Spyware/Adware Infection Precaution Advisory
-
Originally posted by ceecookie:
That's for unwilling to pay people. Anyway, good luck for them. Usually they have no harm. But one of the sites is seriously infected with viruses.
[b]List of Do Not Go sites:
[*]Software crack sites/keygen sites like:
[*]www.cracks.am
[*]www.seriall.com
[*]www.thebugs.ws
[*]www.seriall.ws
[/b] -
Too bad lor. I think most of them already knows how to.Originally posted by contact:malicious minded ah yi!
anti-pirated software holder here
haha
Ah kai, you also know right?
-
so which one issit?Originally posted by ndmmxiaomayi:But one of the sites is seriously infected with viruses. -
As it's name suggest, thebugs.wsOriginally posted by Xcert:so which one issit? -
I personally find that Spyware Doctor has a couple of false alarms, but the scanning speed is commendable. And it does have pretty good spyware detections on the whole. Many regular updates as well. Webroot's kind of slow and seems to slow down other processes quite a fair bit too.
What I use for my PC's security and maintenance:
1 ) AVG
2 ) CCleaner
3 ) FreeRAM XP Pro
4 ) Kerio Personal Firewall
5 ) Lavasoft Ad-Aware SE Personal
6 ) Spybot - Search & Destroy
7 ) SpywareBlaster
8 ) Spyware Guard
9 ) Norton Systemworks
10 ) Regular visits to Trendmicro's free online antivirus and antispyware scans -
i only have one antivirus...
-
It is actually most ideal to have just 1 antivirus program in any 1 PC terminal, however, it's got to be updated regularly with the latest definitions, if not, it's of not much use. But that said, it is alright to have more than 1 antivirus program in a PC terminal, provided only 1 is made active at any 1 time. To prevent conflicts or misidentifying each other's behaviour as that of a virus. Run 1 program at a time, and ensure that both programs are not active together, especially in default options such as email scanning or real-time protection etc.
-
free antivirus AVG seems good enough.......yeah this i agree......
while spyware.....the one that;'s free.........for usage is spysweeper......
all these can be found on www.cnet.com
while webroot spysweeper is free....yeah it maybe free for use....but if your PC has already been infected and needs the software to eliminate it......then you will have to register for a fee of US 40 if i am not mistaken........
oh btw....there is one free software that's available too on the net.....its yahoo spysweeper..........quite good and its free though......if your PC has been infected......you can install it and delete any virus........however be warned......that it might not clear all viruses..... -
Weird though, I can use spysweeper to clear my spyware, without registration. But it lasts only 14 days....Originally posted by gohkatkat:free antivirus AVG seems good enough.......yeah this i agree......
while spyware.....the one that;'s free.........for usage is spysweeper......
all these can be found on www.cnet.com
while webroot spysweeper is free....yeah it maybe free for use....but if your PC has already been infected and needs the software to eliminate it......then you will have to register for a fee of US 40 if i am not mistaken........
oh btw....there is one free software that's available too on the net.....its yahoo spysweeper..........quite good and its free though......if your PC has been infected......you can install it and delete any virus........however be warned......that it might not clear all viruses.....
Spyware Doctor from pctools.com need registration to eliminate anything.
Yahoo's antispyware is good, isn't comprehensive. -
[quote]Originally posted by ndmmxiaomayi:
[b]
Weird though, I can use spysweeper to clear my spyware, without registration. But it lasts only 14 days....=
HUH???can meh????how so????interesting.....everytime i want it to clear an adware or virus.....it keeps on telling me to register first...............anyone knows of any crack software to kill the registering stuff?????tell me............i might show some goodies in return....... -
Don't know leh...Originally posted by gohkatkat:[quote]Originally posted by ndmmxiaomayi:
[b]
Weird though, I can use spysweeper to clear my spyware, without registration. But it lasts only 14 days....=
HUH???can meh????how so????interesting.....everytime i want it to clear an adware or virus.....it keeps on telling me to register first...............anyone knows of any crack software to kill the registering stuff?????tell me............i might show some goodies in return.......
My software wasn't cracked, so that's why it lasted for 14 days.
If you want, visit those websites stated. Though if you got virus not my business liao.
-
how come limewire no good??
-
You can get viruses through limewire, if it isn't being used properly. Although technically it is quite safe because there's lots of users sharing files, other vulunerabilities are available.Originally posted by mhcampboy:how come limewire no good?? -
-
Originally posted by launtpc:
which firewalls r free??
Mods please edit as you wish. Thanks!
[b]List of MUST GET software:
Antispyware
[*]Ad-Aware Personal SE 1.06
[*]Windows Defender Beta 2 (need valid XP CD-Key)
[*]Spybot Search and Destroy
[*]Webroot Spysweeper
[*]Spyware Doctor
Internet Browsers *
[*]Opera 8.54
[*]Opera 9.0 Beta
[*]FireFox 1.5.0.3
* No need to exactly use these two -- refer to FAQ
Firewalls
[*]Agnitium Outpost Firewall
[*]Sygate Personal Firewall 5.6 (discontinued by Symantec)
[*]Kerio Personal Firewall
[*]ZoneAlarm 5.5
Anti-Virus Software
[*]AVG Antivirus
[*]Avast! 4 Home Edition
List of Do Not Use software:
Vulnerable software
[*]Internet Explorer
[*]ZoneAlarm 6
Fake antispywares
[*]Spyaxe
[*]Winfixer 2005
[*] Antivirus Gold
[*] SpywareStrike
[*] WorldAntiSpyware
[*] SpyTrooper
[*] Spy Sheriff
[*] SpyBan
[*] SpyWiper
[*] PAL Spyware Remover
[*] Spyware Stormer
[*] PS Guard
[*]AdwareAlert (url: http://www.spyware-blitz.com/). Please don't go to this website.
P2P Software
[*]LimeWire
[*]Kazaa (Especially this)
Be careful when downloading via P2P!
List of Do Not Go sites:
[*]Software crack sites/keygen sites like:
[*]www.cracks.am
[*]www.seriall.com
[*]www.thebugs.ws
[*]www.seriall.ws
[*]Pirated MP3/video/software sites
[*]Game cheat/hack web sites
[*]Pornography web sites (haha )
When visiting untrusted sites,
[*]Disable Java, Javascript, all plug-ins and all external content. Opera 8 users will find this easier to do -- simply hit F12 and uncheck the five checkboxes. Opera 9.0 TP2 users hit F12 and select Block Content.
[*]Make sure you have real-time spyware protection, like the Windows Antispyware one.
[*]Set your firewall level to High.
[*]Make sure you patch Windows with latest updates from here. Beware of fake "Windows Update" sites! The exact one is http://update.microsoft.com/
When you have an infection,
[*]Scan using all antispyware (update definitions first)
[*]Block spyware from accessing Internet using firewall. Best is avoid Internet connections unless necessary.
[*]Do Not click on any popups that claims to help you clean out spywares/adwares or improve your computer's performance. All these are spywares/adwares. If you are unsure whether the anti-spyware is genuine, please ask. We will try to help you find out more.
[*]If cannot be removed, download Process Explorer and HijackThis just in case. Unzip the ZIP files onto your desktop.
[*]Post the following:
[*]Name of spyware (if available)
[*]What it does (add toolbars? popups?)
[*]Screenshot of its damage
[*]Screenshot of Task Manager's "Processes" list (For Windows 2000 users and above)
[*]Run HijackThis, do a system scan with log and post the generated log file here
[*]Follow all instructions by moderators!
FAQ
[*]Why ZoneAlarm 6 in the "Do Not Use" list?
Because ZoneAlarm 6 spies on the user's movement and sends the information back to Zone Labs -- just like spyware. It's not critical to switch to ZA5.5, but if you don't want people to know you surf porn... Refer to the other thread.
[*]Why avoid Internet connections?
Some spyware will download updated versions which are harder to remove. Also, they will contact their "mothership" for instructions (like to wreck your computer, steal sensitive data, keylog your PC) or sometimes download other trojans and viruses!
[*]Why follow Mod's instructions? Antispyware sure can remove one!
You are wrong... not all spyware can be removed. Some inject themselves into critical processes which cannot be ended. Some need a reinstallation/reformat to solve! So you need to listen to our advice on what to do next to dismantle the pest!
[*]Why use Firefox/Opera only?
You need not use the above two recommended; use any browser your trust. If you are unsure, use the ones we recommend/provide.
[*]Sorry I don't have a legit Windows... how to patch?!
You can enable Automatic Updates. Microsoft provides critical updates to all users regardless of fake/legit versions. To enable Automatic Updates right-click My Computer, select Properties, select Automatic Updates tab, and click Automatic.
Alternatively you can go to WinDiz Update which provide another means to patching, but releases patches much slower than Microsoft.
Another way is to buy legitimate Windows software.
[*]At any one time, only have one antivirus installed. -
As of now, only ZoneAlarm is free. The rest have been bought over by some companies and are no longer free.Originally posted by davidche:which firewalls r free?? -
yeah....the other time when i went to a site saying free serial numbers it was tagged with viruses..........damn.....i had my PC infected with the virus.........it was planted into my PC...........system slow down......task manager LOCKED......so instantly i knew it was infected........formatted it and wha lah........done....gone with the virus.......
-
may i know whether my norton antivirus's and spyware doctor's real time protection can be used together.
I wish this qn can be answered by a it expert(the moderator) -
Antivirus and anti-spywares although are the same technically, they look out for different things.Originally posted by davidche:may i know whether my norton antivirus's and spyware doctor's real time protection can be used together.
I wish this qn can be answered by a it expert(the moderator)
You can use them safely together. However, no 2 antivirus should be working at the same time. 2 anti-spywares can work together at the same time, it's not a problem. -
Can somebody check mine for me...?
I have yet to settle my spyware problem after so long...
Logfile of HijackThis v1.99.1
Scan saved at 9:14:00 PM, on 5/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\HP_Owner\Desktop\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q105&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.my.yahoo.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q105&bd=pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q105&bd=pavilion&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DPCUpdater Object - {61C07AF3-01A3-4B85-ADB2-4EFD04E1286C} - C:\WINDOWS\system32\jkklk.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {2B866353-E598-4403-8E4D-B871AB30DC55} (Speed Class) - http://www.pacific.net.sg/articles/files/112004/attachments/file21ra4mh.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/activex/EPUWALControl_v1-0-3-18.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
O16 - DPF: {E56347B0-6C2B-4C2E-939F-EE513EAC80BC} (Creative Product Registration ActiveX Control Module) - http://www.creative.com/register/OCXs/CtORWebClientNoMFC.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -
To MooKu:
O2 - BHO: DPCUpdater Object - {61C07AF3-01A3-4B85-ADB2-4EFD04E1286C} - C:\WINDOWS\system32\jkklk.dll
Remove this
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE Remove this
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab Remove this
Refer to http://www.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=ADW%5FPOP%2EA
O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll You may need to remove this. Before that do a search for the following registry keys.
1) Go to Start, Run and type regedit.
2) Press Ctrl + F.
3) Copy this key and click Find.
20D57A66-F7DF-467D-907B-9B7F4A118AB7
If this key is found, refer to http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe to remove. -
Wow that's alot.Originally posted by ndmmxiaomayi:To MooKu:
O2 - BHO: DPCUpdater Object - {61C07AF3-01A3-4B85-ADB2-4EFD04E1286C} - C:\WINDOWS\system32\jkklk.dll Remove this
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE Remove this
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab Remove this
Refer to http://www.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=ADW%5FPOP%2EA
O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll You may need to remove this. Before that do a search for the following registry keys.
1) Go to Start, Run and type regedit.
2) Press Ctrl + F.
3) Copy this key and click Find.
20D57A66-F7DF-467D-907B-9B7F4A118AB7
If this key is found, refer to http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe to remove.
Ok I'll work on it now... hmmm... by "remove", do you mean just delete by pressing the "DELETE" key? And when I perform the deletion, do I have to turn off System Restore (that's what I saw when I was browsing other forums some time back)? -
For all these:Originally posted by MooKu:Wow that's alot.
Ok I'll work on it now... hmmm... by "remove", do you mean just delete by pressing the "DELETE" key? And when I perform the deletion, do I have to turn off System Restore (that's what I saw when I was browsing other forums some time back)?
O2 - BHO: DPCUpdater Object - {61C07AF3-01A3-4B85-ADB2-4EFD04E1286C} - C:\WINDOWS\system32\jkklk.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
Start HijackThis.
Select None of the options. Start the scan.
Find the above 3 and ticked them. After that, clicked on Fix checked.
For the one about registry, it would be recommended that you go to Safe Mode. There's no need to turn off System Restore unless you are some software to remove it. -
Okay I have removed all those in red as instructed, via HijackThis.Originally posted by ndmmxiaomayi:For all these:
O2 - BHO: DPCUpdater Object - {61C07AF3-01A3-4B85-ADB2-4EFD04E1286C} - C:\WINDOWS\system32\jkklk.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
Start HijackThis.
Select None of the options. Start the scan.
Find the above 3 and ticked them. After that, clicked on Fix checked.
For the one about registry, it would be recommended that you go to Safe Mode. There's no need to turn off System Restore unless you are some software to remove it.
For the one about the registry, are you referring to the green one or the blue one below? I'm in Normal mode now, and I just ran a search in the registry for the value in blue, and nothing is found.
Regarding the one in green, I've removed it via HijackThis, so do I still have to delete the registry values according to the info on the Trend Micro website?Originally posted by ndmmxiaomayi:To MooKu:
O2 - BHO: DPCUpdater Object - {61C07AF3-01A3-4B85-ADB2-4EFD04E1286C} - C:\WINDOWS\system32\jkklk.dll Remove this
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE Remove this
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab Remove this
Refer to http://www.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=ADW%5FPOP%2EA
O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll You may need to remove this. Before that do a search for the following registry keys.
1) Go to Start, Run and type regedit.
2) Press Ctrl + F.
3) Copy this key and click Find.
20D57A66-F7DF-467D-907B-9B7F4A118AB7
If this key is found, refer to http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe to remove. -
The blue one.