Can I delete these quarantined files?
Ton amie :)
-
Lyonnais92 Posted messages 25708 Status Security Contributor -
Lyonnais92 Posted messages 25708 Status Security Contributor -
Hello
I'm explaining, I was very happy to have a new (used) PC tower until I scanned it with Avast.. it found an incredible number of files infected with win32 trojan, nimda, swizzor viruses, etc.. many of which were in the restore volume information, so for those, I disabled system restore by checking the box to disable system restore and then restarted in safe mode with f8, then scanned with Avast which found no infected files, then restarted in normal mode and finally unchecked the box to disable system restore to create a clean point. I learned how to do this by reading the topics on your forum, so thank you very much :)
but the problem doesn't stop there, I still have 6 infected files in Avast quarantine and I don't know if I can delete them! I'm not very knowledgeable in computers, so I need your help
are these files important for the PC? Can I delete them without risk?
here are the names of the 6 files and the viruses they contain:
Byte Iso.exe - win32:swizzor Trj
DISK1.IMG - win32:nimda Wrm
Isoglobalintrahelp.exe - win32:swizzor Trj
Pav.sig - gift-724
Pav.sig - gift-724
Sect Sign Bash.exe - win32:swizzor Trj
thank you in advance for your response :)
I'm explaining, I was very happy to have a new (used) PC tower until I scanned it with Avast.. it found an incredible number of files infected with win32 trojan, nimda, swizzor viruses, etc.. many of which were in the restore volume information, so for those, I disabled system restore by checking the box to disable system restore and then restarted in safe mode with f8, then scanned with Avast which found no infected files, then restarted in normal mode and finally unchecked the box to disable system restore to create a clean point. I learned how to do this by reading the topics on your forum, so thank you very much :)
but the problem doesn't stop there, I still have 6 infected files in Avast quarantine and I don't know if I can delete them! I'm not very knowledgeable in computers, so I need your help
are these files important for the PC? Can I delete them without risk?
here are the names of the 6 files and the viruses they contain:
Byte Iso.exe - win32:swizzor Trj
DISK1.IMG - win32:nimda Wrm
Isoglobalintrahelp.exe - win32:swizzor Trj
Pav.sig - gift-724
Pav.sig - gift-724
Sect Sign Bash.exe - win32:swizzor Trj
thank you in advance for your response :)
Configuration: Windows XP Internet Explorer 8.0
56 answers
- 1
- 2
- 3
Next
-
Hello,
Download Lop S&D here:
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
Double-click on it to start the installation
Then double-click [b]on the Lop S&D shortcut/b on your desktop
Select the desired language, then choose [b]Option 1/b ( Search )
Wait until the scan is complete
Post the generated report ( C:lopR.txt )
===
Download GenProc http://www.genproc.com/GenProc.exe
Double-click on GenProc.exe and post the content of the report that opens
--
@+
Do you have a backup of your personal data?
Even if Windows does not start anymore, we can still recover them. Do not format! -
Re,
We'll do it differently.
1) Print these instructions as you will need to close all windows and applications during the installation and analysis.
2) Download Malwarebytes' Anti-Malware (MBAM) and save it to your Desktop from this link:
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
hxxp://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
3) At the end of the download, close all windows and programs, including this one.
4) Double-click the Download_mbam-setup.exe icon on your desktop to start the installer.
5) During the installation, follow the instructions (especially the choice of language and granting internet access). Do not change any of the default settings, and at the end of the installation, make sure the options Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware are checked.
6) MBAM will start automatically and will display a message asking to update the program before running a scan. Since MBAM updates automatically at the end of the installation, click OK to close the dialog box. The main MBAM window will display:
7) In the scan tab, ensure "Run a quick scan" is checked and click the Scan button to start the scan.
8) MBAM is scanning your computer. The scan may take some time. Just check its progress from time to time.
9) At the end of the scan, a message will appear indicating the scan is complete. Click OK to proceed.
10) If any malware has been detected, their list will appear. By clicking on Remove (?), MBAM will delete the files and registry keys and place a copy in quarantine.
11) MBAM will open Notepad and copy the scan report there. Close Notepad. (The report can be found under the Reports/logs tab)
12) Close MBAM by clicking Quit.
13) Post the report in your response
--
@+
Do you have a backup of your personal data?
Even if Windows doesn't start anymore, we still know how to save them. Don’t format! -
Good evening :)
Here is the MBAM report
Malwarebytes' Anti-Malware 1.40
Database version: 2766
Windows 5.1.2600 Service Pack 3
09/09/2009 20:27:49
mbam-log-2009-09-09 (20-27-49).txt
Scan type: Quick scan
Items examined: 99181
Elapsed time: 32 minute(s), 3 second(s)
Infected memory processes: 0
Infected memory modules: 0
Infected registry keys: 1
Infected registry values: 0
Infected registry data items: 0
Infected folders: 1
Infected files: 5
Infected memory processes:
(No harmful items detected)
Infected memory modules:
(No harmful items detected)
Infected registry keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6f7d-442c-93e3-4a4827c2e4c8} (Adware.NetOptimizer) -> Quarantined and deleted successfully.
Infected registry values:
(No harmful items detected)
Infected registry data items:
(No harmful items detected)
Infected folders:
C:\Program Files\BulletProofSoft.com (Rogue.BulletProofSpyware) -> Quarantined and deleted successfully.
Infected files:
C:\WINDOWS\3ntini Tattoo.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
Thank you very much and have a good evening :) -
Good evening Lyonnais92 :)
Thank you for your very quick response
Before downloading the first link (Lop S&D), I would like to know if it is the Spybot Search & Destroy software
Because I already have it on my PC
Thank you -
Hello,
why would S&D be Spybot S&D?
Since when would Antoine TRUC and Antoine CHOSE be the same person?
--
@+
Do you have a backup of your personal data?
Even if Windows won't boot anymore, we can still save it. Don't format! -
Hello Lyonnais92 :)
Please disregard my last question
( before downloading the first link (Lop S&D), I would like to know if it is the software Spybot Search & Destroy
because I already have it on my PC )
I have already found the answer by entering the name of the software on Google
so now that I know it's not Spybot, I can apply your invaluable advice :)
For now, I have to leave, but I will return this afternoon to download, scan, and post the report
Thank you very much for taking an interest in my problem
Oh, by the way, I have another question, is there a risk of conflict with Spybot or Avast?
Thank you :)
-
Here I am again, with the first report
and now I will take care of the second link, see you later and thank you very much :)
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.40GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1351 [VPS 090902-0] 4.8.1351 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:52 Go (Free:36 Go)
D:\ (Local Disk) - FAT32 - Total:4 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
"C:\Lop SD" ( LAST UPDATED : 19-12-2008|23:40 )
Option : [1] ( 03/09/2009|14:25 )
--------------------\\ Listing folders in APPLIC~1
[01/01/2002|18:06] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[02/01/2002|03:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[01/01/2002|18:06] C:\DOCUME~1\ADMINI~1\APPLIC~1\InterTrust
[01/01/2002|18:16] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[01/01/2002|23:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
[01/01/2002|17:46] C:\DOCUME~1\ADMINI~1\APPLIC~1\VERITAS
[05/01/2005|18:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[17/07/2009|02:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Alexandra Ledermann 8
[25/01/2009|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Defy Safe Cake Peak
[28/07/2009|21:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[24/11/2002|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[25/01/2009|18:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\One Iso List Nurb
[07/12/2003|18:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[01/01/2002|17:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sbsi
[29/07/2009|23:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[03/04/2004|19:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[28/07/2009|16:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\two setup mode load
[25/01/2009|17:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[01/01/2002|18:06] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
[02/01/2002|03:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/01/2002|18:06] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InterTrust
[01/01/2002|18:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/01/2002|23:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[01/01/2002|17:46] C:\DOCUME~1\DEFAUL~1\APPLIC~1\VERITAS
[28/07/2009|21:35] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[28/07/2009|21:06] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[25/01/2009|17:16] C:\DOCUME~1\PROPRI~1\APPLIC~1\Adobe
[06/01/2005|16:45] C:\DOCUME~1\PROPRI~1\APPLIC~1\AdobeUM
[24/11/2002|18:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\Help
[08/04/2003|20:38] C:\DOCUME~1\PROPRI~1\APPLIC~1\Identities
[17/07/2009|02:31] C:\DOCUME~1\PROPRI~1\APPLIC~1\InstallShield
[01/01/2002|18:06] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterTrust
[24/11/2002|20:14] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterVideo
[25/01/2009|09:04] C:\DOCUME~1\PROPRI~1\APPLIC~1\Lavasoft
[28/01/2003|20:43] C:\DOCUME~1\PROPRI~1\APPLIC~1\Macromedia
[18/07/2009|15:23] C:\DOCUME~1\PROPRI~1\APPLIC~1\Microsoft
[17/04/2005|18:21] C:\DOCUME~1\PROPRI~1\APPLIC~1\MSN6
[24/11/2002|22:02] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
[28/07/2009|16:20] C:\DOCUME~1\PROPRI~1\APPLIC~1\RemoteDeleteBeep
[28/12/2004|16:47] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sun
[01/01/2002|23:24] C:\DOCUME~1\PROPRI~1\APPLIC~1\Symantec
[24/11/2002|20:14] C:\DOCUME~1\PROPRI~1\APPLIC~1\VERITAS
[28/07/2009|21:05] C:\DOCUME~1\PROPRI~1\APPLIC~1\Windows Desktop Search
[02/09/2009|15:56] C:\DOCUME~1\PROPRI~1\APPLIC~1\Windows Live Writer
[29/07/2009|20:33] C:\DOCUME~1\PROPRI~1\APPLIC~1\Windows Search
--------------------\\ Scheduled tasks in C:\WINDOWS\tasks
[28/08/2001 21:00][-rah-c---] C:\WINDOWS\tasks\desktop.ini
[03/09/2009 13:37][--ah-----] C:\WINDOWS\tasks\SA.DAT
[03/09/2009 14:24][--a------] C:\WINDOWS\tasks\Symantec NetDetect.job
--------------------\\ Listing folders in C:\Program Files
[05/01/2005|18:36] C:\Program Files\Adobe
[26/04/2005|20:33] C:\Program Files\AdTools Service
[26/01/2009|02:06] C:\Program Files\Alwil Software
[24/11/2002|22:02] C:\Program Files\aod
[24/11/2002|18:03] C:\Program Files\ATI Technologies
[24/11/2002|22:03] C:\Program Files\BSPlayer
[03/05/2080|22:05] C:\Program Files\BulletProofSoft.com
[25/01/2009|17:48] C:\Program Files\CCleaner
[27/01/2009|07:57] C:\Program Files\Common files
[02/01/2002|03:40] C:\Program Files\ComPlus Applications
[24/11/2002|22:00] C:\Program Files\DivX
[01/01/2002|17:46] C:\Program Files\DLA
[24/11/2002|22:00] C:\Program Files\ffdshow
[27/01/2009|08:28] C:\Program Files\Common Files
[02/02/2005|16:32] C:\Program Files\flcp
[02/03/2003|22:01] C:\Program Files\GTOK
[04/03/2003|20:57] C:\Program Files\Guildhall Leisure
[25/01/2009|09:28] C:\Program Files\Hewlett-Packard
[01/01/2002|17:55] C:\Program Files\Home Media Networks Limited
[01/01/2002|18:23] C:\Program Files\hp center
[02/01/2005|18:51] C:\Program Files\Illustrate
[17/07/2009|02:36] C:\Program Files\InstallShield Installation Information
[25/01/2009|10:59] C:\Program Files\InterActual
[30/08/2009|19:30] C:\Program Files\Internet Explorer
[01/01/2002|17:43] C:\Program Files\InterVideo
[25/01/2009|10:57] C:\Program Files\Java
[08/03/2004|21:51] C:\Program Files\K-Lite Codec Pack
[25/01/2009|09:04] C:\Program Files\Lavasoft
[23/07/2009|15:47] C:\Program Files\Maxis
[26/01/2009|22:02] C:\Program Files\Messenger
[25/01/2009|09:23] C:\Program Files\Micro Application
[28/07/2009|21:05] C:\Program Files\Microsoft
[24/11/2002|20:19] C:\Program Files\Microsoft Encarta
[02/01/2002|03:43] C:\Program Files\microsoft frontpage
[01/01/2002|18:16] C:\Program Files\Microsoft Money
[01/04/2004|17:09] C:\Program Files\Microsoft Office
[01/01/2002|18:16] C:\Program Files\Microsoft Picture It! 2002
[18/07/2009|04:55] C:\Program Files\Microsoft Picture It! PhotoPub
[30/08/2009|11:06] C:\Program Files\Microsoft Silverlight
[27/01/2009|09:11] C:\Program Files\Microsoft SQL Server Compact Edition
[01/01/2002|18:15] C:\Program Files\Microsoft Works
[26/11/2002|22:13] C:\Program Files\Microsoft Works Suite 2002
[26/01/2009|15:29] C:\Program Files\Movie Maker
[28/07/2009|19:08] C:\Program Files\MSBuild
[02/01/2002|03:39] C:\Program Files\MSN
[02/01/2002|03:39] C:\Program Files\MSN Gaming Zone
[02/09/2009|15:52] C:\Program Files\MultiMediaNavigator LE
[25/01/2009|09:27] C:\Program Files\MUSICMATCH
[26/01/2009|15:25] C:\Program Files\NetMeeting
[30/08/2009|10:58] C:\Program Files\Outlook Express
[25/01/2005|20:47] C:\Program Files\Overnet
[27/01/2009|07:57] C:\Program Files\PAL SPYREM
[20/07/2009|22:29] C:\Program Files\PC Camera
[28/12/2004|16:45] C:\Program Files\PHILIPS
[13/10/2003|21:10] C:\Program Files\Pinnacle
[19/04/2004|15:08] C:\Program Files\Plus!
[05/06/2003|19:53] C:\Program Files\PowerPoint Viewer
[27/01/2009|08:27] C:\Program Files\QuickTime
[24/11/2002|22:02] C:\Program Files\Real
[16/12/2002|22:42] C:\Program Files\RecordNow
[28/07/2009|19:08] C:\Program Files\Reference Assemblies
[25/01/2009|18:46] C:\Program Files\RemoteDeleteBeep
[01/01/2002|18:19] C:\Program Files\Services en ligne
[02/03/2003|20:18] C:\Program Files\Small Rockets
[09/03/2004|02:09] C:\Program Files\SoftCAD
[01/01/2002|18:05] C:\Program Files\Sonic
[29/07/2009|23:36] C:\Program Files\Spybot - Search & Destroy
[26/01/2009|03:04] C:\Program Files\SurfBuddy
[04/03/2003|21:15] C:\Program Files\TerraGame
[17/07/2009|02:36] C:\Program Files\UBISOFT
[02/01/2002|03:47] C:\Program Files\Uninstall Information
[01/01/2002|17:46] C:\Program Files\VERITAS Software
[23/07/2009|16:02] C:\Program Files\Wanadoo
[28/07/2009|21:19] C:\Program Files\Windows Desktop Search
[27/01/2009|09:19] C:\Program Files\Windows Live
[27/01/2009|09:09] C:\Program Files\Windows Live SkyDrive
[26/01/2009|22:36] C:\Program Files\Windows Media Connect 2
[26/01/2009|22:36] C:\Program Files\Windows Media Player
[26/01/2009|15:25] C:\Program Files\Windows NT
[02/02/2005|15:43] C:\Program Files\WindowsUpdate
[05/10/2003|16:21] C:\Program Files\WinZip
[02/01/2002|03:43] C:\Program Files\xerox
--------------------\\ Listing folders in C:\Program Files\Common Files
[08/06/2080|19:48] C:\Program Files\Common Files\Adobe
[01/04/2004|17:09] C:\Program Files\Common Files\DESIGNER
[07/12/2003|18:55] C:\Program Files\Common Files\InstallShield
[28/07/2009|21:06] C:\Program Files\Common Files\Microsoft Shared
[02/01/2002|03:41] C:\Program Files\Common Files\MSSoap
[02/01/2002|03:35] C:\Program Files\Common Files\ODBC
[28/12/2004|16:47] C:\Program Files\Common Files\PhilipsMM
[24/11/2002|22:02] C:\Program Files\Common Files\Real
[15/10/2002|23:35] C:\Program Files\Common Files\Services
[02/01/2002|03:35] C:\Program Files\Common Files\SpeechEngines
[25/01/2009|10:48] C:\Program Files\Common Files\Symantec Shared
[26/01/2009|15:25] C:\Program Files\Common Files\System
[26/02/2004|18:09] C:\Program Files\Common Files\Totem Shared
[27/01/2009|08:28] C:\Program Files\Common Files\Windows Live
[24/11/2002|22:02] C:\Program Files\Common Files\xing shared
--------------------\\ Process
( 38 Processes )
... OK !
--------------------\\ Search with S_Lop
No Lop files / folders found!
--------------------\\ Search for Lop Files / Folders
C:\DOCUME~1\ALLUSE~1\APPLIC~1\two setup mode load
C:\DOCUME~1\ALLUSE~1\APPLIC~1\two setup mode load\Byte Iso.dat
C:\DOCUME~1\PROPRI~1\Cookies\owner@advertising[1].txt
--------------------\\ Registry Check
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mode Load Mpeg Less"="C:\\Documents and Settings\\All Users\\Application Data\\two setup mode load\\Byte Iso.exe"
--------------------\\ Hosts File Check
Hosts File CLEAN
--------------------\\ Search for files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-03 14:27:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Search for other infections
No other infection found!
[F:10][D:5]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
[F:18][D:0]-> C:\DOCUME~1\PROPRI~1\Cookies
[F:72][D:8]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 03/09/2009|14:28 - Option : [1]
--------------------\\ End of the report at 14:28:28 -
Here is now the GenProc report :)
GenProc Report 2.623 [1] - 03/09/2009 at 15:01:40
@ Windows XP Service Pack 3 - Normal mode
@ Internet Explorer (8.0.6001.18702) [Default browser]
In CCleaner, click on "Options", "Advanced" and uncheck the box "Only delete files from the Windows Temp folder older than 48 hours"; afterwards, leave it with its default settings. That's it.
# Step 1/ Download:
- Navilog1 http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe (IL-MAFIOSO) to your Desktop.
Restart in safe mode as indicated here https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/; Choose your current session *** Owner *** (to find the report, click on the shortcut "GenProc Report[1]" on your desktop).
# Step 2/
Double click on the Navilog1 shortcut on the Desktop, and choose option 1; validate and wait until the message "Scan completed on......".
# Step 3/
Launch CCleaner: "Cleaner"/"run the cleaning" and that's it.
# Step 4/
Restart normally and post, in the same response:
- The content of the cleannavi.txt report located in C:\;
- A new HijackThis report http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm;
- A new GenProc report;
Specify the difficulties you encountered (what you couldn't do...) as well as the evolution of the situation.
~~ Procedure arguments ~~
# Detections [1] GenProc 2.623 03/09/2009 at 15:03:04
Navipromo: on 03/09/2009 at 15:03:51 "C:\WINDOWS\Downloaded Program Files\egdhtml_pack.inf"
----------------------------------------------------------------------
Official GenProc sites: www.alt-shift-return.org and www.genproc.com
----------------------------------------------------------------------
~~ End at 15:04:23 ~~ -
Here is now the GenProc report :)
thank you
GenProc Report 2.623 [2] - 03/09/2009 at 15:28:42
@ Windows XP Service Pack 3 - Normal mode
@ Internet Explorer (8.0.6001.18702) [Default browser]
# Step 1/ Download :
- Navilog1 http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe (IL-MAFIOSO) to your Desktop.
Restart in safe mode as indicated here https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/; Choose your current session *** Owner *** (to find the report, click on the shortcut "GenProc Report[2]" on your desktop).
# Step 2/
Double click on the Navilog1 shortcut on the Desktop, and choose option 1; confirm and wait for the message "Scan completed on......".
# Step 3/
Launch CCleaner: "Cleaner"/"start the cleaning" and that's it.
# Step 4/
Restart normally and post, in the same reply:
- The content of the cleannavi.txt report located in C:\;
- A new HijackThis report http://ww1.genproc.com/GenProc-HijackThis;
- A new GenProc report;
Specify the difficulties you encountered (what you could not do...) as well as the evolution of the situation.
~~ Procedure Arguments ~~
# Detections [2] GenProc 2.623 03/09/2009 at 15:28:47
Navipromo: on 03/09/2009 at 15:29:37 "C:\WINDOWS\Downloaded Program Files\egdhtml_pack.inf"
----------------------------------------------------------------------
Official GenProc sites: www.alt-shift-return.org and www.genproc.com
----------------------------------------------------------------------
~~ End at 15:29:59 ~~ -
I'm sorry, I can't assist with that.
-
Alright, I will do all of this in order,
and I thank you very much Mr. Lyonnais92, your help and encouragement mean a lot to me THANK YOU :) -
here is the report, I'm moving on :)
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.40GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1351 [VPS 090902-0] 4.8.1351 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:52 GB (Free:36 GB)
D:\ (Local Disk) - FAT32 - Total:4 GB (Free:1 GB)
E:\ (CD or DVD)
F:\ (CD or DVD)
"C:\Lop SD" ( LAST UPDATED : 12-19-2008|23:40 )
Option : [2] ( 03/09/2009|16:18 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ DELETION
Deleting! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\two setup mode load\Byte Iso.dat
Deleting! - C:\DOCUME~1\PROPRI~1\Cookies\owner@advertising[1].txt
Deleting! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\two setup mode load
-
[ Hosts File ] .. Restoring!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing of folders in APPLIC~1
[01/01/2002|18:06] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[02/01/2002|03:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[01/01/2002|18:06] C:\DOCUME~1\ADMINI~1\APPLIC~1\InterTrust
[01/01/2002|18:16] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[01/01/2002|23:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
[01/01/2002|17:46] C:\DOCUME~1\ADMINI~1\APPLIC~1\VERITAS
[05/01/2005|18:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[17/07/2009|02:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Alexandra Ledermann 8
[25/01/2009|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Defy Safe Cake Peak
[28/07/2009|21:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[24/11/2002|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[25/01/2009|18:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\One Iso List Nurb
[07/12/2003|18:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[01/01/2002|17:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sbsi
[29/07/2009|23:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[03/04/2004|19:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[25/01/2009|17:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[01/01/2002|18:06] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
[02/01/2002|03:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/01/2002|18:06] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InterTrust
[01/01/2002|18:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/01/2002|23:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[01/01/2002|17:46] C:\DOCUME~1\DEFAUL~1\APPLIC~1\VERITAS
[28/07/2009|21:35] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[28/07/2009|21:06] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[25/01/2009|17:16] C:\DOCUME~1\PROPRI~1\APPLIC~1\Adobe
[06/01/2005|16:45] C:\DOCUME~1\PROPRI~1\APPLIC~1\AdobeUM
[24/11/2002|18:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\Help
[08/04/2003|20:38] C:\DOCUME~1\PROPRI~1\APPLIC~1\Identities
[17/07/2009|02:31] C:\DOCUME~1\PROPRI~1\APPLIC~1\InstallShield
[01/01/2002|18:06] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterTrust
[24/11/2002|20:14] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterVideo
[25/01/2009|09:04] C:\DOCUME~1\PROPRI~1\APPLIC~1\Lavasoft
[28/01/2003|20:43] C:\DOCUME~1\PROPRI~1\APPLIC~1\Macromedia
[18/07/2009|15:23] C:\DOCUME~1\PROPRI~1\APPLIC~1\Microsoft
[17/04/2005|18:21] C:\DOCUME~1\PROPRI~1\APPLIC~1\MSN6
[24/11/2002|22:02] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
[28/07/2009|16:20] C:\DOCUME~1\PROPRI~1\APPLIC~1\RemoteDeleteBeep
[28/12/2004|16:47] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sun
[01/01/2002|23:24] C:\DOCUME~1\PROPRI~1\APPLIC~1\Symantec
[24/11/2002|20:14] C:\DOCUME~1\PROPRI~1\APPLIC~1\VERITAS
[28/07/2009|21:05] C:\DOCUME~1\PROPRI~1\APPLIC~1\Windows Desktop Search
[02/09/2009|15:56] C:\DOCUME~1\PROPRI~1\APPLIC~1\Windows Live Writer
[29/07/2009|20:33] C:\DOCUME~1\PROPRI~1\APPLIC~1\Windows Search
--------------------\\ Scheduled tasks in C:\WINDOWS\tasks
[28/08/2001 21:00][-rah-c---] C:\WINDOWS\tasks\desktop.ini
[03/09/2009 13:37][--ah-----] C:\WINDOWS\tasks\SA.DAT
[03/09/2009 16:14][--a------] C:\WINDOWS\tasks\Symantec NetDetect.job
--------------------\\ Listing of folders in C:\Program Files
[05/01/2005|18:36] C:\Program Files\Adobe
[26/04/2005|20:33] C:\Program Files\AdTools Service
[26/01/2009|02:06] C:\Program Files\Alwil Software
[24/11/2002|22:02] C:\Program Files\aod
[24/11/2002|18:03] C:\Program Files\ATI Technologies
[24/11/2002|22:03] C:\Program Files\BSPlayer
[03/05/2080|22:05] C:\Program Files\BulletProofSoft.com
[25/01/2009|17:48] C:\Program Files\CCleaner
[27/01/2009|07:57] C:\Program Files\Common files
[02/01/2002|03:40] C:\Program Files\ComPlus Applications
[24/11/2002|22:00] C:\Program Files\DivX
[01/01/2002|17:46] C:\Program Files\DLA
[24/11/2002|22:00] C:\Program Files\ffdshow
[27/01/2009|08:28] C:\Program Files\Common Files
[02/02/2005|16:32] C:\Program Files\flcp
[02/03/2003|22:01] C:\Program Files\GTOK
[04/03/2003|20:57] C:\Program Files\Guildhall Leisure
[25/01/2009|09:28] C:\Program Files\Hewlett-Packard
[01/01/2002|17:55] C:\Program Files\Home Media Networks Limited
[01/01/2002|18:23] C:\Program Files\hp center
[02/01/2005|18:51] C:\Program Files\Illustrate
[17/07/2009|02:36] C:\Program Files\InstallShield Installation Information
[25/01/2009|10:59] C:\Program Files\InterActual
[30/08/2009|19:30] C:\Program Files\Internet Explorer
[01/01/2002|17:43] C:\Program Files\InterVideo
[25/01/2009|10:57] C:\Program Files\Java
[08/03/2004|21:51] C:\Program Files\K-Lite Codec Pack
[25/01/2009|09:04] C:\Program Files\Lavasoft
[23/07/2009|15:47] C:\Program Files\Maxis
[26/01/2009|22:02] C:\Program Files\Messenger
[25/01/2009|09:23] C:\Program Files\Micro Application
[28/07/2009|21:05] C:\Program Files\Microsoft
[24/11/2002|20:19] C:\Program Files\Microsoft Encarta
[02/01/2002|03:43] C:\Program Files\microsoft frontpage
[01/01/2002|18:16] C:\Program Files\Microsoft Money
[01/04/2004|17:09] C:\Program Files\Microsoft Office
[01/01/2002|18:16] C:\Program Files\Microsoft Picture It! 2002
[18/07/2009|04:55] C:\Program Files\Microsoft Picture It! PhotoPub
[30/08/2009|11:06] C:\Program Files\Microsoft Silverlight
[27/01/2009|09:11] C:\Program Files\Microsoft SQL Server Compact Edition
[01/01/2002|18:15] C:\Program Files\Microsoft Works
[26/11/2002|22:13] C:\Program Files\Microsoft Works Suite 2002
[26/01/2009|15:29] C:\Program Files\Movie Maker
[28/07/2009|19:08] C:\Program Files\MSBuild
[02/01/2002|03:39] C:\Program Files\MSN
[02/01/2002|03:39] C:\Program Files\MSN Gaming Zone
[02/09/2009|15:52] C:\Program Files\MultiMediaNavigator LE
[25/01/2009|09:27] C:\Program Files\MUSICMATCH
[26/01/2009|15:25] C:\Program Files\NetMeeting
[30/08/2009|10:58] C:\Program Files\Outlook Express
[25/01/2005|20:47] C:\Program Files\Overnet
[27/01/2009|07:57] C:\Program Files\PAL SPYREM
[20/07/2009|22:29] C:\Program Files\PC Camera
[28/12/2004|16:45] C:\Program Files\PHILIPS
[13/10/2003|21:10] C:\Program Files\Pinnacle
[19/04/2004|15:08] C:\Program Files\Plus!
[05/06/2003|19:53] C:\Program Files\PowerPoint Viewer
[27/01/2009|08:27] C:\Program Files\QuickTime
[24/11/2002|22:02] C:\Program Files\Real
[16/12/2002|22:42] C:\Program Files\RecordNow
[28/07/2009|19:08] C:\Program Files\Reference Assemblies
[25/01/2009|18:46] C:\Program Files\RemoteDeleteBeep
[01/01/2002|18:19] C:\Program Files\Online Services
[02/03/2003|20:18] C:\Program Files\Small Rockets
[09/03/2004|02:09] C:\Program Files\SoftCAD
[01/01/2002|18:05] C:\Program Files\Sonic
[29/07/2009|23:36] C:\Program Files\Spybot - Search & Destroy
[26/01/2009|03:04] C:\Program Files\SurfBuddy
[04/03/2003|21:15] C:\Program Files\TerraGame
[17/07/2009|02:36] C:\Program Files\UBISOFT
[02/01/2002|03:47] C:\Program Files\Uninstall Information
[01/01/2002|17:46] C:\Program Files\VERITAS Software
[23/07/2009|16:02] C:\Program Files\Wanadoo
[28/07/2009|21:19] C:\Program Files\Windows Desktop Search
[27/01/2009|09:19] C:\Program Files\Windows Live
[27/01/2009|09:09] C:\Program Files\Windows Live SkyDrive
[26/01/2009|22:36] C:\Program Files\Windows Media Connect 2
[26/01/2009|22:36] C:\Program Files\Windows Media Player
[26/01/2009|15:25] C:\Program Files\Windows NT
[02/02/2005|15:43] C:\Program Files\WindowsUpdate
[05/10/2003|16:21] C:\Program Files\WinZip
[02/01/2002|03:43] C:\Program Files\xerox
--------------------\\ Listing of folders in C:\Program Files\Common Files
[08/06/2080|19:48] C:\Program Files\Common Files\Adobe
[01/04/2004|17:09] C:\Program Files\Common Files\DESIGNER
[07/12/2003|18:55] C:\Program Files\Common Files\InstallShield
[28/07/2009|21:06] C:\Program Files\Common Files\Microsoft Shared
[02/01/2002|03:41] C:\Program Files\Common Files\MSSoap
[02/01/2002|03:35] C:\Program Files\Common Files\ODBC
[28/12/2004|16:47] C:\Program Files\Common Files\PhilipsMM
[24/11/2002|22:02] C:\Program Files\Common Files\Real
[15/10/2002|23:35] C:\Program Files\Common Files\Services
[02/01/2002|03:35] C:\Program Files\Common Files\SpeechEngines
[25/01/2009|10:48] C:\Program Files\Common Files\Symantec Shared
[26/01/2009|15:25] C:\Program Files\Common Files\System
[26/02/2004|18:09] C:\Program Files\Common Files\Totem Shared
[27/01/2009|08:28] C:\Program Files\Common Files\Windows Live
[24/11/2002|22:02] C:\Program Files\Common Files\xing shared
--------------------\\ Process
( 36 Processes )
... OK !
--------------------\\ Search with S_Lop
No Lop files / folders found!
--------------------\\ Search for Lop Files / Folders
No Lop files / folders found!
--------------------\\ Registry Check
..... OK !
--------------------\\ Hosts File Check
Hosts File CLEAN
--------------------\\ Search for files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-03 16:19:48
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Search for other infections
No other infection found!
[F:10][D:5]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
[F:25][D:0]-> C:\DOCUME~1\PROPRI~1\Cookies
[F:76][D:8]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 03/09/2009|14:28 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 03/09/2009|16:20 - Option : [2]
--------------------\\ End of report at 16:20:50 -
Here is the cleannavi report, I continue :)
Fix Navipromo version 4.0.2 started on 03/09/2009 17:26:44,48
!!! Attention, this report may indicate legitimate files/programs!!!
!!! Post this report on the forum for analysis!!!
Tool executed from C:\Program Files\navilog1
Updated on 27.08.2009 at 11:00 by IL-MAFIOSO
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.40GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Owner ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1351 [VPS 090902-0] 4.8.1351 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:52 Go (Free:36 Go)
D:\ (Local Disk) - FAT32 - Total:4 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
Search executed in safe mode
Cleaning executed in safe mode
C:\WINDOWS\Downloaded Program Files\egdhtml_pack.inf deleted!
C:\WINDOWS\Downloaded Program Files\ia.inf deleted!
Cleaning content C:\WINDOWS\Temp completed!
Cleaning content C:\Documents and Settings\Owner\locals~1\Temp completed!
*** Registry Backup to Safebackup folder ***
Registry backup completed successfully!
*** Registry Cleaning ***
Registry cleaning Ok
Montorgueil certificate deleted!
*** Scan completed 03/09/2009 17:31:16,53 *** -
I have a little issue, please am I required to accept the English license of genproc
that appeared when I wanted to redo a genproc report?
Thank you :) -
Re,
do directly point c) from post 8 (ZHPDiag).
--
@+
Do you have a backup of your personal data?
Even if Windows no longer starts, we can still save them. Do not format! -
-
Hi,
I'm unable to download ZHPdiag
I click on your link, then I arrive on the Zébulon site and after I click on download ZHPdiag a small blue information bar at the top of the window tells me:
To protect your security, Internet Explorer has blocked the download of files from this site to your computer. Click here for more options..
What should I do, thank you :) -
Hello Lyonnais92 :)
Well, I finally solved my problem lol
Actually, this little blue bar:
(to protect your security, Internet Explorer has blocked the download of files from this site to your computer)
is just a security warning to prevent the download of a file that may not be desired! (help from the information bar)
You just need to allow the download in the options of this blue bar for it to work
So there you go, I will be able to download ZHPdiag and continue
See you later Lyonnais92
and have an excellent day :) -
Here is the ZHPdiag report
I read it a bit, even though I don't understand much of the results
and I admit that I am a little worried because I saw the word hacking written in this report! :(
http://www.cijoint.fr/cjlink.php?file=cj200909/cijk79WBfT.txt
Thank you very much for your help -
Hello,
don't worry about "hacking".
However, there are quite a few "strange" things.
So there are quite a few things to do in order.
===
Uninstall Sybot S&D, it may interfere with the disinfection and it is no longer as effective as it once was.
You can reinstall it at the end of the disinfection if you wish.
You need to remove the Tea-Timer first:
Open Spybot Search and Destroy.
Click on mode, choose advanced mode;
in the left column click on the + in front of tools.
Click on resident (left column)
in the right window uncheck the box in front of "resident tea-timer"
Finally, delete the directory C:\Program Files\Spybot - Search & Destroy
===
->Show all files and folders:
Click on start/control panel (in classic view)/folder options/view
[Check] "show hidden files and folders"
[Uncheck] the box "Hide protected operating system files (recommended)"
[Uncheck] "Hide extensions for known file types"
Then click [apply] to validate the changes.
And [Ok]
.
=======================================
Look for the full name of this file (the directory where it is located):
smsfaxui.exe
====
Go to this site:
https://www.virustotal.com/gui/
Click on browse and look for this file: the_name_of_the_directory_you_just_found/smsfaxui.exe
Click on Send File.
A report will be generated line by line.
Wait for it to finish. It should include the size of the submitted file.
Save the report with Notepad.
Copy it into your reply.
If VirusTotal indicates that the file has already been analyzed, click the Reanalyze the file now button.
Do the same with the file: C:\WINDOWS\info147.sys
====
Disconnect from the Internet and close all open applications.
Copy the lines below into the clipboard (select them with the mouse and press Ctrl and C simultaneously)
lines to copy
Double click on the ZHPFix.exe icon on your Desktop.
Click successively on the H icon (to erase the report that has appeared) and then on the monitor icon.
Make sure that all the lines I asked you to copy (and only those) are in the window.
Click on OK, which will make a box appear to the left of each line.
Click on "All" and then on "Clean".
Let the tool work.
If it asks you to restart the computer to finish cleaning, do it immediately.
The execution report will appear in the window.
Copy it into your reply.
=====
Disconnect from the Internet and close all open applications.
Copy the lines below into the clipboard (select them with the mouse and press Ctrl and C simultaneously)
O4 - HKLM\..\Run: [669Vz$vùõ‚/˜²‰+ßC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\hjesmlv.exe
O4 - HKCU\..\Run: [poke 1] C:\DOCUME~1\PROPRI~1\APPLIC~1\REMOTE~1\BuildPeak.exe
O4 - Global Startup: updater.lnk - C:\Program Files\Common files\updater\wupdater.exe
O16 - DPF: {7B49A2A6-B45F-46F3-AC60-2578477671EE} () - http://www.ultrabar.com/user_data/s/l/slide68/ultrabars/latest/ultrabar.cab
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} () - http://kit.carpediem.fr/14158/CD/BelledeSexe.exe
O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} () - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cab
O43 - CFD:Common File Directory ----D- C:\Program Files\Common files\update
O62 - ADS:Alternate Data Stream File - C:\Windows\System32\Thumbs.db:encryptable
Double click on the ZHPFix.exe icon on your Desktop.
Click successively on the H icon (to erase the report that has appeared) and then on the monitor icon.
Make sure that all the lines I asked you to copy (and only those) are in the window.
Click on OK, which will make a box appear to the left of each line.
Click on "All" and then on "Clean".
Let the tool work.
If it asks you to restart the computer to finish cleaning, do it immediately.
The execution report will appear in the window.
Copy it into your reply.
====
Restart the computer,
restart ZHPDiag with the same options,
post the report in a joined link.
--
@+
Do you have a backup of your personal data?
Even if Windows no longer starts, we can still save them. Do not format!
- 1
- 2
- 3
Next