raman
December 16, 2003, 4:01pm
21
You only need the “how to get rid of this”: http://www.merijn.org/cwschronicles.html#cwshredder
and please let these fix too:
Maybe after get rid of all these, the Windowsupdatepage will work again.
Please post a new log after fixing all( incl. the cwshredder)
system
December 16, 2003, 4:15pm
22
I did everything, but the error page keeps on coming back, here`s the log after the SWshredder and fixing the files you specified…
Logfile of HijackThis v1.97.7
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/ http://www.hotmail.com/ http://www.apple.com/qtactivex/qtplugin.cab http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
raman
December 16, 2003, 4:28pm
23
The "Problem is, that Hijackthis only fix the registry, but not delete any files. Avast should be able to delte the files(at least in safe mode). And you should also give adaware a try( www.lavasoft.com ) because the Spy/Adware is still on your pc.
BTW forgot this. Its Spyware, too:
BTW2: in which file does Avast find the torj-gen
system
December 16, 2003, 7:01pm
24
Hello, im back… so what do I do now?
What do I need from http://www.lavasoft.com/
Do you want me to restart my computer in safe mode and run the scan again? and try to delete that file you specified?
raman
December 16, 2003, 7:11pm
25
Sorry wrong link!http://lavasoft.element5.com/default.shtml.es http://www.safer-networking.org/index.php?page=download
and yes, start you pc in safe mode and let Avast scan your PC.
system
December 22, 2003, 9:04pm
26
File: C:\WINDOWS\system32\audio.exe
Hijack This log:
Logfile of HijackThis v1.97.7
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinkshttp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37977.5068518519 http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
raman
December 22, 2003, 9:24pm
27
Possibly Afcore Variant:
If you are able to find the file test it here: http://www.kaspersky.com/remoteviruschk.html
system
December 22, 2003, 9:41pm
28
found the audio one and scanned it and it found nothing. Couldn’t find the bybdzzl.dll or anything like that anywhere…
raman
December 23, 2003, 4:47am
29
Fix the bybdzzl.dll lines and than type
system
December 23, 2003, 5:59am
30
Okay did that.
Logfile of HijackThis v1.97.7
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinkshttp://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37977.5068518519 http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
raman
December 23, 2003, 7:20am
31
The log looks clean(to me). The audio.exe could be a “spamtrojan” just delete/or remove it from the Windowsdir if you want to keep it.
system
December 24, 2003, 8:21pm
32
I’m also having problems with win32:trojan-gen. A screen appeard when I was scanning my computer saying it was infected with win32:trojan-gen {VC}. I tried to remove it, but it wasn’t possible and I suspect that deleting the file will damage my computer. :-
Logfile of HijackThis v1.97.7
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ieplugin.com/search.htm http://search.ieplugin.com/search.htm http://www.uol.com.br/ http://search.ieplugin.com/search.htm http://search.ieplugin.com/search.htm http://search.ieplugin.com/search.htm http://search.ieplugin.com/search.htm http://search.ieplugin.com/q.cgi?q=%s http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://download.mcafee.com/molbin/shared/MInstall.cab http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37819.2653935185 http://ftp.hp.com/pub/automatic/player/isetupML.cab http://www.searchwww.com/search.cab http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe http://www.truedoc.com/activex/tdserver.cab http://www.sis.com/support/chipdetect/OSInfo.cab http://www.sis.com/support/chipdetect/SiSAutodetect98.cab http://212.145.159.194/251065/dialercab/WebRecomendada.cab http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4306/mcfscan.cab http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
Thanks
raman
December 25, 2003, 8:55am
33
One of your Problems is CWS: http://www.merijn.org/cwschronicles.html
Pleas test this file: C:\WINDOWS\CSRSS.EXEhttp://www.kaspersky.com/remoteviruschk.html what virus does it report? Ciadoor? After doing all this( the cwshredder), post a new log.
system
December 25, 2003, 1:24pm
34
CWShredder says the computer is clean and the antivirus didn’t report any virus… :-\ hum… it doen’t look good to me… What should I do???
raman
December 25, 2003, 2:10pm
35
We will do it manually. Fix the following things:http://www.truedoc.com/activex/tdserver.cab http://www.sis.com/support/chipdetect/OSInfo.cab http://www.sis.com/support/chipdetect/SiSAutodetect98.cab http://212.145.159.194/251065/dialercab/WebRecomendada.cab http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4306/mcfscan.cab http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
Make a restart and post a new log.
It would be nice if you could send me these files:
to the Email which can be found in my Profil or to virus@rokop-security.de
system
December 25, 2003, 4:18pm
36
I just did what you told. This is the log:
Logfile of HijackThis v1.97.7
Running processes:
F1 - win.ini: load=ptsnoop.exehttp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://download.mcafee.com/molbin/shared/MInstall.cab http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37819.2653935185 http://ftp.hp.com/pub/automatic/player/isetupML.cab http://www.searchwww.com/search.cab http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
I sent you csrss.exe, but I couldn’t send bxxs5.dll cause it disappeard after I fixed that stuff.
By the way, Merry Christmas!! And thaks for helping
raman
December 25, 2003, 5:50pm
37
Thanks, and no problem.
Is there anything else I should do?
Yes, please fix this:http://www.searchwww.com/search.cab
and update your Windows /IE via www.windowsupdate.com
system
December 26, 2003, 12:25pm
38
I fixed that and updated Windows, but the antivirus keeps saying the file is infected and I can’t repair or remove it… :-. ??? What could that be? ???
raman
December 26, 2003, 12:33pm
39
Which file is reported as infected and where is it located(folder)?
system
December 26, 2003, 12:33pm
40
my antivirus sw picked up a " Win32:Trojan-gen. {UPX!} " virus.
Logfile of HijackThis v1.97.7
Running processes:
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllhttp://install.global-netcom.de/ieloader.cab http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab http://office.microsoft.com/officeupdate/content/opuc.cab http://207.188.7.150/0642e5bee8eb0ff6a106/netzip/RdxIE601.cab http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37956.0703472222 http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
what should i do next?
