View original (French)

Win32:Adware-gen [Adw] - Page 2

Solved/Closed
Previous
  • 1
  • 2
  1. nico
     
    Moreover, since the appearance of the virus, I have a blue screen as my background, and I wanted to put my old background back, and the name of the blue screen intrigued me... it is the same name as the first file found by Avast!: an image file named "phc3rnj0ecfn". I suppose that it's normal, but can I put my usual background back? Is it a harmless "residue"?
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Yes, it is harmless, cleaned.

      For antivirXP08, I just checked. It's an empty entry in add/remove programs.
      A software like TunesUp cleans up this kind of entry.
      0
  2. nico
     
    Ok, sorry for the response time but I had some issues with the forum page display. So yes, it does appear in the add/remove programs. I don't remember if I used it or not, I don't think so because it should have asked me to acquire a license, which I didn't do. But it's true that it installed itself and appeared suddenly a little after the infection was found...
    Anyway, what should I do? How should my PC react?
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Do you have ad pages like in message 35 (you know, the thing you had never seen).

      Can you post a Hijackthis report for me?

      Then, we'll see about the cleanup.
      0
      1. verni29 Posted messages 6805 Status Security Contributor 180 > verni29 Posted messages 6805 Status Security Contributor
         
        For your question about your wallpaper, it's the file we used with OTmoveIt:

        moveit report!
        File/Folder C:\WINDOWS\system32\Iphc3rnj0ecfn.exe not found.
        OTmoveIt 2 by Oldimer - version 1.0.4.3 log created on 07102008_181601
        0
      2. nico > verni29 Posted messages 6805 Status Security Contributor
         
        No, I don't have any more pesky ads; however, I no longer have the little "Avast!" icon in my taskbar near the clock, but it is still properly installed. Am I at risk? (Report in the next message.)
        0
      3. verni29 Posted messages 6805 Status Security Contributor 180 > nico
         
        For Avast, I believe the problem will be resolved.

        1) Your computer is not properly protected.
        Avast is not enough. The proof!!!
        However, I see that you have
        Spybot, keep it, it's very good.
        I would rather recommend Antivir:

        I'm attaching an article comparing Avast and Antivir
        http://forum.malekal.com/ftopic3528.php

        Antivir tutorial:
        https://www.malekal.com/avira-free-security-antivirus-gratuit/

        Uninstalling Avast:
        https://www.avast.com/fr-fr/uninstall-utility

        Second protection you must have: the firewall
        I will indicate two possible products (in French)

        Kerio Personal Firewall
        http://www.sunbelt-software.com/Kerio-Download.cfm
        Tutorial: https://www.malekal.com/tutorial-et-guide-counterspy/

        PC Tools Firewall Plus
        https://fr.norton.com/

        3) Java: go to this site
        https://www.java.com/fr/download/manual.jsp

        In the Windows section, click on check now.
        Another window will open. Follow the instructions.

        4) We will remove the software that has been used..
        Download ToolsCleaner to the desktop
        http://perso.orange.fr/AceRothstein/ToolsCleaner2.exe
        Double-click on ToolsCleaner2.exe --> Search --> Delete.
        It is possible that your desktop will disappear.

        If the screen does not reappear, press Ctrl + Alt + Delete. This will open the task manager.
        In the Processes tab, click on the File menu, then Run and type Explorer. Confirm.

        5) You will recreate a clean restore point.

        To recreate a restore point:
        Start --> Programs --> Accessories --> System Tools --> System Restore

        Choose "Create a restore point". Follow the prompts.

        After these various actions, send me a Hijackthis report and we'll take stock.
        0
  3. nico
     
    HijackThis report:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:20:19, on 12/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\PROGRA~1\Wanadoo\CnxMon.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
    O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
    O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O9 - Extra 'Tools' menuitem: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 6410 bytes
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Indeed, we keep running into each other.
      Check the security points on your PC.

      Give me your opinion.
      0
  4. nico
     
    I think you are more informed than I am on the issue of protection, so I will follow your "guidelines" and install what needs to be installed. I will then post another Hijackthis report. See you later!
    0
    1. nico
       
      Problem with the installation of antivirus... I downloaded the archive, extracted it into a folder, but the files present are neither executables nor setups. There are 2 files that I think could perform the installation: "install" which is only a type "file" 60kb and ".installrc", in "installrc file" which is 1kb. The licenses are in .DE, I cannot read them. However, there are other folders like "bin", "contrib", "gui", "script", or "vdf" for example. Should I search inside those to find an executable file?
      0
      1. verni29 Posted messages 6805 Status Security Contributor 180 > nico
         
        I check.
        0
  6. verni29 Posted messages 6805 Status Security Contributor 180
     
    Another link.

    https://www.clubic.com/telecharger-fiche10821-avira-antivir-personal-free-antivirus.html
    0
    1. nico
       
      Ok, download started, it's already much lighter.. I'll keep you posted, thanks, see you later.
      0
      1. nico > nico
         
        To uninstall Avast, since I no longer have the icon at the bottom, I can no longer access the dropdown menu by right-clicking to disable its self-defense module. What should I do?
        0
      2. verni29 Posted messages 6805 Status Security Contributor 180 > nico
         
        Open Avast and disable the module.
        I'm providing you with a tutorial:
        https://forums.cnetfrance.fr
        You need to disable all shields (web, P2P, ...)

        Avast is not installed on my machine (but on the virtual machine and I need to start it)

        If you can't do it, let me know.
        0
  7. verni29 Posted messages 6805 Status Security Contributor 180
     
    Nico,

    Here is the solution to disable the resident protection:

    start menu --> Programs --> Avast

    Open Avast (it should not be the skin but the normal interface)

    Settings --> Resident Protection

    set to disable

    A+
    0
  8. nico
     
    It's done, thank you. I've started the installation of Sunbelt Personal Firewall, everything went normally, but before the last window asking me to restart the PC to finish the installation, I got an error message "internal error...". I clicked on "OK" (no other choice), and now I can restart my PC. That said, would the installation still have been completed successfully?
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      You'll know if it's correctly installed after the restart.

      See you!
      0
  9. nico
     
    Sorry, once again I rushed too much... I can't restart the PC, here is what the last installation window displays: "The wizard was interrupted before Sunbelt (..) could be completely installed.
    Your system has not been modified. To complete installation at another time, please run setup again.
    Click finish to exit (...)."
    So I will click and restart the installation!
    0
    1. nico
       
      I restarted the installation, and this time everything went smoothly. The firewall icon is in my taskbar, and the program is running. See you later!
      0
  10. nico
     
    installation of java ok, it has of course allowed me to see the effectiveness of the firewall (impressive!). I have a small issue with the last link (the one from step 4), it is apparently incorrect (according to Orange). See you soon!
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Oops, that's absolutely true.
      But where was my head? :-)

      link for toolsCleaner:
      http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner
      0
      1. nico > verni29 Posted messages 6805 Status Security Contributor
         
        surely in one of your many infection resolutions ;)
        Just so you know, do I only need the executable or do I still need to install it?
        0
      2. verni29 Posted messages 6805 Status Security Contributor 180 > nico
         
        You execute it only.
        0
  11. nico
     
    Hijack report:

    Logfile of HijackThis v1.99.1
    Scan saved at 14:53:30, on 12/07/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\PROGRA~1\Wanadoo\CnxMon.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\DOCUME~1\Nicolas\LOCALS~1\Temp\Rar$EX00.750\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
    O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
    O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1215865838395&h=d25db4a49e84af280db9dd1465543dae/&filename=jinstall-6u7-windows-i586-jc.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

    For your information, I still have programs on the desktop (malwarebytes, sreng2) with the associated folders and files, as well as the infamous fix.reg. What should I do with all of this?
    And in my programs, the antivirus XP08 still appears, should I remove it via the control panel?
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      For the programs:
      - MalwareBytes: keep it, you found it useful to have this tool.
      - Sreng: delete
      - Hijackthis: you can remove it. It won't be very useful to you.
      - Fix.reg: unnecessary, delete

      For antivirusXP08, as I told you, download TunesUp.
      It's free to use for 30 days. After that, you will uninstall it.
      It's a very good tool to optimize your PC.

      One last thing. Before deleting Hijackthis ( via Add/Remove Programs ), you will remove the following lines ( these are processes that start up with Windows and are unnecessary. They take up RAM )

      close your browser.
      Launch Hijackthis and select "Do a system scan only."
      You select the following lines:


      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)


      You choose the "Fixchecked" option at the bottom of the page.

      That said, I believe we are at the end of the road.
      Glad to have been of service to you.

      Goodbye.

      Can you mark the topic as resolved, please?
      0
  12. nico
     
    Alert! After posting this message, I went online, and my antivirus alerted me that a virus was found:
    "A virus or unwanted program was found!
    C:\Documents and Settings\Temporary Internet files\Content.IE5\0L6YB5IN\prototype[1]"
    Below it is marked:
    "contains detection pattern of the Java script virus
    JS/Director.A (in the form of a link).
    What should I do? Put it in quarantine, delete it...?
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Go :
      Programs --> Accessories --> System Tools --> Disk Cleanup
      The temporary files option must be checked.

      It's Antivir that's reacting. Good sign, right?
      You can trust it if your antivirus detects an intrusion and blocks it.
      0
  13. nico
     
    Yes, I am glad that he is reacting, but the "deny access" box is checked by default... Should I leave it like this and click OK or change the option (delete, remove, quarantine, ignore)? Moreover, I clicked on the JS\director.A link and it is not recognized on the antivirus site. After that, I will clean up the system and mark the topic as resolved.
    I deeply thank you for the attention you have given to my problem and the time you have dedicated to it, hats off!
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Give yourself the choice to be able to delete.
      Unless you know the file that is displayed during alerts, I would advise you to never open that kind of thing.

      HELLO.
      0
  14. nico
     
    Ok, I think everything is good, thanks again, and if I ever have another problem of this kind I’ll know who to turn to! (even if I’d prefer not to have to resort to it ;))
    Kudos for the work done and good luck for the future vernie29!
    0
    1. verni29 Posted messages 6805 Status Security Contributor 180
       
      Don't forget to mark it as resolved.
      0
  15. nico
     
    I would love to, just to close the issue ;), but I can't change the status of the problem, maybe it's because I'm not a member?! In that case, I can try to report one of our latest posts to a mod, letting them know they can mark it as "resolved"?
    0
Previous
  • 1
  • 2