MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: Virus please help
November 19, 2019, 08:51:16 PM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
November 19, 2019, 08:51:16 PM

Login with username, password and session length
 Featured Sites:
News
New  We now offer MyTechSupport.ca Merchandise! Every purchase goes towards maintaining our site.
Thank you for supporting MyTechSupport.ca!
  0 Members and 1 Guest are viewing this topic.
Pages: [1] 2  All Go Down Print
Author Topic: Virus please help  (Read 3286 times)
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« on: October 05, 2005, 10:17:55 PM »

PLEASE SUPPLY RELEVANT INFORMATION:
Operating System Version:
Problem Application Name & Version:
Problem Hardware Make & Model:
Error Messages:

Logfile of HijackThis v1.99.1
Scan saved at 6:11:07 PM, on 10/5/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\ISPCOMP\InstallService.exe
C:\WINDOWS\System32\kernels32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\Documents and Settings\James\Desktop\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://admin.isp.netscape.com/session/session_start.php?ConMethod=lan&ConType=1&radius_session_id=9731676L&screenname=snoogans2614&password=53755ace50564fafbcda84fdbfee57f6&OrigUrl=https://myaccount.isp.netscape.com/myaccount/FTLHomePageAction.do
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO:   - {094f87f6-521c-42af-b363-4cbd7632e70d} - C:\WINDOWS\System32\le.dll
O2 - BHO:   - {0cf604cc-20c4-434c-bdf2-9888647ba2e7} - C:\WINDOWS\System32\dfhzy.dll
O2 - BHO:   - {18cf5521-c519-4a66-9fd3-b97302807149} - C:\WINDOWS\System32\phxphpp.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Netscape Internet Service\Netscape Web Accelerator\pbhelper.dll
O2 - BHO:   - {4d48b744-42f0-4d0c-b4ab-c5fbf26e091f} - C:\WINDOWS\System32\phkf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO:   - {6339d8e9-0626-441d-946d-1fb8cf0ae81b} - C:\WINDOWS\System32\phxz.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO:   - {726ff674-18b7-4e8f-ad71-f15ed85032ea} - C:\WINDOWS\System32\p.dll
O2 - BHO:   - {8a39c17f-588a-42ea-904e-e808cd252fec} - C:\WINDOWS\System32\phxn.dll
O2 - BHO:   - {902771bf-e31f-47cc-a4d9-c1f9c108bfba} - C:\WINDOWS\System32\phj.dll
O2 - BHO:   - {b0aca4cc-eb39-4b35-9ad0-2c3f28e53590} - C:\WINDOWS\System32\jgmlnx.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO:   - {cb208398-e71c-4f47-b131-b8adf751093b} - C:\WINDOWS\System32\phxplx.dll
O2 - BHO:   - {cf99e0e5-d497-4718-b977-98565a7fbece} - C:\WINDOWS\System32\jgnzqj.dll
O2 - BHO:   - {dd1f6aa6-c57a-4b65-9f4d-90a36249b45e} - C:\WINDOWS\System32\zq.dll
O2 - BHO:   - {e41758f0-ffb9-4b4c-8ab1-502f9119972e} - C:\WINDOWS\System32\dfbdfl.dll
O2 - BHO:   - {fdcd3073-836a-4a9b-8b9e-8442e9e7b57e} - C:\WINDOWS\System32\lbj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Netscape] C:\Program Files\Common Files\ISPCOMP\InstallService.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSv

My computer keeps sending emails non stop by itself and symantec keeps scanning them and says it cannot send them this is happening non stop i have ran Ad Aware Spybot and Norton and nothing comes up please help
Logged

 
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #1 on: October 05, 2005, 11:14:21 PM »

Also my task manager has been disabled i think the virus has something to do with that also
Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #2 on: October 06, 2005, 12:36:08 AM »

Hi.
Download and run these in safe mode.

Please start by putting HJT in SAFE MODE.  During reboot, tap the F8 key. Select Safe Mode and then run "Hijack This"


How to setup Spybot Search & Destroy version 1.4

Download SpyBot
Save spybotsd14.exe into its own directory, NOT in a TEMPorary folder or on the Desktop.
I recommend c:/program files/spybot/
Doubleclick spybotsd13.exe. Make sure to direct the program to install in the c:/program files/spybot/ directory, NOT the default directory.
Open Spybot from Start | Programs | Spybot | Spybot S&D
Select <Search for Updates>. Let it install all updates. This is very important!
Select <Immunize>
Select <Check for Problems>
Check all entries that are in RED. Only RED, NOTHING ELSE. For your records, write/print out each item that you have fixed. Date it.
Select <Fix Selected Problems>
Close Spybot//
-------------------------------------------

Please download Ewido Security Suite and do a scan when you first go into Safe Mode

 Install Ewido Security Suite.
 When installing, under 'Additional Options' uncheck: "Install background guard" and  "Install scan via context menu"

To open the main screen double click the icon on the desktop.
 
 You will get a warning 'Database could not be found!'.(only if no updated have first been installed) Click OK.

 Update to the latest definition files.On the left of the main screen click Update.Then click on Start Update.Let it complete the updates.

Now Click on Scanner and Click on Complete System Scan and the scan will start.

During some scans  it may find cases of false positives so you will need to step through the process of cleaning files one-by-one.

If a file is detected you KNOW to be legitimate, select None as the action. Do NOT select 'Perform action on all infections'
 
If you are unsure of any entry found play safe and select None as the action.
Press the button marked Save Report

Save the report .txt file to your desktop or somewhere you can find it.Post it back with your next HJT log.
« Last Edit: October 06, 2005, 12:41:17 AM by Pancake » Logged

An Australian Member of

EDDY
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #3 on: October 06, 2005, 04:53:21 AM »

ewido security suite - Scan report
---------------------------------------------------------

 + Created on:         11:40:44 PM, 10/5/2005
 + Report-Checksum:      E6BBC8D0

 + Scan result:

   C:\!Submit\systr.dll -> Spyware.Globosearch : Cleaned with backup
   C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\QPOLE1SJ\ver1[1].exe -> Heuristic.Win32.HostFile : Cleaned with backup
   C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\QPOLE1SJ\ver1[2].exe -> Heuristic.Win32.HostFile : Cleaned with backup
   C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\QPOLE1SJ\ver1[3].exe -> Heuristic.Win32.HostFile : Cleaned with backup
   C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\QPOLE1SJ\ver1[4].exe -> Heuristic.Win32.HostFile : Cleaned with backup
   C:\WINDOWS\SYSTEM32\popup_bl.dll -> Spyware.Globos : Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 12:45:17 AM, on 10/6/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\ISPCOMP\InstallService.exe
C:\WINDOWS\System32\kernels32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\vxgame4.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\James\Desktop\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://admin.isp.netscape.com/session/session_start.php?ConMethod=lan&ConType=1&radius_session_id=9731676L&screenname=snoogans2614&password=53755ace50564fafbcda84fdbfee57f6&OrigUrl=https://myaccount.isp.netscape.com/myaccount/FTLHomePageAction.do
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO:   - {094f87f6-521c-42af-b363-4cbd7632e70d} - C:\WINDOWS\System32\le.dll
O2 - BHO:   - {0b2c9ee8-b77b-440f-84c7-809b1504460a} - C:\WINDOWS\System32\pj.dll
O2 - BHO:   - {0cf604cc-20c4-434c-bdf2-9888647ba2e7} - C:\WINDOWS\System32\dfhzy.dll
O2 - BHO:   - {1822b17f-b34e-4671-a834-f7f7546d49ee} - C:\WINDOWS\System32\phz.dll
O2 - BHO:   - {18cf5521-c519-4a66-9fd3-b97302807149} - C:\WINDOWS\System32\phxphpp.dll
O2 - BHO:   - {19d2c934-73dc-44af-b9b5-bc2a77ad04b7} - C:\WINDOWS\System32\ph.dll
O2 - BHO:   - {206258ae-4b5d-4b12-b857-ffb07f3a64a1} - C:\WINDOWS\System32\phyledx.dll
O2 - BHO:   - {26ed113b-4574-41d2-9fbb-0c79457dada4} - C:\WINDOWS\System32\h.dll
O2 - BHO:   - {2770c9f3-100e-442f-b9e6-8ae9e83c373a} - C:\WINDOWS\System32\phxp.dll
O2 - BHO:   - {3693c4bd-74a6-4db1-9c5a-03a583ffb6f4} - C:\WINDOWS\System32\phxp.dll
O2 - BHO:   - {3e530e0f-7303-41cb-9280-cc89521a80f4} - C:\WINDOWS\System32\bm.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Netscape Internet Service\Netscape Web Accelerator\pbhelper.dll
O2 - BHO:   - {45b3bcc1-869e-4a59-83c5-da5bbd7f9b2e} - C:\WINDOWS\System32\phxphltt.dll
O2 - BHO:   - {4b6c697d-e83b-4b14-9a98-c120ec0fceb8} - C:\WINDOWS\System32\phjzqxb.dll
O2 - BHO:   - {4d48b744-42f0-4d0c-b4ab-c5fbf26e091f} - C:\WINDOWS\System32\phkf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO:   - {595e0c38-558c-4ac9-8df5-03a25eddb556} - C:\WINDOWS\System32\h.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO:   - {60cf2df6-6158-4370-9c53-d979beaf2dde} - C:\WINDOWS\System32\phxphpm.dll
O2 - BHO:   - {6339d8e9-0626-441d-946d-1fb8cf0ae81b} - C:\WINDOWS\System32\phxz.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO:   - {726ff674-18b7-4e8f-ad71-f15ed85032ea} - C:\WINDOWS\System32\p.dll
O2 - BHO:   - {733f43b0-4e65-4af0-8ddb-68aa08aec556} - C:\WINDOWS\System32\jg.dll
O2 - BHO:   - {7adc804f-3779-4eae-85fc-6a11ed9a03eb} - C:\WINDOWS\System32\phhbmnol.dll
O2 - BHO:   - {7b4c63e1-2666-4fe8-9c63-50cb392deb4d} - C:\WINDOWS\System32\jgmhzr.dll
O2 - BHO:   - {8a39c17f-588a-42ea-904e-e808cd252fec} - C:\WINDOWS\System32\phxn.dll
O2 - BHO:   - {8d80a193-e5c9-41c5-939e-5323fbe4f8b7} - C:\WINDOWS\System32\jjw.dll
O2 - BHO:   - {902771bf-e31f-47cc-a4d9-c1f9c108bfba} - C:\WINDOWS\System32\phj.dll
O2 - BHO:   - {9239a519-e4ef-419b-a976-813464d0ba28} - C:\WINDOWS\System32\jgmjgvdx.dll
O2 - BHO:   - {93cd6553-a487-476c-9c51-c5057d57fa32} - C:\WINDOWS\System32\phxnv.dll
O2 - BHO:   - {96cdce45-3996-4874-b42a-23c85b90f033} - C:\WINDOWS\System32\j.dll
O2 - BHO:   - {ad743317-0e8b-413a-a200-c1798d975dae} - C:\WINDOWS\System32\phzzt.dll
O2 - BHO:   - {b0aca4cc-eb39-4b35-9ad0-2c3f28e53590} - C:\WINDOWS\System32\jgmlnx.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO:   - {cb208398-e71c-4f47-b131-b8adf751093b} - C:\WINDOWS\System32\phxplx.dll
O2 - BHO:   - {cf99e0e5-d497-4718-b977-98565a7fbece} - C:\WINDOWS\System32\jgnzqj.dll
O2 - BHO:   - {d2acb94f-8e06-46e5-a923-21271e10f32b} - C:\WINDOWS\System32\phzjy.dll
O2 - BHO:   - {d558122c-aa92-41e4-aced-6cc8db682dba} - C:\WINDOWS\System32\jgmjgjl.dll
O2 - BHO:   - {db3b2ede-b092-4401-ace4-836fd7ea82e8} - C:\WINDOWS\System32\h.dll
O2 - BHO:   - {dc702697-9b15-4cc9-9d6a-494bf1387f17} - C:\WINDOWS\System32\jgoxs.dll
O2 - BHO:   - {dd1f6aa6-c57a-4b65-9f4d-90a36249b45e} - C:\WINDOWS\System32\zq.dll
O2 - BHO:   - {e41758f0-ffb9-4b4c-8ab1-502f9119972e} - C:\WINDOWS\System32\dfbdfl.dll
O2 - BHO:   - {e65cff37-81ce-4727-81a0-21fbdee698b4} - C:\WINDOWS\System32\phi.dll
O2 - BHO:   - {e812eb64-937d-40b0-83b8-b7e670e219b2} - C:\WINDOWS\System32\dfwtylbh.dll
O2 - BHO:   - {ed64bf98-cd55-4b54-a633-b0acdea2aa25} - C:\WINDOWS\System32\jgm.dll
O2 - BHO:   - {fc7574b2-87ed-4cbf-a947-6089ee304ade} - C:\WINDOWS\System32\zn.dll
O2 - BHO:   - {fdcd3073-836a-4a9b-8b9e-8442e9e7b57e} - C:\WINDOWS\System32\lbj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Netscape] C:\Program Files\Common Files\ISPCOMP\InstallService.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

The emails are still being sent at a rapid rate sometimes 500 at a time synmantec still is scanning them and they wont stop popping up.What next??
Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #4 on: October 06, 2005, 05:12:32 AM »

Hi

Now for the big cleanup...just take your time...

It may help you if you print out or copy this page for easy reference.. Make sure to work through the fixes in the exact order its listed. Please Keep your browser and all open programs closed (except firewalls and antivirus) when you are carrying out the fixes





SHOW HIDDEN FILES AND FOLDERS.
To show hidden files instructions (WinXP)
Doubleclick My Computer | Tools | Folder Options | View tab
Select Show Hidden Files and Folders
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files (Recommended)
Select Apply to All Folders | Yes | Apply | OK
------------------------------------------------------------------

Files highlighted in BLACK  will need to be removed from your hard drive.

  -----------------------------------------------------------------------



Please start by putting your computer in SAFE MODE.  During reboot, tap the F8 key. Select Safe Mode and then run HJT.
--------------------------------------------------------------





Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click End Process for each one if they are still listed.

vxgame4.exe
vxgame6.exe
kernels32.exe

-----------------------------------------------------------------


Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO: - {094f87f6-521c-42af-b363-4cbd7632e70d} - C:\WINDOWS\System32\le.dll
O2 - BHO: - {0b2c9ee8-b77b-440f-84c7-809b1504460a} - C:\WINDOWS\System32\pj.dll
O2 - BHO: - {0cf604cc-20c4-434c-bdf2-9888647ba2e7} - C:\WINDOWS\System32\dfhzy.dll
O2 - BHO: - {1822b17f-b34e-4671-a834-f7f7546d49ee} - C:\WINDOWS\System32\phz.dll
O2 - BHO: - {18cf5521-c519-4a66-9fd3-b97302807149} - C:\WINDOWS\System32\phxphpp.dll
O2 - BHO: - {19d2c934-73dc-44af-b9b5-bc2a77ad04b7} - C:\WINDOWS\System32\ph.dll
O2 - BHO: - {206258ae-4b5d-4b12-b857-ffb07f3a64a1} - C:\WINDOWS\System32\phyledx.dll
O2 - BHO: - {26ed113b-4574-41d2-9fbb-0c79457dada4} - C:\WINDOWS\System32\h.dll
O2 - BHO: - {2770c9f3-100e-442f-b9e6-8ae9e83c373a} - C:\WINDOWS\System32\phxp.dll
O2 - BHO: - {3693c4bd-74a6-4db1-9c5a-03a583ffb6f4} - C:\WINDOWS\System32\phxp.dll
O2 - BHO: - {3e530e0f-7303-41cb-9280-cc89521a80f4} - C:\WINDOWS\System32\bm.dll
O2 - BHO: - {45b3bcc1-869e-4a59-83c5-da5bbd7f9b2e} - C:\WINDOWS\System32\phxphltt.dll
O2 - BHO: - {4b6c697d-e83b-4b14-9a98-c120ec0fceb8} - C:\WINDOWS\System32\phjzqxb.dll
O2 - BHO: - {4d48b744-42f0-4d0c-b4ab-c5fbf26e091f} - C:\WINDOWS\System32\phkf.dll
O2 - BHO: - {595e0c38-558c-4ac9-8df5-03a25eddb556} - C:\WINDOWS\System32\h.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: - {60cf2df6-6158-4370-9c53-d979beaf2dde} - C:\WINDOWS\System32\phxphpm.dll
O2 - BHO: - {6339d8e9-0626-441d-946d-1fb8cf0ae81b} - C:\WINDOWS\System32\phxz.dll
O2 - BHO: - {726ff674-18b7-4e8f-ad71-f15ed85032ea} - C:\WINDOWS\System32\p.dll
O2 - BHO: - {733f43b0-4e65-4af0-8ddb-68aa08aec556} - C:\WINDOWS\System32\jg.dll
O2 - BHO: - {7adc804f-3779-4eae-85fc-6a11ed9a03eb} - C:\WINDOWS\System32\phhbmnol.dll
O2 - BHO: - {7b4c63e1-2666-4fe8-9c63-50cb392deb4d} - C:\WINDOWS\System32\jgmhzr.dll
O2 - BHO: - {8a39c17f-588a-42ea-904e-e808cd252fec} - C:\WINDOWS\System32\phxn.dll
O2 - BHO: - {8d80a193-e5c9-41c5-939e-5323fbe4f8b7} - C:\WINDOWS\System32\jjw.dll
O2 - BHO: - {902771bf-e31f-47cc-a4d9-c1f9c108bfba} - C:\WINDOWS\System32\phj.dll
O2 - BHO: - {9239a519-e4ef-419b-a976-813464d0ba28} - C:\WINDOWS\System32\jgmjgvdx.dll
O2 - BHO: - {93cd6553-a487-476c-9c51-c5057d57fa32} - C:\WINDOWS\System32\phxnv.dll
O2 - BHO: - {96cdce45-3996-4874-b42a-23c85b90f033} - C:\WINDOWS\System32\j.dll
O2 - BHO: - {ad743317-0e8b-413a-a200-c1798d975dae} - C:\WINDOWS\System32\phzzt.dll
O2 - BHO: - {b0aca4cc-eb39-4b35-9ad0-2c3f28e53590} - C:\WINDOWS\System32\jgmlnx.dll
O2 - BHO: - {cb208398-e71c-4f47-b131-b8adf751093b} - C:\WINDOWS\System32\phxplx.dll
O2 - BHO: - {cf99e0e5-d497-4718-b977-98565a7fbece} - C:\WINDOWS\System32\jgnzqj.dll
O2 - BHO: - {d2acb94f-8e06-46e5-a923-21271e10f32b} - C:\WINDOWS\System32\phzjy.dll
O2 - BHO: - {d558122c-aa92-41e4-aced-6cc8db682dba} - C:\WINDOWS\System32\jgmjgjl.dll
O2 - BHO: - {db3b2ede-b092-4401-ace4-836fd7ea82e8} - C:\WINDOWS\System32\h.dll
O2 - BHO: - {dc702697-9b15-4cc9-9d6a-494bf1387f17} - C:\WINDOWS\System32\jgoxs.dll
O2 - BHO: - {dd1f6aa6-c57a-4b65-9f4d-90a36249b45e} - C:\WINDOWS\System32\zq.dll
O2 - BHO: - {e41758f0-ffb9-4b4c-8ab1-502f9119972e} - C:\WINDOWS\System32\dfbdfl.dll
O2 - BHO: - {e65cff37-81ce-4727-81a0-21fbdee698b4} - C:\WINDOWS\System32\phi.dll
O2 - BHO: - {e812eb64-937d-40b0-83b8-b7e670e219b2} - C:\WINDOWS\System32\dfwtylbh.dll
O2 - BHO: - {ed64bf98-cd55-4b54-a633-b0acdea2aa25} - C:\WINDOWS\System32\jgm.dll
O2 - BHO: - {fc7574b2-87ed-4cbf-a947-6089ee304ade} - C:\WINDOWS\System32\zn.dll
O2 - BHO: - {fdcd3073-836a-4a9b-8b9e-8442e9e7b57e} - C:\WINDOWS\System32\lbj.dll
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe



 ---------------------------------------------------------------------------
Open Windows Explorer and delete the following highlighted file/s (or delete the whole folder (Red) if no specific file is given)

C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame6.exe
C:\WINDOWS\System32\kernels32.exe



------------------------------------------------------------------------
Check that you have carried out all the above steps/fixes and then reboot into Normal Mode and download Cleanup This will  clean out your tempory files.

 
Restart your computer and post a new HijackThis log

« Last Edit: October 06, 2005, 05:14:03 AM by Pancake » Logged

An Australian Member of

EDDY
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #5 on: October 06, 2005, 04:15:34 PM »

Logfile of HijackThis v1.99.1
Scan saved at 12:13:09 PM, on 10/6/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\ISPCOMP\InstallService.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Documents and Settings\James\Desktop\hijack\HijackThis.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://admin.isp.netscape.com/session/session_start.php?ConMethod=lan&ConType=1&radius_session_id=9731676L&screenname=snoogans2614&password=53755ace50564fafbcda84fdbfee57f6&OrigUrl=https://myaccount.isp.netscape.com/myaccount/FTLHomePageAction.do
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Netscape] C:\Program Files\Common Files\ISPCOMP\InstallService.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Thanks man so far so good i couldnt imagine going anywhere else for help.
Logged

 
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #6 on: October 06, 2005, 04:39:03 PM »

Well it is not fixed it worked for 10 min and now its back its not moving has fast but it is still sending the emails. It looks like its sending junk mail to random email addresses from my computer.
Logged

 
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #7 on: October 06, 2005, 08:00:57 PM »

C:\DOCUME~1\James\LOCALS~1\Temp\vx2.game
C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\YVAP85OL\zgame3[1].exe
C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\YVAP85OL\zgame3[1].exe
C:\DOCUME~1\James\LOCALS~1\Temp\vx3.game
C:\DOCUME~1\James\LOCALS~1\Temp\vx3.game
C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\YVAP85OL\zgame2[1].exe
C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\YVAP85OL\zgame2[1].exe
C:\DOCUME~1\James\LOCALS~1\Temp\vx2.game
C:\DOCUME~1\James\LOCALS~1\Temp\vx2.game
C:\Documents and Settings\James\Local Settings\Temporary Internet Files\Content.IE5\YVAP85OL\gunit[1].exe

Ok i just ran Norton again and it finally came back with the Trojan Horse Virus which cannot be repaired or accessed in these locations. Maybe this will help
Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #8 on: October 06, 2005, 11:57:36 PM »

Did you run the Cleanup program ? you can clean manually...

Open up the Internet Explorer browser in the manner that you usually do.

You can double click on the Internet Explorer icon that Microsoft adds to your Desktop.

Then you click on the word Tools, which is contained in your top tool bar area.

This will pull down a menu for you to now click on Internet Options.

In the center of the screen, click on the button entitled Delete Files.

Windows will ask if you want Delete all files in the Temporary Internet Files folder.

You can place a check mark next to Delete all offline content to remove locally stored content.

When you are satisfied with your selection, click on the OK button to delete these Temp files.

This action will free up a decent amount of the Temporary Internet files on your system.

Now click on the newly added button entitled Delete Cookies.

Windows will ask if you want Delete all cookies in the Temporary Internet Files folder.

Click on the OK button to have Windows delete all of these Cookie files for you.

Now click on the Clear History button to clear out your recently visited page links.

When Windows asks if you want to Delete your history of visited Web sites, click on Yes.

Notice that there is an adjustment next to Days to keep pages in history:.

Adjust this setting to your personal preference. 5 - 7 days is usually sufficient for History links.

Then click on the Ok button to save your changes and exit the Internet Options Window.



Logged

An Australian Member of

EDDY
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #9 on: October 09, 2005, 01:04:39 AM »

I have done that twice and still doing the email thing
Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #10 on: October 09, 2005, 01:28:51 AM »

Download SILENT RUNNERS  to a new folder,... Unzip if Zipped, and run the Silent Runners.vbs file.
Open the "Startup Programs.txt" file it creates, and copy/paste the contents to this post, please.
The "Startup Programs.txt" file will be in the folder you ran the "Silent Runners.vbs" file from.
Logged

An Australian Member of

EDDY
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #11 on: October 09, 2005, 01:41:17 AM »

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation]
"ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation]
"ccRegVfy" = ""C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation]
"Netscape" = "C:\Program Files\Common Files\ISPCOMP\InstallService.exe" ["Netscape Communications Corporation]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation]
"SSC_UserPrompt" = "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" ["Symantec Corporation]
"WinPatrol" = ""C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"" ["BillP Studios]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc.]
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" = "WebCheck"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ws6010.dll" [null data]
Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #12 on: October 09, 2005, 02:16:55 AM »

Lets fix this one.

Turn off your System Restore

C:\WINDOWS\System32\ws6010.dll<--- delete this file

Reboot and run "Cleanup" again
Logged

An Australian Member of

EDDY
snoogans2614
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #13 on: October 09, 2005, 03:27:41 AM »

Say access was denied
Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #14 on: October 09, 2005, 03:43:48 AM »

Delete it in safe mode.
Logged

An Australian Member of

EDDY
Pages: [1] 2  All Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page August 09, 2017, 05:12:54 PM