Author Topic: HELP!  (Read 33853 times)

0 Members and 1 Guest are viewing this topic.

andy214ever

  • Guest
HELP!
« on: May 30, 2007, 03:08:41 PM »
hi..

how to run boot time scan manualy?
and i got a friend he...do not use any antivirus at all, for about 1 years ....and now his pc is terribly slow  :-\and cannot log on....then i help him log on with safe mode and install the avast on his pc ....and scan his pc...i m shocked....why?because there about 50-60 virus found include adware,and trojan i follow the avast advice to move to chest....and the avast advice me to run boot times scan because there is a dangerous virus in memory, but when i click yes to start boot times scan ...it cant run....anybody help?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89326
  • No support PMs thanks
Re: HELP!
« Reply #1 on: May 30, 2007, 03:21:59 PM »
Personally I not in the least surprised at the number of viruses, adware, etc. that is on their system, my only surprise is that there aren't more.

If you have enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, Menu, 'Schedule boot-time scan...' as you have done, I have no idea why it isn't running.

Or use a command line, Windows, Start, Run and type, C:\Program Files\ALWIL Software\Avast4\sched.exe /A:*

If as you say they can't boot normally, that may be the problem although avast does its scan outside of windows the normal windows boot starts (you see the windows logo) and is then interrupted to start the avast boot-time scan. So the total lack of a normal windows boot may be the cause of this failure.

After so long their system is likely to be completely compromised with password stealers, backdoors, possibly rootkits hiding much more, etc. (you really have a task in front of you) that realistically they should be considering a format and start from scratch.

If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode.
1. AVG anti-spyware (formerly Ewido) If using winXP. or a-Squared free if using win98/ME. Or SUPERantispyware Or Spyware Terminator
2. Ad-Aware SE Personal Edition
3. Spybot Search and Destroy

Also see, anti-rootkit, detection, removal & protection http://www.antirootkit.com/software/index.htm.
- BlackLight - It can detect rootkits like Rootkit Revealer but can also remove them. http://www.f-secure.com/blacklight/
- Panda Rootkit Cleaner - http://research.pandasoftware.com/blogs/images/AntiRootkit.zip also see http://research.pandasoftware.com/blogs/research/archive/2007/04/02/Panda-AntiRootkit-Released.aspx or http://www.pandasoftware.com/.
 - AVG Anti-Rootkit http://free.grisoft.com/doc/avg-anti-rootkit-free/lng/us/tpl/v5.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

andy214ever

  • Guest
Re: HELP!
« Reply #2 on: May 31, 2007, 10:36:19 AM »
thank...i still cant help my friend run boot time scan....it just restart without running boot time scan even i already follow yr advice...and i scan with AVG anti spy and also blacklight found nothing...i run the avast scan in safe mode found some trojan....and i cant move to chest so i just delete it....when i log in pc with normal mode....the avast start warn me that a trojan found.....they keep coming non stop.....and sometimes avast have block somethings from downloading ad- ware  to my friend pc......how can i find that things that download ad- ware to my pc?now his pc is faster a bit than before....but still very slow.... :-\

andy214ever

  • Guest
Re: HELP!
« Reply #3 on: May 31, 2007, 10:39:19 AM »
oops!! sorry i know why i cant run oot times scan now........i just enables it but still dint run it....sorry...i m just a beginner ......

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: HELP!
« Reply #4 on: May 31, 2007, 02:43:39 PM »
they keep coming non stop
If a virus is replicant (coming and coming again), you should:

1) Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k. After boot you can enable System Restore again.

2) Clean your temporary files. You can use [ur=http://www.stevengould.org/downloads/cleanup/]CleanUp[/url] or the Windows Advanced Care features for that.

3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

4) It will be good if you download, install, update and run other trojan remover tools: a-squared and/or Free AVG Antispyware (trojan removers). Some users recommend SUPERantispyware or Spyware Terminator.

5) Use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89326
  • No support PMs thanks
Re: HELP!
« Reply #5 on: May 31, 2007, 02:57:31 PM »
<snip>
i run the avast scan in safe mode found some trojan....and i cant move to chest so i just delete it

What is the malware/trogan name, infected file name, where was it found e.g. (malware name, C:\windows\system32\infected-file-name.xxx) ? 
Check the avast! Log Viewer (right click the avast icon), Warning section, this contains information on all avast detections. This may help us with what the trojan does and possibly how to combat it or if other elements are at work.

....when i log in pc with normal mode....the avast start warn me that a trojan found.....they keep coming non stop.....and sometimes avast have block somethings from downloading ad- ware  to my friend pc......how can i find that things that download ad- ware to my pc?
1. So you are now able to log on normally ?
2. This would tend to indicate that there are still undetected trojan downloaders on his system, the other two anti-spyware links I gave should also be tried, SuperAntiSpwware and SpywareTerminator.
3. An effective firewall should be capable of blocking unauthorised outbound Internet Connections. Does he have a firewall and if so what (XP's firewall doesn't provide outbound protection) ?
4. For adware I would suggest the AdAware and Spybot Search & Destroy links I gave.

now his pc is faster a bit than before....but still very slow.... :-\

So you/he might be a little further from the ultimate nuclear option. But, I fear if the other software and anti-rootkits mentioned don't resolve it you are rapidly approaching the previously mentioned option.
Quote from: DavidR
After so long their system is likely to be completely compromised with password stealers, backdoors, possibly rootkits hiding much more, etc. (you really have a task in front of you) that realistically they should be considering a format and start from scratch.

oops!! sorry i know why i cant run oot times scan now........i just enables it but still dint run it....sorry...i m just a beginner ......


And this is I believe the reason as previously mentioned (however, you have since mentioned being able to boot normally (?), so perhaps not):
Quote from: DavidR
If as you say they can't boot normally, that may be the problem although avast does its scan outside of windows the normal windows boot starts (you see the windows logo) and is then interrupted to start the avast boot-time scan. So the total lack of a normal windows boot may be the cause of this failure.

There are other anti-rootkits, you have only tried one of them, there are two others I gave links for and there is also the anti-rootkit, detection, removal & protection link I gave with even more. I only listed the ones which have been commonly recommended on these forums and by members with reasonable success.

I would believe that not only did your friend not have an AV, they probably didn't have a firewall (?) and if so that is probably long ago bypassed.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89326
  • No support PMs thanks
Re: HELP!
« Reply #6 on: May 31, 2007, 03:03:40 PM »
they keep coming non stop
If a virus is replicant (coming and coming again), you should:

<snip>
3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
<snip>
5) Use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

Tech, Did you read that Andy can't do a boot time scan, it fails.

I have suggested and given links to the majority of the software , with exception to SpywareBlaster, which shouldn't be installed until the system is clean and it is a long way from there yet. I would assume the same for Windows Advanced Care dont apply immunization until you have a clean system.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: HELP!
« Reply #7 on: May 31, 2007, 08:19:31 PM »
i just enables it but still dint run it
Is there any error message? Or it just don't run?
Which is the operational system of that machine?
The best things in life are free.

andy214ever

  • Guest
Re: HELP!
« Reply #8 on: June 01, 2007, 07:17:02 AM »
how to Disable System Restore on  Windows XP???

could yougive me the links of some free fire wall???

thank.....i will follow yr advice..........


Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89326
  • No support PMs thanks
Re: HELP!
« Reply #10 on: June 01, 2007, 02:45:45 PM »
- Zone Alarm free http://www.zonelabs.com works fine with avast and has a reasonably friendly user interface, however, the free version is becoming bloated (large download size) with trial ware. There are others, the first two used by many forum members, Comodo, PCTools Firewall Plus, Sunbelt Kerio, Jetico, etc.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

andy214ever

  • Guest
Re: HELP!
« Reply #11 on: June 02, 2007, 06:39:56 AM »
2/15/2005 8:44:55 PM   Personal   5692   Sign of "Win32:VB-DXJ [Trj]" has been found in "C:\WINDOWS\Temp\6.tmp\[FSG]" file. 
2/15/2005 8:27:31 PM   Personal   5692   Sign of "Win32:VB-DXJ [Trj]" has been found in "C:\Documents and Settings\Personal\Local Settings\Temp\F.tmp\[FSG]" file. 
2/15/2005 8:27:24 PM   Personal   5692   Sign of "Win32:VB-DXJ [Trj]" has been found in "C:\Documents and Settings\Personal\Local Settings\Temp\9.tmp\[FSG]" file. 
2/15/2005 8:27:22 PM   Personal   5692   Sign of "Win32:VB-DXJ [Trj]" has been found in "C:\Documents and Settings\Personal\Local Settings\Temp\17.tmp\[FSG]" file. 
2/15/2005 8:27:12 PM   Personal   5692   Sign of "Win32:VB-DXJ [Trj]" has been found in "C:\Documents and Settings\Personal\Local Settings\Temp\16.tmp\[FSG]" file. 
2/15/2005 8:44:15 PM   Personal   5692   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\sd012.exe" file. 
2/15/2005 8:40:42 PM   Personal   5692   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\7.exe" file. 
2/15/2005 8:37:53 PM   Personal   5692   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0114704.dll" file. 
2/15/2005 8:37:53 PM   Personal   5692   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0114700.dll" file. 
2/15/2005 7:42:18 PM   Personal   1164   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Program Files\CNNIC\Cdn\Update\wmhlpr.dll" file. 
2/15/2005 7:42:18 PM   Personal   1164   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Program Files\CNNIC\Cdn\Update\imaoe.dll" file. 
2/15/2005 7:42:18 PM   Personal   1164   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Program Files\CNNIC\Cdn\Update\iesrch.dll" file. 
2/15/2005 7:42:16 PM   Personal   1164   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Program Files\CNNIC\Cdn\Update\cdncol.dll" file. 
2/16/2005 4:01:16 PM   SYSTEM   1660   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4DA30LU7\7[1].exe" file. 
2/16/2005 4:06:08 PM   Personal   1072   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4DA30LU7\7[1].exe" file. 
2/15/2005 8:17:16 PM   SYSTEM   1612   Sign of "Win32:Small-TD [Trj]" has been found in "C:\WINDOWS\downlo~1\CnsHook.dll" file. 
2/15/2005 8:01:07 PM   SYSTEM   1612   Sign of "Win32:Small-TD [Trj]" has been found in "C:\WINDOWS\downlo~1\CnsHook.dll" file. 
2/15/2005 8:16:28 PM   SYSTEM   1612   Sign of "Win32:Small-TD [Trj]" has been found in "C:\WINDOWS\downlo~1\CnsHook.dll" file. 
2/15/2005 8:38:28 PM   Personal   5692   Sign of "Win32:Small-TD [Trj]" has been found in "C:\WINDOWS\Downloaded Program Files\trz2E.tmp" file. 
2/15/2005 8:18:54 PM   Personal   2216   Sign of "Win32:Small-TD [Trj]" has been found in "c:\windows\downloaded program files\cnshook.dll" file. 
2/15/2005 8:44:06 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\qiscbk.dll" file. 
2/15/2005 8:44:05 P

andy214ever

  • Guest
Re: HELP!
« Reply #12 on: June 02, 2007, 06:40:54 AM »
2/15/2005 8:44:05 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\praian.dll\[Petite]" file. 
2/16/2005 5:21:11 PM   SYSTEM   1828   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/15/2005 8:19:28 PM   Personal   2216   Sign of "Win32:Small-FCC [Trj]" has been found in "c:\windows\system32\msccrt.dll\[Petite]" file. 
2/16/2005 9:03:29 PM   SYSTEM   1632   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 9:03:30 PM   SYSTEM   1632   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/15/2005 8:59:11 PM   SYSTEM   1664   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/17/2005 9:36:21 PM   SYSTEM   1576   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/17/2005 9:36:21 PM   SYSTEM   1576   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/17/2005 9:49:11 PM   SYSTEM   1624   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/17/2005 9:49:12 PM   SYSTEM   1624   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/18/2005 12:09:58 PM   SYSTEM   1572   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/18/2005 12:09:58 PM   SYSTEM   1572   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 2:46:53 PM   SYSTEM   1668   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/15/2005 8:59:11 PM   SYSTEM   1664   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 10:40:42 AM   SYSTEM   1648   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 10:40:42 AM   SYSTEM   1648   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 2:46:53 PM   SYSTEM   1668   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 3:43:27 PM   SYSTEM   1624   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/15/2005 8:16:41 PM   SYSTEM   1612   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 3:43:28 PM   SYSTEM   1624   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 3:56:39 PM   SYSTEM   1660   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 5:19:47 PM   SYSTEM   1828   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/16/2005 3:56:40 PM   SYSTEM   1660   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\msccrt.dll\[Petite]" file. 
2/15/2005 8:43:28 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\ltgdfk.dll" file. 
2/15/2005 8:43:26 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\kmnmha.dll" file. 
2/15/2005 8:43:26 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\klqceq.dll" file. 
2/15/2005 8:42:54 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\jyhzwh.dll\[Petite]" file. 
2/15/2005 8:42:54 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\jkwlbt.dll" file. 
2/15/2005 8:42:47 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\gbkkrd.dll" file. 
2/15/2005 8:42:33 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\dnedaq.dll" file. 
2/15/2005 8:40:56 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\cwykgz.dll\[Petite]" file. 
2/15/2005 8:40:52 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\WINDOWS\system32\chqnbz.dll" file. 
2/15/2005 8:37:48 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0111677.dll\[Petite]" file. 
2/15/2005 8:37:47 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0110674.dll\[Petite]" file. 
2/15/2005 8:37:46 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0109675.dll\[Petite]" file. 
2/15/2005 8:37:45 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108677.dll\[Petite]" file. 
2/15/2005 8:37:30 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108619.dll\[Petite]" file. 
2/15/2005 8:37:29 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108591.dll\[Petite]" file. 
2/15/2005 8:37:27 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108564.dll\[Petite]" file. 
2/15/2005 8:37:25 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0107565.dll\[Petite]" file. 
2/15/2005 8:37:24 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106565.dll\[Petite]" file. 
2/15/2005 8:37:23 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106537.dll" file. 
2/15/2005 8:37:22 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106514.dll" file. 
2/15/2005 8:37:20 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105510.dll" file. 
2/15/2005 8:37:19 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105479.dll" file. 
2/15/2005 8:37:19 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105458.dll" file. 
2/15/2005 8:37:18 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105437.dll" file. 
2/15/2005 8:37:17 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0104431.dll" file. 
2/15/2005 8:37:17 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0104414.dll" file. 
2/15/2005 8:37:15 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0103411.dll" file. 
2/15/2005 8:37:14 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0103370.dll" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0102370.dll" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0101370.dll" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0100370.dll" file. 
2/15/2005 8:37:12 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0099370.dll" file. 

andy214ever

  • Guest
Re: HELP!
« Reply #13 on: June 02, 2007, 06:42:18 AM »
 :-[2/15/2005 8:37:10 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098375.dll" file. 
2/15/2005 8:37:09 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098341.dll" file. 
2/15/2005 8:37:09 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0097341.dll" file. 
2/15/2005 8:27:44 PM   Personal   5692   Sign of "Win32:Small-FCC [Trj]" has been found in "C:\Documents and Settings\Personal\Local Settings\Temp\_avast4_\unp45742612.tmp\[Petite]" file. 
2/15/2005 8:42:42 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\WINDOWS\system32\drivers\usbine.sys" file. 
2/15/2005 8:37:48 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0111665.sys" file. 
2/15/2005 8:37:47 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0110666.sys" file. 
2/15/2005 8:37:46 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0109665.sys" file. 
2/15/2005 8:37:45 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108666.sys" file. 
2/15/2005 8:37:30 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108608.sys" file. 
2/15/2005 8:37:28 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108580.sys" file. 
2/15/2005 8:37:26 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108554.sys" file. 
2/15/2005 8:37:25 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0107554.sys" file. 
2/15/2005 8:37:23 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106554.sys" file. 
2/15/2005 8:37:22 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106527.sys" file. 
2/15/2005 8:37:22 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106506.sys" file. 
2/15/2005 8:37:20 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105504.sys" file. 
2/15/2005 8:37:19 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105473.sys" file. 
2/15/2005 8:37:18 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105452.sys" file. 
2/15/2005 8:37:18 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105431.sys" file. 
2/15/2005 8:37:18 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105430.sys" file. 
2/15/2005 8:37:17 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0104430.sys" file. 
2/15/2005 8:37:17 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0104408.sys" file. 
2/15/2005 8:37:15 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0103409.sys" file. 
2/15/2005 8:37:15 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0103408.sys" file. 
2/15/2005 8:37:14 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0103364.sys" file. 
2/15/2005 8:37:14 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0103363.sys" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0102364.sys" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0102363.sys" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0101364.sys" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0101363.sys" file. 
2/15/2005 8:37:12 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0100364.sys" file. 
2/15/2005 8:37:12 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0100363.sys" file. 
2/15/2005 8:37:12 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0099364.sys" file. 
2/15/2005 8:37:12 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0099363.sys" file. 
2/15/2005 8:37:10 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098369.sys" file. 
2/15/2005 8:37:10 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098368.sys" file. 
2/15/2005 8:37:09 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098336.sys" file. 
2/15/2005 8:37:09 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098335.sys" file. 
2/15/2005 8:37:08 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0097336.sys" file. 
2/15/2005 8:37:08 PM   Personal   5692   Sign of "Win32:Small-EZD [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0097327.sys" file. 
2/15/2005 8:19:18 PM   Personal   2216   Sign of "Win32:Small-EKC [Trj]" has been found in "c:\windows\system32\ctfnom.exe\[FSG]" file. 
2/15/2005 8:01:53 PM   SYSTEM   1612   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\WINDOWS\system32\ctfnom.exe\[FSG]" file. 
2/15/2005 8:40:42 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\WINDOWS\system32\10.exe\[FSG]" file. 
2/15/2005 8:37:48 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0111680.exe\[FSG]" file. 

andy214ever

  • Guest
Re: HELP!
« Reply #14 on: June 02, 2007, 06:42:56 AM »
2/15/2005 8:37:48 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0111680.exe\[FSG]" file. 
2/15/2005 8:37:18 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105439.exe\[Upack]" file. 
2/15/2005 8:37:14 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0103372.exe\[Upack]" file. 
2/15/2005 8:37:13 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0101378.exe\[Upack]" file. 
2/15/2005 8:37:10 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0098347.exe\[Upack]" file. 
2/15/2005 8:37:09 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0097347.exe\[Upack]" file. 
2/15/2005 8:37:08 PM   Personal   5692   Sign of "Win32:Small-EKC [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP46\A0097328.exe\[FSG]" file. 
2/15/2005 8:19:16 PM   Personal   2216   Sign of "Win32:Qqhelper-J [Trj]" has been found in "c:\windows\system32\chsoj.dll" file. 
2/15/2005 8:01:15 PM   SYSTEM   1612   Sign of "Win32:Qqhelper-J [Trj]" has been found in "C:\windows\system32\chsoj.dll" file. 
2/15/2005 8:40:49 PM   Personal   5692   Sign of "Win32:QQHelper-BR [Trj]" has been found in "C:\WINDOWS\system32\bind_50201.exe" file. 
2/15/2005 8:44:56 PM   Personal   5692   Sign of "Win32:OnLineGames-WG [Trj]" has been found in "C:\WINDOWS\Temp\Gjzo0.dll" file. 
2/15/2005 8:27:33 PM   Personal   5692   Sign of "Win32:OnLineGames-WG [Trj]" has been found in "C:\Documents and Settings\Personal\Local Settings\Temp\Gjzo0.dll" file. 
2/15/2005 8:44:25 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\WINDOWS\system32\trz3A.tmp" file. 
2/15/2005 8:19:37 PM   Personal   2216   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "c:\windows\system32\servhost.dll" file. 
2/15/2005 8:16:42 PM   SYSTEM   1612   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\WINDOWS\system32\servhost.dll" file. 
2/15/2005 8:41:00 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\WINDOWS\system32\dhlakn.dll" file. 
2/15/2005 8:40:53 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\WINDOWS\system32\cmdbcs.dll" file. 
2/15/2005 8:18:58 PM   Personal   2216   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "c:\windows\servhost.exe" file. 
2/15/2005 8:37:48 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0111671.dll" file. 
2/15/2005 8:37:47 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0110669.dll" file. 
2/15/2005 8:37:46 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0109669.dll" file. 
2/15/2005 8:37:45 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108672.dll" file. 
2/15/2005 8:37:30 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108610.dll" file. 
2/15/2005 8:37:29 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108582.dll" file. 
2/15/2005 8:37:26 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0108555.dll" file. 
2/15/2005 8:37:25 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0107557.dll" file. 
2/15/2005 8:37:23 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106555.dll" file. 
2/15/2005 8:37:22 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106530.dll" file. 
2/15/2005 8:37:22 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0106509.dll" file. 
2/15/2005 8:37:20 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105506.dll" file. 
2/15/2005 8:37:19 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105478.dll" file. 
2/15/2005 8:37:19 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105456.dll" file. 
2/15/2005 8:37:18 PM   Personal   5692   Sign of "Win32:OnLineGames-SK [Trj]" has been found in "C:\System Volume Information\_restore{D6814480-3694-4C18-8E6D-BE60E437082F}\RP47\A0105435.dll" file.