Author Topic: Repeated alerts for same virus (Read 45155 times)

BarbeeGee · « **Reply #15 on:** August 08, 2004, 05:20:18 AM »

OK scan is complete and no virus's were found.

What next? Am I clear then?

BarbeeGee · « **Reply #16 on:** August 08, 2004, 05:43:02 AM »

So I reread your last post and decided you must be right and even though my Avast scan came out perfectly clear I went into the chest, highlighted the virus again and this time chose: Scan So I scanned the virus and the alarm went off.

I'm back to square 1

BarbeeGee · « **Reply #17 on:** August 08, 2004, 06:03:16 AM »

OK I turned off the restore from My Computer, I rebooted now when I tried to take the check off the box to turn restore back on my computer froze. How do you get it back on?

Eddy · « **Reply #18 on:** August 08, 2004, 09:05:41 AM »

Please the page I have in my signature. I think that will make some things clear for you. If you want, also follow the steps mentioned there to make sure your system is clean. Keep us informed.

BarbeeGee · « **Reply #19 on:** August 08, 2004, 06:32:03 PM »

I followed the steps... now how do I turn the restore function? When I tried it last night my computer froze.

whocares · « **Reply #20 on:** August 08, 2004, 06:58:16 PM »

Quote from: BarbeeGee on August 08, 2004, 06:32:03 PM

now how do I turn the restore function?

--> http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

read the last lines at the bottom of the page..

maybe it works better if you do it in SafeMode (F8-Boot):
CLick-here

Also you might want to postpone this until we've seen your hijackthis-Log;
follow the intructions here:
http://hjt.klaffke.de/en

BarbeeGee · « **Reply #21 on:** August 08, 2004, 07:15:25 PM »

I can't send log file... it tells me it is too long.

It won't go as an attachment either.

whocares · « **Reply #22 on:** August 08, 2004, 07:46:19 PM »

when you follow the instructions, you will get a text file with the log..
normally, it even opens automatically..

mark & copy all the text, and then paste it here in a posting..

if it's really too long: mark, copy and paste the log in split parts.. like 30 lines apiece..

P.S.: a very long hijackthis.-Log is often a reaaallyyy bad sign

BarbeeGee · « **Reply #23 on:** August 08, 2004, 07:49:03 PM »

I play Pogo a lot and most of the files are Pogo.

OK here is the beginning:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\STOPzilla!\Stopzilla.exe
C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe

BarbeeGee · « **Reply #24 on:** August 08, 2004, 07:49:31 PM »

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\HPINST~1\plugin\bin\pchbutton.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\WinZip2\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\UNZIPFOLDER\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=1928356723113218
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.simartshop.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us6.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us6.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\Program Files\ISSS\ZILLAbar\ZILLAbar.dll/options.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchwww.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.zillafind.com/getPageResults.do?doProcessing=true&query=%s
O1 - Hosts: 216.93.168.167 auto.search.msn.com
O1 - Hosts: 216.93.168.167 auto.search.msn.com
O1 - Hosts: comments (such as these) may be inserted on individual

BarbeeGee · « **Reply #25 on:** August 08, 2004, 07:49:59 PM »

O1 - Hosts: 255.255.255.255 www.casinoxo.com
O1 - Hosts: 216.93.168.167 auto.search.msn.com
O1 - Hosts: 216.93.168.167 sitefinder.verisign.com
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - (no file)
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\StopzillaBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ZILLAbar - {8FC8AE66-AC15-4C0D-9E9A-51296A0C52FA} - C:\Program Files\ISSS\ZILLAbar\ZILLAbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\pchbutton.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: GStartup.lnk = ?
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: Search.vbs
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip2\WZQKPICK.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

BarbeeGee · « **Reply #26 on:** August 08, 2004, 07:50:26 PM »

BarbeeGee · « **Reply #27 on:** August 08, 2004, 07:51:09 PM »

whocares · « **Reply #28 on:** August 08, 2004, 08:00:22 PM »

Hi,

good...

please also post the beginning/the header of the Log..

*

((EDIT: PS2.exe is probably ok if you got a HP-computer))

O4 - Global Startup: Search.vbs

check the above file with Onlijnescanners from KAV, RAV and Trend (see link "VirusRemoval" below) and report the results..

also fix all R0, R1, O1 & O2 entry that you don't know or need

(except this one:
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\StopzillaBHO.dll
)

"fix" means: place a checkmark in the square in front of the respective line and then click the button "fix checked" in hijackthis..

reboot, and post a new log..

without listing the O16 ..POGO entries..

whocares · « **Reply #29 on:** August 08, 2004, 08:02:07 PM »

welll the last list is not quite so good..

if you trust POGO then don't list them, but list all the remaining O16 - DPF ... entries again

Author Topic: Repeated alerts for same virus (Read 45155 times)

BarbeeGee

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

Eddy

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

whocares

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

whocares

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

BarbeeGee

Re:Repeated alerts for same virus

whocares

Re:Repeated alerts for same virus

whocares

Re:Repeated alerts for same virus