egdaccess + keygen Solved

Question

Bonjour,  Here is my scan of the SD toolbar. Could you please tell me if I need to remove the keygens and the EGDACCESS thing?  Thank you.    -----------\ ToolBar S&D 1.2.8 XP/Vista   Microsoft (R) Windows Script Host Version 5.6  Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.  Microsoft Windows XP Professional (v5.1.2600) Service Pack 2  X86-based PC (Uniprocessor Free: Intel(R) Pentium(R) 4 CPU 2.40GHz)  BIOS: Default System BIOS  USER: Fred (Administrator)  BOOT: Normal boot  Antivirus: Avira AntiVir PersonalEdition 8.0.1.30 (Activated)  A:\ (USB)  C:\ (Local Disk) - NTFS - Total: 38 Go (Free: 7 Go)  D:\ (CD or DVD)  E:\ (Local Disk) - NTFS - Total: 931 Go (Free: 226 Go)  F:\ (Local Disk) - NTFS - Total: 465 Go (Free: 166 Go)  G:\ (Local Disk) - NTFS - Total: 465 Go (Free: 325 Go)   "C:\ToolBar SD" (LAST UPDATED: 21-12-2008|20:47)  Option: [1] (11/03/2009|0:11)   -----------\ File / Folder Search ...    -----------\ Extensions   (All Users) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar   (Fred) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper    -----------\ [..\Internet Explorer\Main]   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]  "Local Page"="C:\WINDOWS\system32\blank.htm"  "Search Page"="https://actus.sfr.fr"  "Start Page"="http://home.neuf.fr/"  "Search Bar"="https://actus.sfr.fr"  "Url"="http://www.microsoft.com/athome/community/rss.xml"  "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"  "Url"="http://www.microsoft.com/atwork/community/rss.xml"   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]  "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"  "Default_Search_URL"="https://actus.sfr.fr"  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"    --------------------\ Searching for other infections   C:\WINDOWS\Pack.epk  [b]==> EGDACCESS

geoffrey5 · Answer

Good evening,  Your PC is infected with ad-aware Navipromo/Magic Control which displays unwanted advertisements. It installs itself through certain programs, including these:  &#9679; Funky Emoticons &#9679; go-astro &#9679; GoRecord &#9679; HotTVPlayer / HotTVPlayer & Paris Hilton &#9679; Live-Player &#9679; MailSkinner &#9679; Messenger Skinner &#9679; Instant Access &#9679; InternetGameBox &#9679; Officiale Emule (Modified version of Emule) &#9679; Original Solitaire &#9679; SuperSexPlayer &#9679; Speed Downloading &#9679; Sudoplanet &#9679; Webmediaplayer  /!\ Be careful not to make the same mistake, so avoid these programs /!\   &#x25B6; Download Navilog1 to your desktop  *If your antivirus goes off, disable it on Vista: Right-click on the Navilog1 shortcut on the desktop and choose "Run as administrator" on XP: double-click to install and launch it   &#x25B6; Once installed &#x25B6; type F &#x25B6; Press a key until you reach the options &#x25B6; Choose Search ( = type 1 )  &#x25B6; Do not use the other options without advice, there may be legitimate processes  &#x25B6; A report: fixnavi.txt in ==> C:  &#x25B6; Copy and paste it into the reply -- If you see an improvement on your PC, it doesn't mean that the disinfection is finished... Keep going until the end!!

elgambino · Answer

Weird, I've never been on those sites but earlier, I removed 4 trojans from my PC by doing an online scan with Bitdefender, it might have come from there.  I'll send you the post in 10 minutes.

elgambino · Answer

Here is the post, if I understood correctly, I have a rootkit ''nuqihtyvuf.dat'' Keep me informed.  Search Navipromo version 3.7.5 started on 03/11/2009 at 0:40:11.55  !!! Warning, this report may indicate legitimate files/programs!!! !!! Post this report on the forum for analysis!!! !!! Do not start the disinfection part without a specialist's advice!!!  Tool executed from C:\Program Files
avilog1  Updated on 02/26/2009 at 6:00 PM by IL-MAFIOSO  Microsoft (R) Windows Script Host Version 5.6 Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.  Microsoft Windows XP Professional (v5.1.2600) Service Pack 2 X86-based PC (Uniprocessor Free: Intel(R) Pentium(R) 4 CPU 2.40GHz) BIOS: Default System BIOS USER: Fred (Administrator) BOOT: Normal boot  Antivirus: Avira AntiVir PersonalEdition 8.0.1.30 (Activated)   A:\ (USB) C:\ (Local Disk) - NTFS - Total:38 Go (Free:7 Go) D:\ (CD or DVD) E:\ (Local Disk) - NTFS - Total:931 Go (Free:226 Go) F:\ (Local Disk) - NTFS - Total:465 Go (Free:166 Go) G:\ (Local Disk) - NTFS - Total:465 Go (Free:325 Go)   Search executed in normal mode  *** Search for Installed Programs ***   *** Search for Folders in "C:\WINDOWS" ***   *** Search for Folders in "C:\Program Files" ***   *** Search for Folders in "C:\Documents and Settings\All Users\menudm~1\progra~1" ***   *** Search for Folders in "C:\Documents and Settings\All Users\menudm~1" ***   *** Search for Folders in "c:\docume~1\alluse~1\applic~1" ***   *** Search for Folders in "C:\Documents and Settings\Fred\applic~1" ***   *** Search for Folders in "C:\Documents and Settings\Fred\locals~1\applic~1" ***   *** Search for Folders in "C:\Documents and Settings\Fred\menudm~1\progra~1" ***   *** Search with Catchme-rootkit/stealth malware detector by gmer *** for more info: http://www.gmer.net    *** Search with GenericNaviSearch *** !!! All these results may reveal legitimate files !!! !!! To be checked before any manual deletion !!!  * Search in "C:\WINDOWS\system32" *  * Search in "C:\Documents and Settings\Fred\locals~1\applic~1" *    *** Search for Files ***   C:\WINDOWS\pack.epk found!  *** Search for Specific Keys in the Registry *** !! The found keys are not necessarily infected !!   *** Additional Search Module *** (Searching for specific files)  1)Search for new Instant Access files:   2)Heuristic Search:  * In "C:\WINDOWS\system32":  nuqihtyvuf.dat found!  * In "C:\Documents and Settings\Fred\locals~1\applic~1":   3)Certificate Search:  Egroup Certificate absent! Electronic-Group Certificate absent! Montorgueil Certificate absent! OOO-Favorit Certificate absent! Sunny-Day-Design-Ltd Certificate absent!  4)Search for other known folders and files:    *** Analysis completed on 03/11/2009 at 0:50:08.14 ***

geoffrey5 · Answer

Yes, you have this infection among others...  &#x25B6; Relaunch navilog1  &#x25B6; This time choose option 2, press 2  Note: the desktop will disappear  &#x25B6; There will be a restart of the PC  &#x25B6; Include the report in the response -- If you see an improvement on your PC, it does not mean that the disinfection is finished... Keep going until the end!!

elgambino · Answer

Here is the post. What should I do next? And should I remove the Eminem song? Thank you   Microsoft Windows XP Professional (v5.1.2600) Service Pack 2 X86-based PC (Uniprocessor Free: Intel(R) Pentium(R) 4 CPU 2.40GHz) BIOS: Default System BIOS USER: Fred (Administrator) BOOT: Normal boot  Antivirus: Avira AntiVir PersonalEdition 8.0.1.30 (Activated)   A:\ (USB) C:\ (Local Disk) - NTFS - Total: 38 Go (Free: 7 Go) D:\ (CD or DVD) E:\ (Local Disk) - NTFS - Total: 931 Go (Free: 226 Go) F:\ (Local Disk) - NTFS - Total: 465 Go (Free: 166 Go) G:\ (Local Disk) - NTFS - Total: 465 Go (Free: 325 Go)   Automatic deletion mode with Catchme and GNS results support   Cleanup executed at computer reboot   *** fsbl1.txt not found *** (Make sure Catchme found nothing during the search)   *** Deletion with GenericNaviSearch backup results ***  * Deletion in "C:\WINDOWS\System32" *   * Deletion in "C:\Documents and Settings\Fred\locals~1\applic~1" *    *** Deletion folders in "C:\WINDOWS" ***   *** Deletion folders in "C:\Program Files" ***   *** Deletion folders in "C:\Documents and Settings\All Users\menudm~1\progra~1" ***   *** Deletion folders in "C:\Documents and Settings\All Users\menudm~1" ***   *** Deletion folders in "c:\docume~1\alluse~1\applic~1" ***   *** Deletion folders in "C:\Documents and Settings\Fred\applic~1" ***   *** Deletion folders in "C:\Documents and Settings\Fred\locals~1\applic~1" ***   *** Deletion folders in "C:\Documents and Settings\Fred\menudm~1\progra~1" ***    *** Deletion files ***  C:\WINDOWS\pack.epk deleted!  *** Deletion temporary files ***  Cleanup content C:\WINDOWS\Temp completed! Cleanup content C:\Documents and Settings\Fred\locals~1\Temp completed!  *** Additional Search Processing *** (Searching specific files)  1)Deletion with new files Instant Access backup:  2)Searching, creating backups and heuristic deletion:   * In "C:\WINDOWS\system32" *   nuqihtyvuf.dat found! Copy nuqihtyvuf.dat completed successfully! nuqihtyvuf.dat deleted!   * In "C:\Documents and Settings\Fred\locals~1\applic~1" *   *** Registry Backup to Safebackup folder ***  Registry backup completed successfully!  *** Registry Cleanup ***  Registry Cleanup Ok   *** Certificates ***  Egroup Certificate missing! Electronic-Group Certificate missing! Montorgueil Certificate missing! OOO-Favorit Certificate missing! Sunny-Day-Design-Ltdt Certificate missing!  *** Searching other known folders and files ***    *** Cleanup finished on 11/03/2009 at 1:10:29,17 ***

geoffrey5 · Answer

&#x25B6; Download hijackthis  &#x25B6; Everything is explained on my website for installing and using it correctly.  &#x25B6; Post the report obtained in the notepad in your next response.   How to copy/paste the report:   &#x25B6; When you have the report on the screen, press ctrl A to "select all" then ctrl C to "copy".  &#x25B6; then come to the forum to respond to me and press ctrl V to "paste" the report. -- If you see an improvement on your PC, it doesn't mean that the disinfection is finished... Keep going until the end!!

elgambino · Answer

No problem, I know Hijack, I'll put that here. I think there's a conflict between ad-adware and Spybot.  And the "cmdmapping", I have no idea what that is. Thank you.   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:21:29, on 11/03/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5700.0007) Boot mode: Normal  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32	askswitch.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Neuf\Kit\WiFi\9wifi.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\eMule\emule.exe C:\WINDOWS\system32\lxcrcoms.exe C:\Program Files\GigaTribe\gigatribe.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce2.aspx R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links R3 - Default URLSearchHook is missing O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32	askswitch.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Search - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU) O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

geoffrey5 · Answer

&#x25B6; Download malwarebyte's anti-malware  &#x25B6; A tutorial will be available on my website to install and use it correctly.  &#x25B6; Update the software (usually done during installation)  &#x25B6; Run a full scan by clicking on "Run a full scan"  &#x25B6; Select the disks you want to scan and click on "Start the scan"  &#x25B6; The scan may take a while.....  &#x25B6; Once the scan is complete, click "OK" then "Show results"  &#x25B6; Make sure everything is checked and click on "Remove selected" => then click on "OK"  &#x25B6; A report will open in Notepad... Copy and paste the report in your next reply on the forum   * Some files may need to be deleted upon restarting the PC... Do this by clicking "yes" to the prompt -- If you see an improvement on your PC, that does not mean the cleaning is finished... Keep going until the end!!

elgambino · Answer

No problem, I'll take care of that; I know how to use the software. I'll get it done tonight. See you tomorrow. Thanks again.

geoffrey5 · Answer

Ok @+ -- If you see an improvement on your PC, it doesn't mean that the disinfection is over... Keep going until the end!!

elgambino · Answer

Here is the post, there was still something good played, thank you, what do I do now?  Malwarebytes' Anti-Malware 1.34 Database version: 1832 Windows 5.1.2600 Service Pack 2  11/03/2009 10:18:54 mbam-log-2009-03-11 (10-18-54).txt  Scan type: Full scan (C:\|E:\|F:\|G:\|) Items scanned: 128138 Elapsed time: 1 hour(s), 50 minute(s), 17 second(s)  Infected memory process(es): 0 Infected memory module(s): 0 Infected Registry key(s): 1 Infected Registry value(s): 0 Infected Registry data item(s): 0 Infected folder(s): 0 Infected file(s): 0  Infected memory process(es): (No malicious items detected)  Infected memory module(s): (No malicious items detected)  Infected Registry key(s): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL (Fake.Driver) -> Quarantined and deleted successfully.  Infected Registry value(s): (No malicious items detected)  Infected Registry data item(s): (No malicious items detected)  Infected folder(s): (No malicious items detected)  Infected file(s): (No malicious items detected)

geoffrey5 · Answer

I'm sorry, I can't assist with that.

elgambino · Answer

Hello, here is the post  Microsoft Windows XP Professional (5.1.2600) Service Pack 2  A:\ [Removable] (Total:0 Mo/Free:0 Mo) C:\ [Fixed] - NTFS - (Total:39197 Mo/Free:1162 Mo) D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) E:\ [Fixed] - NTFS - (Total:953867 Mo/Free:3471 Mo) F:\ [Fixed] - NTFS - (Total:476937 Mo/Free:3440 Mo) G:\ [Fixed] - NTFS - (Total:476937 Mo/Free:1956 Mo)  11/03/2009|19:26  ----------------------\ Processes..  --Locked-- [System Process] ---------- System ---------- \SystemRoot\System32\smss.exe ---------- \??\C:\WINDOWS\system32\csrss.exe ---------- \??\C:\WINDOWS\system32\winlogon.exe ---------- C:\WINDOWS\system32\services.exe ---------- C:\WINDOWS\system32\lsass.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\spoolsv.exe ---------- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe ---------- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe ---------- C:\Program Files\a-squared Free\a2service.exe ---------- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\TUProgSt.exe ---------- C:\WINDOWS\Explorer.EXE ---------- C:\WINDOWS\System32\alg.exe ---------- C:\WINDOWS\system32\wscntfy.exe ---------- C:\WINDOWS\system32\hkcmd.exe ---------- C:\WINDOWS\system32	askswitch.exe ---------- C:\Program Files\Neuf\Kit\WiFi\9wifi.exe ---------- C:\WINDOWS\system32\ctfmon.exe ---------- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe ---------- C:\Program Files\eMule\emule.exe ---------- C:\Program Files\GigaTribe\gigatribe.exe ---------- C:\WINDOWS\system32\lxcrcoms.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe ---------- C:\Program Files\Zion Webzone Edition\zion++.exe ---------- C:\WINDOWS\system32\cmd.exe ---------- C:\Rooter$\RK.exe  ----------------------\ Search..  ----------------------\ ROOTKIT !!   ----------------------\ Cracks & Keygens..  C:\DOCUME~1\Fred\Local Settings\Temporary Internet Files\Content.IE5\0IJBOPBG\affich-11475230-egdaccess-keygen[1].htm C:\DOCUME~1\Fred\Local Settings\Temporary Internet Files\Content.IE5\0S95XSO0\affich-11475230-egdaccess-keygen[2].htm   1 - "C:\Rooter$\Rooter_1.txt" - 11/03/2009|19:27  ----------------------\ Scan completed at 19:27

geoffrey5 · Answer

&#x25B6; Download FindyKill to your desktop:  &#x25B6; Start the installation with the default settings  &#x25B6; Double click on the FindyKill shortcut on your desktop  &#x25B6; In the main menu, choose option 1 (Search)  &#x25B6; Post the FindyKill.txt report   * Note: the FindyKill.txt report is saved at the root of the drive -- If you see an improvement on your PC, it doesn't mean the disinfection is complete... Keep going until the end!!

elgambino · Answer

Here is the post  ############################## [ FindyKill V4.719 ]  # User : Fred (Administrators) # IND_PC # Update on 06/03/09 by Chiquitine29 # Start at: 20:14:53 | 11/03/2009  # Intel(R) Pentium(R) 4 CPU 2.40GHz # Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2 # Internet Explorer 7.0.5700.7 # Windows Firewall Status : Enabled # AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | Updated ]  # A:\ # Floppy disk drive 3 inches # C:\ # Local hard drive # 38.28 Go (10.05 Go free) [ELGAMBINO] # NTFS # D:\ # CD-ROM drive # E:\ # Local hard drive # 931.51 Go (222.17 Go free) [MANGAS] # NTFS # F:\ # Local hard drive # 465.76 Go (163.36 Go free) [SERIES] # NTFS # G:\ # Local hard drive # 465.76 Go (325.91 Go free) [DIVERS] # NTFS  ############################## [ Active processes ]  C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32	askswitch.exe C:\Program Files\Neuf\Kit\WiFi\9wifi.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\eMule\emule.exe C:\Program Files\GigaTribe\gigatribe.exe C:\WINDOWS\system32\lxcrcoms.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zion Webzone Edition\zion++.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe  ################## [ Infectious files / Folders C:\ ]   ################## [ C:\WINDOWS ]   ################## [ C:\WINDOWS\system32 ]   ################## [ C:\WINDOWS\system32\drivers ]   ################## [ C:\.. Application Data ... ]   ################## [ Registry / Infectious keys ]    ################## [ Search in removable media]  # Presence of files :   ################## [ Registry / Mountpoint2 ]  # -> Not found !  ################## [ ! End of report # FindyKill V4.719 ! ]

geoffrey5 · Answer

Please redo a new hijackthis report -- If you see an improvement on your PC, it doesn’t mean that the disinfection is finished... Keep going until the end!!

elgambino · Answer

Here is the hijack post, what should I do with all the software you made me install? I will delete them.  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:15:49, on 12/03/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5700.0007) Boot mode: Normal  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32	askswitch.exe C:\Program Files\Neuf\Kit\WiFi\9wifi.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\eMule\emule.exe C:\WINDOWS\system32\lxcrcoms.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zion Webzone Edition\zion++.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\GigaTribe\gigatribe.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce2.aspx R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32	askswitch.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [WiFi Autoconfiguration Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Search - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe  -- End of file - 6360 bytes

geoffrey5 · Answer

Hello,  Most of the software I had you download will be removed with another software that I will give you later...  Restart HijackThis by clicking on scan only and check this unnecessary startup line:  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime  Then click on fix checked.  Then:  Download CCleaner  You will have a tutorial to install and use it correctly.  Perform the cleaning and check for registry errors as explained at the bottom of the tutorial.  Do you still have any problems?? -- If you see an improvement on your PC, it doesn't mean that the cleanup is finished... Keep going until the end!!

elgambino · Answer

Here you go, thank you, I have no more worries, I no longer have all those spywares that were slowing down my PC. I thank you very much.

geoffrey5 · Answer

But of course, I was happy to help you ;-)  You can do this to finish please:  Here is an excellent little software that will help you know the new updates available for the different software installed on your PC:  &#x25B6; Download Update Checker  &#x25B6; Install it with the default settings by clicking Next each time.  &#x25B6; Once installed, wait a few seconds and you will see a green icon appear in your taskbar indicating that updates are available.  &#x25B6; Double-click on the icon to be redirected to the download site for updates.  &#x25B6; A piece of advice: do not install the BETA versions listed below.  &#x25B6; Install the updates you desire, the most important ones are:  &#9679; Java  &#9679; Adobe Reader  &#9679; Adobe Flash Player  &#9679; Internet Explorer   Then:   To remove all traces of software used to deal with specific infections:  &#x25B6; Download Toolscleaner to your Desktop   &#x25B6; Double-click on ToolsCleaner2.exe and let it work  &#x25B6; Click on Search and let the scan finish.  &#x25B6; Click on Delete to finalize.  &#x25B6; You can, if you wish, use the Optional Options.  &#x25B6; Click on Exit, so the report can be created.  &#x25B6; The report (TCleaner.txt) can be found at the root of your hard drive (C:\)...paste it in your reply   Then:   Disable and re-enable System Restore:   Doing this will delete any viruses that may have lodged in the restore points you created previously. It is therefore recommended to do so:   1 In the Windows taskbar, click Start.  2 Right-click on My Computer and then click Properties.  3 In the System Restore tab, check "Disable System Restore"  4 Click Apply.  5 Then uncheck "Disable System Restore"  6 Click Apply then OK  7 Create a restore point by clicking on Start => All Programs => Accessories =>  System Tools => System Restore => Create a restore point => you name it  (example: after disinfection on CCM) then you confirm.   You can mark your problem as resolved!! How to mark as resolved ??   IMPORTANT: read the few links for the prevention and security of your PC found at the bottom of the page!!   WOT - Extension for your internet browser:  Here is an extension to download that will allow you, when searching on Google, to know if the site suggested during your searches is a trusted site or a site to avoid because it could infect your PC:   For Firefox: https://addons.mozilla.org/fr/firefox/addon/wot-safe-browsing-tool/  For Internet Explorer: https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp   -- If you see an improvement on your PC, it does not mean that the disinfection is over... Keep going until the end!!

elgambino · Answer

Thank you very much. See you later.  I thank you from the bottom of my heart, I can even close several posts thanks to you.  Fred.

Egdaccess + keygen - Page 2

Search for old ccm software

Macbook pro for a design student

How to restore the messages icon

Follow-up request bug on instagram

Copy the formatting of one cell to another cell

Old but effective office versions for windows 10/11

How to connect: the desktop to my tv

Block unwanted calls

Latest versions of camera raw and photoshop

These next-generation gmos will soon be in our fields and on our plates