I have trojan BHO-KD butt it change name Win32:BHO-MQ C\windows\system32\cryptsv.dll
PLZ Help me delete this trojan. It is same BHO-KD . It says acsess denied when i try to delete it
This trojan change name again now name is Win32:Pakes-AKM
Helppp
Run these tow programs in the order posted and poast the logs
Download ComboFix from Here or Here to your Desktop.
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall.
Click here to download HJTsetup.exe
[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:20, on 23.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4A60DCFC-6B26-427E-9B62-86A38966BBF9} - C:\WINDOWS\system32\cryptsv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Little Fighter 2 Toolbar Helper - {AB41010D-4804-4793-A6A2-3B5EBE2348DD} - C:\Program Files\Little Fighter 2 Toolbar\v2.0.0.1\Little_Fighter_2_Toolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Little Fighter 2 Toolbar - {C11483F7-D7D8-4804-98D8-6055470BB989} - C:\Program Files\Little Fighter 2 Toolbar\v2.0.0.1\Little_Fighter_2_Toolbar.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [ZoneAlarm Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”
O4 - HKLM..\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized
O4 - HKLM..\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1033
O4 - HKLM..\Run: [ExtraFilmHemmaAgent] C:\Program Files\ExtraFilm Kotona\Agent.exe
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU..\Run: [VisualTaskTips] C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [VMCL] C:\Program Files\vodafone\vmclite\DongleEnumerator.exe
O4 - HKCU..\Run: [msnmsgr] “C:\Program Files\MSN Messenger\msnmsgr.exe” /background
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Paikallinen palve’)
O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Verkkopalve’)
O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)
O4 - Startup: PowerReg Scheduler V3
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y’z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://speedbar.myway.com/menusearch.html?p=MG1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Antti.PERHEKONE\Käynnistä-valikko\Ohjelmat\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webcam Corp. Service Starter - Unknown owner - C:\Program Files\Webcam\Webcam123\dogsvc.exe (file missing)
–
End of file - 11022 bytes
Please post the combofix log.
Hi Trojanhater -
Just for information, this entry is a sign of a trojan downloader …
O2 - BHO: (no name) - {4A60DCFC-6B26-427E-9B62-86A38966BBF9} - C:\WINDOWS\system32\cryptsv.dll
Oldman will help you with it and any other problems he may find.
this is combofix log
ComboFix 08-02-21 - Antti 2008-02-21 20:33:58.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.556 [GMT 2:00]
Running from: C:\Documents and Settings\Antti.PERHEKONE\Työpöytä\ComboFix.exe
- Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\MyWay
C:\Program Files\MyWay\myBar\1.bin\MWHTMLMU.DLL
C:\Program Files\MyWay\myBar\1.bin\MY2NS.EXE
C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
C:\Program Files\MyWay\myBar\1.bin\MYPOPSWT.DLL
C:\Program Files\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS
C:\Program Files\MyWay\myBar\1.bin\PARTNER.DAT
C:\Program Files\MyWay\myBar\1.bin\PARTNER2.DAT
C:\Program Files\MyWay\myBar\Cache[u]0[/u]1137F77.bin
C:\Program Files\MyWay\myBar\Cache[u]0[/u]11383EB.bin
C:\Program Files\MyWay\myBar\Cache[u]0[/u]1138D13.bin
C:\Program Files\MyWay\myBar\Cache\files.ini
C:\Program Files\MyWay\myBar\History\search
C:\Program Files\MyWay\myBar\Settings\prevcfg.htm
C:\Program Files\MyWay\SrchAstt\1.bin\PARTNER.DAT
C:\Program Files\MyWay\SrchAstt\Cache[u]0[/u]113213A
C:\Program Files\MyWay\SrchAstt\Cache\files.ini
C:\Program Files\MyWay\SrchAstt\Settings\prevcfg.htm
----- BITS: Possible infected sites -----
hxxp://au.downlo
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-21 to 2008-02-21 )))))))))))))))))
.
2008-02-21 15:27 . 2008-02-21 15:29 226 --a------ C:\Gunner3.ini
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\soundtrack
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\rock
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\reggae
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\newage
2008-02-20 16:17 . 2008-02-20 16:21 d-------- C:\Documents and Settings\Antti\misc
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\jazz
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\folk
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\data
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\country
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\classical
2008-02-20 16:17 . 2008-02-20 16:17 d-------- C:\Documents and Settings\Antti\blues
2008-02-20 16:09 . 2008-02-20 16:31 d-------- C:\Documents and Settings\Antti\Status
2008-02-16 16:07 . 2008-02-16 16:07 d-------- C:\Program Files\Common Files\Motion Playground Inc
2008-02-16 14:51 . 2008-02-16 14:51 d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-13 16:48 . 2008-02-15 20:06 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-11 21:22 . 2008-02-11 21:22 d-------- C:\Program Files\Niels Bauer Software Design
2008-02-10 13:40 . 2008-02-10 13:40 d-------- C:\Sierra
2008-02-09 23:11 . 2008-02-09 23:11 d-------- C:\Documents and Settings\Antti.PERHEKONE\Application Data\GRETECH
2008-02-09 22:35 . 2008-02-09 22:35 d-------- C:\Program Files\GRETECH
2008-02-09 21:37 . 2008-02-09 21:47 5,382 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-09 21:05 . 2008-02-09 21:47 72,074 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-02-09 21:04 . 2008-02-09 21:46 2,359,350 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-02-09 20:53 . 2008-02-09 21:36 d-------- C:\WINDOWS\BricoPacks
2008-02-08 16:52 . 2008-02-08 16:52 335,872 --a------ C:\WINDOWS\system32\mysidesearch_sidebar.dll
2008-02-07 09:06 . 2008-02-07 09:06 d-------- C:\Program Files\eidos Interactive
2008-02-06 11:20 . 2008-02-06 11:20 d-------- C:\Program Files\3DO
2008-02-06 10:39 . 2008-02-06 10:39 d-------- C:\Documents and Settings\All Users\Application Data\Chat Republic Games
2008-02-05 21:29 . 2008-02-05 21:29 31,361 --a------ C:\WINDOWS\3DSTATE_logo.jpg
2008-02-05 21:09 . 2008-02-07 12:55 d-------- C:\Program Files\StarportGE
2008-02-05 21:08 . 2008-02-18 21:57 d-------- C:\Program Files\My Worst Day WW2
2008-02-05 16:19 . 2008-02-05 16:19 d-------- C:\Program Files\Infogrames
2008-01-31 19:15 . 2008-01-31 19:21 d-------- C:\Documents and Settings\pommi tommi\Application Data\Mount&Blade
2008-01-30 13:21 . 2008-01-30 13:21 d-------- C:\Program Files\D-Tools
2008-01-30 13:21 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2008-01-30 13:21 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2008-01-28 22:13 . 2008-01-28 22:16 d-------- C:\Documents and Settings\Antti.PERHEKONE\Application Data\Mount&Blade
2008-01-27 16:28 . 2008-02-21 20:59 5,042,208 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-27 16:28 . 2008-02-21 16:16 59,852 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-27 16:20 . 2008-01-27 16:20 d-------- C:\Program Files\ZoneAlarmSB
2008-01-27 16:17 . 2008-01-27 16:17 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-27 16:17 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-01-27 16:17 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-01-27 16:17 . 2008-01-27 16:20 4,212 —h----- C:\WINDOWS\system32\zllictbl.dat
2008-01-27 16:16 . 2008-01-27 16:16 d-------- C:\Program Files\Zone Labs
2008-01-27 16:15 . 2008-02-21 20:53 d-------- C:\WINDOWS\Internet Logs
2008-01-21 14:02 . 2008-02-09 17:39 84,729 --a------ C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 13:30 4,120 ----a-w C:\Documents and Settings\Antti.PERHEKONE\Application Data\wklnhst.dat
2008-02-20 18:07 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\LimeWire
2008-02-17 18:45 24,008 ----a-w C:\Documents and Settings\SALME NEUVONEN\Application Data\wklnhst.dat
2008-02-17 17:28 --------- d-----w C:\Program Files\ExtraFilm Kotona
2008-02-16 12:34 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-15 20:53 168,960 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-02-15 20:53 1,619,456 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-02-15 17:05 --------- d-----w C:\Program Files\Mount&Blade
2008-02-14 18:08 1,613,312 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-02-14 09:00 1,481 —ha-w C:\Documents and Settings\SALME NEUVONEN\hpothb07.dat
2008-02-11 20:34 273,920 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-02-11 20:34 1,590,784 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-02-10 11:45 --------- d-----w C:\Program Files\Sierra On-Line
2008-02-10 09:26 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\uTorrent
2008-02-09 19:05 219,136 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-02-09 18:58 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\MSN6
2008-02-08 11:47 --------- d-----w C:\Program Files\ProPilkki2
2008-02-08 06:12 --------- d-----w C:\Documents and Settings\pommi tommi\Application Data\LimeWire
2008-02-06 13:23 --------- d-----w C:\Program Files\KotiMikron Hakemisto
2008-02-06 10:55 499,200 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-02-06 08:55 --------- d-----w C:\Program Files\CoolBasic
2008-02-06 08:53 --------- d-----w C:\Program Files\Jollygood Games
2008-02-06 08:52 --------- d-----w C:\Program Files\Beamer
2008-02-06 06:56 1,469,440 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-30 11:08 --------- d-----w C:\Program Files\Jets’n’Guns Demo
2008-01-29 13:08 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\wsInspector
2008-01-28 14:21 --------- d-----w C:\Program Files\Deadhunt Demo
2008-01-26 17:42 --------- d-----w C:\Program Files\EA Games
2008-01-26 17:10 --------- d–h–w C:\Program Files\InstallShield Installation Information
2008-01-26 10:59 --------- d-----w C:\Documents and Settings\SALME NEUVONEN\Application Data\wsInspector
2008-01-25 19:43 --------- d-----w C:\Program Files\LEGO Media
2008-01-21 10:57 --------- d-----w C:\Program Files\eMule
2008-01-19 21:16 --------- d-----w C:\Program Files\LimeWire
2008-01-18 21:24 --------- d-----w C:\Program Files\Paint.NET
2008-01-18 16:34 --------- d-----w C:\Program Files\Microsoft Games
2008-01-18 11:41 --------- d-----w C:\Documents and Settings\pommi tommi\Application Data\InterVideo
2008-01-17 16:47 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\LEGO Media
2008-01-17 16:43 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\eMule
2008-01-17 14:31 --------- d-----w C:\Documents and Settings\SALME NEUVONEN\Application Data\Grisoft
2008-01-17 12:13 --------- d-----w C:\Documents and Settings\pommi tommi\Application Data\LEGO Media
2008-01-17 11:59 720,896 -c–a-w C:\WINDOWS\iun6002.exe
2008-01-17 11:37 --------- d-----w C:\Documents and Settings\pommi tommi\Application Data\Grisoft
2008-01-16 18:58 --------- d-----w C:\Documents and Settings\Pekka\Application Data\Grisoft
2008-01-16 15:09 --------- d-----w C:\Program Files\Freeciv-2.1.0-gtk2
2008-01-16 14:28 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\Grisoft
2008-01-16 11:29 --------- d-----w C:\Program Files\EndlessOnline
2008-01-14 05:22 --------- d-----w C:\Program Files\AGEIA Technologies
2008-01-13 18:31 --------- d-----w C:\Program Files\XMoto
2008-01-13 13:35 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-13 08:01 --------- d-----w C:\Program Files\Elävät Kirjat
2008-01-13 06:47 162 ----a-w C:\Documents and Settings\Pekka\Application Data\wklnhst.dat
2008-01-11 18:06 --------- d-----w C:\Documents and Settings\pommi tommi\Application Data\Microsoft Games
2008-01-11 11:01 --------- d-----w C:\Program Files\TuxPaint
2008-01-08 20:48 --------- d-----w C:\Program Files\Eraser
2008-01-08 12:57 --------- d-----w C:\Documents and Settings\Antti.PERHEKONE\Application Data\Skype
2008-01-06 15:10 --------- d-----w C:\Program Files\Google
2008-01-06 14:32 --------- d-----w C:\Documents and Settings\pommi tommi\Application Data\AdobeUM
2008-01-06 13:57 0 ----a-w C:\Documents and Settings\pommi tommi\Application Data\wklnhst.dat
2008-01-05 11:57 --------- d-----w C:\Program Files\GameSpy Arcade
2008-01-04 12:20 --------- d-----w C:\Documents and Settings\Pekka\Application Data\Hewlett-Packard
2008-01-04 12:19 82,380 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2008-01-03 16:28 110,648 ----a-w C:\Documents and Settings\SALME NEUVONEN\Application Data\GDIPFONTCACHEV1.DAT
2008-01-02 13:14 --------- d-----w C:\Program Files\Elma
2008-01-02 12:27 --------- d-----w C:\Program Files\Skype
2008-01-02 12:27 --------- d-----w C:\Program Files\Common Files\Skype
2008-01-02 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-01 19:37 110,648 ----a-w C:\Documents and Settings\Antti.PERHEKONE\Application Data\GDIPFONTCACHEV1.DAT
2007-12-31 12:50 19,456 ----a-w C:\WINDOWS\system32\drivers\cryskmuh.dat
2007-12-30 10:32 --------- d-----w C:\Program Files\Nstorm
2007-12-22 10:31 --------- d-----w C:\Program Files\Everest Poker
2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-22 13:40 21,840 -c–atw C:\WINDOWS\system32\SIntfNT.dll
2007-11-22 13:40 17,212 -c–atw C:\WINDOWS\system32\SIntf32.dll
2007-11-22 13:40 12,067 -c–atw C:\WINDOWS\system32\SIntf16.dll
2007-11-21 11:21 40,731 ----a-w C:\WINDOWS\system32\superiorads-uninst.exe
2007-09-16 10:49 22 ----a-w C:\Program Files\Uusi WinRAR ZIP-arkisto.zip
2006-11-23 14:08 8,704 --sha-w C:\Program Files\Thumbs.db
2006-02-21 18:57 348 ----a-w C:\Program Files\HitListe.dat
2006-01-13 12:57 3,418 ----a-w C:\Program Files\INSTALL.LOG
2004-12-17 15:35 2,755 ----a-w C:\Program Files\Uninst.isu
2004-12-01 11:50 524,300 ----a-w C:\Documents and Settings\SALME NEUVONEN\Application Data\position.bin
2004-10-22 15:54 561 —ha-w C:\Documents and Settings\SALME NEUVONEN\Application Data\hpothb07.dat
2004-10-01 12:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
2003-09-27 09:24 18,762 ----a-w C:\Program Files\gametext.txt
2002-10-29 19:31 589,824 ----a-w C:\Documents and Settings\SALME NEUVONEN\Application Data\book.bin
1998-03-19 10:58 8,962 ----a-w C:\Program Files\Terning.wav
1998-03-03 09:29 176 ----a-w C:\Program Files\Pop.wav
1998-03-03 09:29 1,078 ----a-w C:\Program Files\Face03.ico
1997-02-12 21:17 19,426 -c----w C:\Program Files\Applaus.wav
1995-01-01 00:51 44 ----a-w C:\Program Files\Track14.cda
.
------- Sigcheck -------
“C:\WINDOWS\explorer.exe”
----a-w 975,872 2007-06-13 13:22:06 C:\WINDOWS\explorer.exe
----a-w 1,033,728 2007-06-13 13:10:34 C:\WINDOWS$hf_mig$\KB938828\SP2QFE\explorer.exe
-c----w 1,004,544 2002-09-16 12:00:00 C:\WINDOWS$NtServicePackUninstall$\explorer.exe
-c----w 1,032,704 2004-09-14 13:12:04 C:\WINDOWS$NtUninstallKB938828$\explorer.exe
----a-w 975,872 2007-06-13 13:22:06 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
-c----w 1,033,728 2007-06-13 13:22:06 C:\WINDOWS\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
Huom Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{4A60DCFC-6B26-427E-9B62-86A38966BBF9}]
2004-09-14 15:11 84992 --a------ C:\WINDOWS\system32\cryptsv.dll
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-27 16:20 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{C11483F7-D7D8-4804-98D8-6055470BB989}
{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}
[HKEY_CLASSES_ROOT\clsid{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
“{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}”= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-27 16:20 262144]
[HKEY_CLASSES_ROOT\clsid{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-08-15 20:16 68856]
“VisualTaskTips”=“C:\Program Files\VisualTaskTips\VisualTaskTips.exe” [2006-07-31 13:33 36864]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-09-14 15:12 15360]
“VMCL”=“C:\Program Files\vodafone\vmclite\DongleEnumerator.exe” [2007-04-16 11:56 131072]
“msnmsgr”=“C:\Program Files\MSN Messenger\msnmsgr.exe” [2007-01-19 11:55 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Wizard”=“”
“IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2004-07-01 12:02 155648]
“HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2004-07-01 11:58 118784]
“Microsoft Works Update Detection”=“C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe” [2003-06-10 02:11 50688]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 09:50 155648]
“InCD”=“C:\Program Files\Ahead\InCD\InCD.exe” [2005-07-25 12:01 1397760]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 15:00 79224]
“ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-11-14 16:05 919016]
“!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2007-06-11 11:25 6731312]
“DAEMON Tools-1033”=“C:\Program Files\D-Tools\daemon.exe” [2004-08-22 17:05 81920]
“ExtraFilmHemmaAgent”=“C:\Program Files\ExtraFilm Kotona\Agent.exe” [2004-05-21 13:16 290816]
“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-10-10 19:51 39792]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-09-14 15:12 15360]
“Picasa Media Detector”=“C:\Program Files\Picasa2\PicasaMediaDetector.exe” [2007-10-23 23:18 443968]
C:\Documents and Settings\SALME NEUVONEN\K„ynnist„-valikko\Ohjelmat\K„ynnistys
Uusi InterActual Skin.iti [2007-04-17 15:44:03 0]
C:\Documents and Settings\Antti.PERHEKONE\K„ynnist„-valikko\Ohjelmat\K„ynnistys
PowerReg Scheduler V3.exe [2007-09-19 17:51:39 225280]
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224]
Y’z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648]
C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-05 17:47:46 113664]
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 00:37:10 323646]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 01:06:58 28672]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 21:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
“UIHost”=“LogonUI.EXE”
R0 wblhobme;wblhobme;C:\WINDOWS\system32\drivers\cryskmuh.dat
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-10-05 14:33]
R1 XPROTECTOR;XPROTECTOR;C:\WINDOWS\system32\drivers\Oreans.sys [2005-09-05 13:10]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2003-04-18 13:45]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe
S3 iMSPCLOj;iMSPCLOj;C:\DOCUME~1\Antti\LOCALS~1\Temp\iMSPCLOj.sys
S3 Webcam Corp. Service Starter;Webcam Corp. Service Starter;C:\Program Files\Webcam\Webcam123\dogsvc.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3796bfba-7cd2-11dc-b68e-003005673e3a}]
\Shell\AutoRun\command - E:\VMC_PBStarter.exe
.
‘Ajoitetut tehtävät’-kansion sisältö
“2008-02-14 12:20:32 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1199449175.job”
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
“2008-02-21 18:26:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job” - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
“2008-02-21 12:20:00 C:\WINDOWS\Tasks\WebReg 20080214142048.job” - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exeQ/TaskName 20080214142048 /N
.
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 20:58:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
.
Completion time: 2008-02-21 21:01:46
ComboFix-quarantined-files.txt 2008-02-21 19:01:39
.
2008-02-15 18:06:02 — E O F —
It’s a pretty old combofix log, but I can see somethings that have to go.
First delete the copy of combofix.exe from your desktop and download a new one. Do not run it yet.
Please download ComboFix from Here or Here to your Desktop.
You have a driver we have to disable and remove.
Please copy and paste this section into a notepad as you will be in safe mode.
Step #1
Start in Safe Mode Using the F8 method:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
Use the arrow keys to select the Safe Mode menu item.
Press the Enter key.
Step #2
Now we will need to disable the driver for this thing. Please do the following:
Click Start, click Control Panel, click Performance and Maintenance, and then click System.
(Please note, that depending on how you have your computer set up, the path to the system icon may be
start, control panel, system.)
On the Hardware tab, click Device Manager.
Click the View menu and if there is no checkmark in front of Show hidden devices then click on it to activate it.
Scroll down the list of devices and double-click Non-Plug and Play Drivers.
Locate wblhobme and right click it and then click the Properties option.
Click the Driver tab.
In the Startup section select Disable from the drop-down list.
Click General tab.
In the Device Usage drop-down list select Do not use this device (disable).
Click the Ok button and you should be prompted to reboot. You can reboot normally.
Back in normal windows.
Please download The Avenger by Swandog46 to your Desktop.
1.[*]Click on Avenger.zip to open the file[*]Extract avenger2.exe to your desktop
[QUOTE]Drivers to delete:
wblhobme
Files to delete:
C:\WINDOWS\system32\drivers\cryskmuh.dat
C:\WINDOWS\system32\cryptsv.dll
[/quote]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.[/b]
- Now, start The Avenger program by clicking on its icon on your desktop.
[*] Copy/Paste [b]all[b] the text in the above quote box into the main window
[*] MAKE SURE THE TEXT MATCHES EXACTLY
[*] Click Execute
The Avenger will automatically do the following:
[*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Delete”, The Avenger will actually restart your system twice.)
[*]On reboot, it will briefly open a black command window on your desktop, this is normal.
[*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
Now run combofix
[]Please, never rename Combofix unless instructed.
[]Close any open browsers.
[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
[list]
[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
[*]Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
[*]Close any open browsers.
[*]WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
[]Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
[]If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
[*]Double click on combofix.exe & follow the prompts.
[*]When finished, it will produce a report for you.
[*]Please post the “C:\ComboFix.txt” along with a new HijackThis log for further review.
[/list]
Note: Do not mouseclick combofix’s window while it’s running. That may cause it to stall
Please post in your next reply, the Avenger results and the Combofix log and a new Hijackthis log.
Please don’t hesitate if you have any problems or questions.
Thanks.
oldman i want ask why this trojan change name sometimes. It was months ago win32:BHO-KD then win32:BHO-MQ now win32:PAKES-AKM?
You probably have both or a variant. How are coming along with the removal instructions I posted?
Now i have two trojans Both are in C/windows/system32/cryptsv.1~ and cryptsv.dll
You will probably end up with more if you don’t start removing them. ???
when i scan cryptsv.dll it doesnt find anything. Is trojan deleted by his/her maker or something
Hi Trojanhater666,
This is a BHO trojan with the following components:
Processes : *
CRYPTSV.DLL
CLSID List : {F0E5F564-BA65-4181-AD5A-F868F08D0480}
{85BE6BA5-6732-4A71-B48E-82AFCC24639C}
All the hidden components should be removed, else you still have it. Follow oldman’s instructions to the dot, and you have a chance of removing them for good. And for the future you have to go online with a fully patched windows, service packs and all, and the most recent Sun Java version and previous versions manually removed, else you will be a sitting duck again waiting for reinfection, and use a normal users account only to surf after your comp is clean, 90% of malware can no longer make changes to your OS, which is more secure by enormous leaps,
polonus
I think what is not being understood is that even though CRYPTSV.DLL is scanned as not infected (because it is not), the infection uses this dll in it’s work of infecting your computer. It is only a single part of the infection and all parts of the infection must be removed. It is also a dll that is not needed on your computer so why have it?
As Polonus stated, please follow oldman’s instructions to the dot.
Hi CharleyO,
You are right, only a full scan and a log file txt will show what the infection could be, as you have experienced lately that there is so much infestations with “hidden” malware, that need special measures for being able to remove it properly. Also important is that av scanners have to adjust also to their new role as spyware scanners. Oldman will come up with the right formula for Trojanhater666’s problem,
polonus