Spyware/Adware Infection Precaution Advisory
-
Okay all done.Originally posted by ndmmxiaomayi:The blue one.
As in, the blue one cannot find in registry.
The green one also cannot find the values (as stated by Trend Micro) in the registry.
So for now all done... hmm I surf around a bit more and see if anything happens. -
If it is not found, it cannot be deleted. That means it's required.Originally posted by MooKu:Okay all done.
As in, the blue one cannot find in registry.
The green one also cannot find the values (as stated by Trend Micro) in the registry.
So for now all done... hmm I surf around a bit more and see if anything happens.
Try using anti-spywares and antivirus to scan to see what else is wrong. Remember to update your anti-spywares and antivirus before scanning. -
Mmm okay now the pop-ups like these have stopped popping out...
But, I still get pop-up windows leading to sites like this :
http://www.winantiviruspro.com/pages/newcontent/?aid=nm_ap_wavkey_r1&lid=keyin
and to some casino site etc...
!!!NEWSFLASH!!!
omg. The window is popping out again, asking me to download ErrorSafe. -
Try this:
Print out the instructions first.
http://www.symantec.com/avcenter/venc/data/errorsafe.html
http://www.remove-errorsafe.org/
Apparently, the Bloodhound thingy is developed by Symantec. You are supposed to remove it yourself, not some programs.
http://www.symantec.com/avcenter/venc/data/bloodhound.html -
Another fake anti-spyware
Titan Anti-spyware
It's official home: titanantispyware.com/home.htm
Titan Shield Program
Fake Windows Security Center above. Windows Security Center can be accessed from Start > Control Panel > Security Center
Fake security alert
You will need SmitFraudFix to fix it.
If you do a HijackThis scan, these entries would appear:
O2 - BHO: (no name) - {00000000-59D4-4008-9058-080011001200} - (no file)
O2 - BHO: (no name) - {00000000-C1EC-0345-6EC2-4D0300000000} - (no file)
O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file)
O2 - BHO: adobepnl.ADOBE_PANEL - {2513A321-CB50-4C5F-91C5-80342AFACFB1} - C:\WINDOWS\System32\adobepnl.dll
O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} - (no file)
O2 - BHO: (no name) - {7b55bb05-0b4d-44fd-81a6-b136188f5deb} - (no file)
O2 - BHO: (no name) - {8333c319-0669-4893-a418-f56d9249fca6} - (no file)
O2 - BHO: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file)
O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file)
O2 - BHO: (no name) - {ffd2825e-0785-40c5-9a41-518f53a8261f} - (no file)
O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\System32\runsrv32.exe
O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\System32\susp.exe
O4 - Startup: titanshield.lnk = C:\Program Files\TitanShield Antispyware\titanshield.exe
Using SmitFraudFix
1) Extract SmitFraudFix.zip to your desktop
2) Restart your computer in Safe Mode
3) Close any open programs and open the SmitFraudFix folder
4) Double-click on the SmitfraudFix.cmd file, as shown in the image above, to start the removal process
5) When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screenYou will now see a menu as shown in the image below. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
6) You will now see a menu as shown in the image below. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
7) The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program. This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will should continue with step 8
8 ) When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the enter key.
9) When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.
10) Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer. Post this log for experts to analyse. -
may i know is NewDotNet a threat?
-
Not too much of a threat, is considered an irritating program by many experts.Originally posted by twiggies:may i know is NewDotNet a threat?
However, attempting to fix NewDotNet without experts helping will damage internet connections at the Winsock layer, resulting in you not being able to connect to the Internet. -
Originally posted by ndmmxiaomayi:Not too much of a threat, is considered an irritating program by many experts.
However, attempting to fix NewDotNet without experts helping will damage internet connections at the Winsock layer, resulting in you not being able to connect to the Internet.
ohh.. thanks 
-
-
New fake anti-spyware found, it goes by the name of VirusBurst.
Removal instructions from Bleeping Computer
More details: http://www.bleepingcomputer.com/securityblog/2006/08/31/virusburst-rogue-antispyware/
Edit: Newer updates to this variant, it seems to be linked to a rootkit named Gromozon.
Gromozon is the latest baddie in the security field, and it disables almost every tool available against it. This means F-Secure Blacklight, Sophos Anti-rootkit, Gmer, Icesword and Avenger barely works. The only removal tool that seems to be able to work is Prevx1 Gromozon Rootkit Removal, available here. There appears to have some errors while running this tool, so just be careful when using it.
Full details for this variant
By the way, no matter what browser you use, you will be attacked. I think Internet Explorer users may have a higher chance of escaping this, by not accepting any ActiveX downloads. Perhaps the only good news for IE users.
PDF writeup for Gromozon
Hmm... playing with some addons of Firefox and it's quite good if you are worried about getting it.
https://addons.mozilla.org/firefox/722/
http://www.extensionsmirror.nl/lofiversion/index.php/t5083.html
https://addons.mozilla.org/firefox/1237/ -
ZoneAlarm 5.5 can't be found leh. The link provided leads to an Oops site on pcworld.
-
http://www.oldversion.com/program.php?n=zalarmOriginally posted by dahliamorie:ZoneAlarm 5.5 can't be found leh. The link provided leads to an Oops site on pcworld.
Scroll down and select version 5.5 -
McAfee Reports Adware and Spyware Growth
SINGAPORE -- 12 September 2006 -- McAfee, Inc. today reported that the prevalence of adware and spyware is increasing at an exponential rate and the most prolific distributors of adware are star/celebrity Web sites. In a white paper entitled “Adware and Spyware: Unraveling the Financial Web”, McAfee Avert Labs highlights the financial incentives fueling the rise of adware and spyware, and culprits behind the problem. The paper is available at: http://www.mcafee.com/us/threat_center/default.asp.
McAfee research shows that adware and spyware distributors abuse the affiliate marketing programs of legitimate companies. In addition, adware distributors use front companies and web sites to reach unsuspecting users and intermediaries, meaning that legitimate sites are finding themselves tied to known spyware distributors. Programs then install themselves on a user’s machine, often as the trade-off for a piece of “free” software, and are used to collect marketing data and distribute targeted advertising.
Key research findings include:
* Celebrities are a bigger lure than sex. The most prolific distributors of adware are star/celebrity Web sites – not the commonly believed adult and pornography web sites, according to McAfee SiteAdvisor.
* The prevalence of adware and spyware is increasing at an exponential rate. By August 2006, there were approximately 450 adware families with more than 4,000 variants.
* A recent survey by McAfee SiteAdvisor found that 97 percent of Internet users could not differentiate safe from unsafe sites, meaning that the majority of users are just one click away from downloading potentially unwanted programs.
* The adware business model is lucrative. A recent criminal indictment alleged that Jeanson James Ancheta, a convicted bot-herder, received US$150 per each 1,000 infected computers.
“The emergence of lucrative online affiliate-marketing business models and the widespread ease with which adware and spyware can be spread have made them prominent features in the threat landscape,” said Jeff Green, senior vice president of product development, McAfee, Inc. “Since 2003, when adware and spyware emerged as dominant threats in the security environment, to 2006, we have seen the number of adware families rise by more than 1,000 percent, demonstrating a sharp increase.”
The paper also highlights the confusion merchants and consumers face surrounding spyware and adware, and the blurred boundaries between malicious, unwanted programs and friendly software.
To learn more about adware, spyware, and the top potentially unwanted programs rated by McAfee, visit the McAfee Threat Center: http://www.mcafee.com/us/threat_center/default.asp. -
my office installed F-Secure Anti Virus for me.
If I use it to scan my lappie, will it detect and remove any spyware that i may originally have in my lappie?
or do i need a separate anti-spyware programme?
(I noticed that this F-Secure has blocked a few simi simi wares with its firewall......... so last time when i was using AVG, dunno got any wares managed to come in or not, since i never had notification of "wares" being blocked) -
Antivirus usually will remove viruses. They are almost useless against spywares. A separate anti-spyware program would be good.Originally posted by TehJarVu:my office installed F-Secure Anti Virus for me.
If I use it to scan my lappie, will it detect and remove any spyware that i may originally have in my lappie?
or do i need a separate anti-spyware programme?
(I noticed that this F-Secure has blocked a few simi simi wares with its firewall......... so last time when i was using AVG, dunno got any wares managed to come in or not, since i never had notification of "wares" being blocked)
AVG by itself is only an antivirus, so you won't get any notification if anything comes in, unless you set it to scan your emails, both incoming and outgoing. Then you will know whatever that is coming and going out.
F-Secure has a firewall that is integrated with their security suite. So they will prompt you every time. Whether incoming or outgoing. -
so what programme to use to see if i have spyware in my laptop or not?Originally posted by ndmmxiaomayi:Antivirus usually will remove viruses. They are almost useless against spywares. A separate anti-spyware program would be good.
AVG by itself is only an antivirus, so you won't get any notification if anything comes in, unless you set it to scan your emails, both incoming and outgoing. Then you will know whatever that is coming and going out.
F-Secure has a firewall that is integrated with their security suite. So they will prompt you every time. Whether incoming or outgoing. -
Free ones include Spybot S&D, Lavasoft Ad-Aware, Ewido and a-squared free.Originally posted by TehJarVu:so what programme to use to see if i have spyware in my laptop or not?
Ewido has a real time monitoring function for the full version. The limited version, which is free, will scan and remove spywares and other things found. When you download and install Ewido for the first time, you will be using the full version. Once it expires (30 days), it will turn into a limited version.
Spybot S&D: http://www.safer-networking.org/
Lavasoft Ad-Aware: http://www.lavasoft.com/
Ewido: http://www.ewido.net/
a-squared Free: http://www.emsisoft.com/
You can have more than one anti-spyware. -
wow thanks... they themselves confirm no spy/ad ware one hor?Originally posted by ndmmxiaomayi:Free ones include Spybot S&D, Lavasoft Ad-Aware, Ewido and a-squared free.
Ewido has a real time monitoring function for the full version. The limited version, which is free, will scan and remove spywares and other things found. When you download and install Ewido for the first time, you will be using the full version. Once it expires (30 days), it will turn into a limited version.
Spybot S&D: http://www.safer-networking.org/
Lavasoft Ad-Aware: http://www.lavasoft.com/
Ewido: http://www.ewido.net/
a-squared Free: http://www.emsisoft.com/
You can have more than one anti-spyware. -
Yup, tried and tested. All working well with my PC.Originally posted by TehJarVu:wow thanks... they themselves confirm no spy/ad ware one hor? 
-
ok thanks!Originally posted by ndmmxiaomayi:Yup, tried and tested. All working well with my PC. -
New Rogue Anti-Spyware
PestCapture
Screenshot
The GiveawayShop safely at www.pestcapture.com with the PestCapture 100% satisfaction guarantee. If for any reason you are not happy with your purchase, simply contact our customer support staff within 30 days, and we will refund 100% of the purchase price with no questions asked. At www.spysheriff.com your security and satisfaction come first. If you're unhappy, we're unhappy and we'll make sure that won't happen.
I like the red part best. PestCapture or Spysheriff?
Anyway, Spysheriff is a known rogue anti-spyware.
http://www.spywarewarrior.com/rogue_anti-spyware.htm
Removing Spysheriff
Don't think there's any fix for it yet. In the meanwhile, keep your fingers crossed. Anybody interested to play, please visit www.pestcapture.com -
Note: If you tried to update, yet get a no definitions are found error, please download and install them manually.
Lavasoft Ad-Aware- [*]Download the latest definition from here.
[*]Save it to your desktop.
[*]Extract the definitions from this zip file to where you installed Ad-Aware. By default, this location is C:\Program Files\Lavasoft\Ad-Aware SE Personal.
[*]When it prompts you to replace this file, select Yes.
[*]Now load Ad-Aware. You should see that your definitions files is EXPORTED.
Spybot Search & Destroy- [*]Download the latest definition from here.
[*]Save it to your desktop.
[*]Run the installation file.
[*]Spybot should detect where you installed Spybot Search & Destroy. If it doesn't detect the correct location, please navigate to the correct location.
[*]After this, load Spybot. Click Help > About. You should see these words: Latest detection update: 2006-10-06.
[*]Now click on the Immunize button on the left hand side. Look at the top of the page. Click the Green + button with the word Immunize.
AVG Anti-Spyware- [*]Download the latest definition from here.
[*]Save it to your desktop.
[*]Run the installation. AVG Anti-Spyware should detect where you installed AVG Anti-Spyware. If it doesn't detect the correct location, please navigate to the correct location.
[*]After this, start AVG Anti-Spyware. You should see that you have 449,202 threats in the Signatures in database section. -
I really need help here,there website automaticly popup at some time interval and later my com become extremely lag.
I have follow instruction here using updated version of avg anti virus,spyware doctor , spybot as well as ad-aware se personal to scan and remove them but the problem still occur.Hence i decided to use hijack this n the log file is as follow
Logfile of HijackThis v1.99.1
Scan saved at 2:07:49 PM, on 10/16/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\gearsec.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SteelBytes\PortTunnel\PortTunnel.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Share10_ex2\Share.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\SNDVOL32.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ringz Studio\Storm Codec\mplayerc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgwb.dat
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q304&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamefaqs.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q304&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\Program Files\winrar\msn.com
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINCINEMAMGR] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [lntrenat] C:\WINDOWS\lntrenat.exe
O4 - HKCU\..\Run: [MtdAcq] C:\Program Files\Creative\Shared Files\Media Sniffer\MtdAcq.exe /s
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer\Add_AllO.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mkls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mkls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mkls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mkls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mkls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mkls.dll
O20 - AppInit_DLLs: 608769M.BMP
O20 - Winlogon Notify: atgmt - atgmt.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PortTunnel - Unknown owner - C:\Program Files\SteelBytes\PortTunnel\PortTunnel.exe" /RUN_SERVICE (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
Really needed help,thanks in advance -
Some updates to PestCapture.
AVG Anti-Spyware, Spybot Search & Destroy and Lavasoft Ad-Aware are able to remove it.
However, it takes a few times to remove them all.
For each time you remove them, restart your computer. Update, scan and remove. Repeat this process until the programs give you the all clear signal. -
Removal Tools from Lavasoft
Virtumonde removal tool
This tool is to be used when Lavasoft Ad-Aware detects Virtumonde infections in your PC.- [*]Download the Virtumonde Remover.
[*]Extract the zip archive. Double-click the “.exe” file to activate the remover tool.
[*]Accept the EULA.
[*]Choose “Scan.” If any targets are found you will be asked to neutralize. If you wish to do this, select “Neutralize.” Once this is complete, the program will check if a reboot is recommended, and if so, you will have the option to do so immediately.
Aries Rootkit removal tool
Over protection of singers lead to this. Dumb Sony incorporated this rootkit protection software to hide their DRM software. Attackers can then make use of this rootkit to hide whatever software that they are trying to run.
If you bought any Sony BMG CDs between 2005 and 2006, please check.- [*]Download the ARIES Rootkit Remover.
[*]Back up all critical data files and close any open applications.
[*]Select “AriesRemover.exe” to activate the tool.
[*]Select “Perform Scan.”
[*]In the confirmation window, select the option to confirm your approval, and then select “Proceed.” The tool will begin to search for certain indicators that reveal the presence of the rootkit on your system.
[*]If the tool does not detect the rootkit, a green checkmark will appear beside the rootkit indicators on the application screen. If the rootkit is detected, a red cross will appear by the rootkit indicators.
[*]If the remover tool detects the rootkit, select the “Clean” button.
[*]When the cleaning is complete, select “Reboot” to restart your computer.
Note: Try listening to any Sony BMG CDs and run the removal tool again. If you received "ARIES rootkit module detected" again after listening to it, email to Lavasoft at: research at lavasoft dot com (replace "at" with "@" , "dot" with "." and type in the email address with no spaces). Email address is purposely written this way to prevent spamming.
Look2Me removal tool
This tool is to be used when Lavasoft Ad-Aware detects Look2Me during scanning.- [*]Download the Look2Me Removal Tool.
[*]Extract the zip archive. This will create a folder named "Look2Me Removal Tool.”
[*]Go to the folder, and double-click on the icon for the Look2Me Removal Tool.exe.
[*]If the remover fails to get the needed permission, it will inform you, then close automatically and restart after one minute. If this happens, click OK, wait for one minute, and the program should launch again.
[*]Agree to the EULA.
[*]Choose “Scan.” If the remover finds Look2Me, select “Neutralize” to kill all Look2Me processes and restore the user accounts. Then restart your computer.
[*]After you restart your computer, run Ad-Aware SE to remove all files. (This is optional.)
[*]Scan again to confirm that the system is clean.
VX2 removal tool
This tool is to be used when Lavasoft Ad-Aware detects VX2 during scanning.- [*]Before running the VX2 Cleaner, close all anti-virus or anti-spyware applications.
[*]Run the VX2 Cleaner. If your computer is infected with VX2, a dialog box saying “New VX2 variant found” or “VX2 variant 1 found” will appear.
[*]Select "Clean" and a dialog box saying “The first phase is complete. Please reboot and perform a Smart Scan" will appear. After saving your work, reboot your system manually.
[*]Repeat this until the VX2 Cleaner reports “System clean.” Select “Close” to exit.
Win32 Pipeline removal tool
Seems to affect AOL clients. If you receive a message from your firewall or antivirus that AOL is sending something when you are not, you are probably infected.- [*]Download the Win32.Pipeline Remover.
[*]Extract the zip archive. Double-click the “.exe” file to activate the remover tool.
[*]Accept the EULA.
[*]Choose “Scan.” If any Pipeline targets are found, select “Quarantine” to put the files in a quarantine folder. The application will advise you where the quarantine is located.
