETECTION] Contains signature of the batch virus BAT/Small.K [INFO] The file was deleted!
C:autorun.vbs
[DETECTION] Contains signature of the VBS script virus VBS/Small.K [INFO] The file was deleted
Now I have the error opening c: or d: drives "autorun.vbs not found" or something similar.
I have computer ***. antivirus 2007. It is telling me I need to manually remove a Byte.Verify virus X3 I have. Directs me to: Start. Control Panel. Java Plug in Control Panel. Chache Tab and then to Clear.I can get to this manually but no one at CA will tell me what I am clearing or deleting so I am afraid to do this. Can anyone tell me what I'm deleting or clearing? I would not lose any significant data or programming?
View 5 Replies View RelatedFor the past week, I have been geting this pop-up every so often I use IE7. Some Asian site http://www.100x10000.com/cai_union.html keeps opening every time I start IE or it sometimes opens when I go to another site. I'm using XP and IE7, I don't want suggestions on using other browsers, just need someone to help me remove it. I had a similar thing a long time ago, and I searched it on google and found the solutions right away. I can't find anything on that ad, but I'm pretty sure I can solve it the same way, but I don't remember what file I deleted the first time to get rid of the other add pop-up.
View 7 Replies View RelatedIs there any way to remove a software program if you have deleted the uninstaller??
View 7 Replies View RelatedI have a computer that runs windows xp pro, service pack 1. I was having trouble with freezing and a whole lot of pop ups, I started a virus scan with anti vir and it deleted a whole bunch of trojan horses, but didn't find any viruses. I installed the free version of AdAware and every time I try to run a scan, it starts ok but after a few minitues it has found about 20 critical objects when it just turns off by itself. I have restarted it several times and it does the same thing. I have downloaded spyware doctor and spybot, but every time I try to install them, it tells me that a dll or some other thing like a scripter cannot install. Can someone tell me why AdAware is quiting by itself and why spybot and spyware doctor cannot be installed.
View 15 Replies View RelatedI have not been able to get into my C drive directly, I have got to use a shortcut,when I try to get into it directly I get a message saying "Windows cannot find 'RECYCLERs-2-8-49-100014492-100020849-100010941-4277.com.' make sure you have typed the name correctly, then try again. To search for a file, click the start button,and then Click Search." I only know that this is a virus because when I plugged a cheap usb storage stick I saw a folder called RECYCLER start to be created, I managed to stop it from finishing, but there is no RECYCLER folder in my C drive.
View 3 Replies View RelatedCan I get rid of some of these services to speed up my computer? Logfile of HijackThis v1.99.0
I have recently installed windows XP pro SP 2 on my computer. Is there a way to remove a user from the welcome screen so that no body knows the log in name of that user. Just like the build in administrator account which is not displayed on welcome screen but one can log into this account thru the classic log in screen instead of welcome screen (pressing Ctrl Alt Del) twice?
View 14 Replies View RelatedAnyone know a good method of purging an XP pc of a user, like when a machine is sold and the new user wants all traces of the old user removed?
I thought I had a reasonably good method, which was to create a new user account, remove the default files from it's folder in Documents and Settings, copy most of the contents of the original user's folder into it, then delete the original user.
This method isn't too bad, and removes most of the obvious traces of the original owner, while leaving all the desktop and Windows settings intact.
But a scan with RegSeeker (incidentally, this is a damn good free app for finding and deleting multiple registry entries) revealed 85 instances of the old user name still in the Registry, so my method isn't 100% effective