Help! My Comuter Kena Spyware!

• SBS1985C

  17 Jul 06, 10:04

  My computer kena Spyware. One of them I know it as Brave Sentry. How do I remove them?
  
  Here is my logfile. I hope I did not miss out any.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 1:05:49 AM, on 7/17/2006
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\WINDOWS\System32\scrovfpo.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\system32\cleanmgr.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Documents and Settings\Scania Volvo\Desktop\hijackthis\HijackThis.exe
  
  R3 - Default URLSearchHook is missing
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [rpcc] rpcc.exe
  O4 - HKLM\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe
  O4 - HKLM\..\Run: [Explorer 2238] C:\WINDOWS\System32\dxvwjuvk.exe
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe
  O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\SCANIA~1\LOCALS~1\Temp\28.tmp3072.exe
  O4 - HKCU\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe
  O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll
  O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
  O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe
  O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\WINDOWS\System32\lolfacga.dll
  O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_27.dll
  O21 - SSODL: VtjQKRFnSKcN - {305EFB84-9AF4-512E-6F39-5A4861C58094} - C:\WINDOWS\System32\yaes.dll
  O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
  --------------
  Spy Sweeper.
  
  9:21 PM: | Start of Session, Sunday, July 16, 2006 |
  9:21 PM: Spy Sweeper started
  9:21 PM: Sweep initiated using definitions version 719
  9:21 PM: Found Trojan Horse: trojan-backdoor-cyn
  9:21 PM: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\artm_newreg\ || dllname (ID = 1532249)
  9:21 PM: artm_new.dll (ID = 1532249)
  9:21 PM: Found Trojan Horse: trojan-backdoor-msdcom32
  9:21 PM: HKCR\clsid\{2c1cd3d7-86ac-4068-93bc-a02304bb2236}\inprocserver32\ (2 subtraces) (ID = 1532296)
  9:21 PM: 2236_27.dll (ID = 1532296)
  9:21 PM: Found Trojan Horse: trojan-downloader-evko.biz
  9:21 PM: HKLM\software\microsoft\windows\currentversion\run\ || system (ID = 1532301)
  9:21 PM: testtestt.exe (ID = 1532301)
  9:21 PM: Found Trojan Horse: trojan-backdoor-securemulti
  9:21 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || taskdir (ID = 1220571)
  9:21 PM: taskdir.exe (ID = 1220571)
  9:21 PM: Found Trojan Horse: trojan-backdoor-adagoe
  9:21 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || winmedia (ID = 1374371)
  9:21 PM: 28.tmp3072.exe (ID = 1374371)
  9:21 PM: Starting Memory Sweep
  9:22 PM: Detected running threat: C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll (ID = 425)
  9:25 PM: Memory Sweep Complete, Elapsed Time: 00:04:22
  9:25 PM: Starting Registry Sweep
  9:34 PM: Found Adware: bravesentry
  9:34 PM: HKLM\software\microsoft\windows\currentversion\uninstall\bravesentry\ (5 subtraces) (ID = 1198509)
  9:34 PM: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\artm_newreg\ (4 subtraces) (ID = 1499383)
  9:34 PM: HKCR\clsid\{2c1cd3d7-86ac-4068-93bc-a02304bb2236}\ (3 subtraces) (ID = 1531605)
  9:34 PM: HKLM\software\classes\clsid\{2c1cd3d7-86ac-4068-93bc-a02304bb2236}\ (3 subtraces) (ID = 1531609)
  9:34 PM: HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload\ || dcom server 2236 (ID = 1531611)
  9:34 PM: HKLM\software\microsoft\windows\currentversion\run\ || system (ID = 153229
  9:34 PM: HKLM\software\microsoft\windows\currentversion\runservices\ || systemtools (ID = 1532300)
  9:34 PM: HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler\ || {2c1cd3d7-86ac-4068-93bc-a02304bb2236} (ID = 1533943)
  9:37 PM: Found Adware: bravesentry fakealert
  9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || windows update loader (ID = 119843
  9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\bravesentry\ (12 subtraces) (ID = 1198479)
  9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || bravesentry (ID = 1199973)
  9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || winmedia (ID = 1333205)
  9:40 PM: Registry Sweep Complete, Elapsed Time:00:14:41
  9:40 PM: Starting Cookie Sweep
  9:40 PM: Found Spy Cookie: atlas dmt cookie
  9:40 PM: scania volvo@atdmt[2].txt (ID = 2253)
  9:40 PM: Found Spy Cookie: 2o7.net cookie
  9:40 PM: scania [email protected][1].txt (ID = 195
  9:40 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
  9:40 PM: Starting File Sweep
  9:42 PM: taskdir.exe (ID = 321110)
  9:42 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run || taskdir (ID = 0)
  9:42 PM: desktop.html (ID = 258792)
  9:43 PM: Found Adware: spysheriff fakealert
  9:43 PM: vxt4.game (ID = 242074)
  9:43 PM: Found Trojan Horse: trojan-downloader-asdbiz.biz
  9:43 PM: vxgamet4.exe (ID = 80237)
  9:43 PM: 2.dlb (ID = 318284)
  9:44 PM: dlh9jkdq2.exe (ID = 318284)
  9:44 PM: qvxt2.game (ID = 80237)
  9:44 PM: qvxgamet2.exe (ID = 80237)
  9:44 PM: qvxt4.game (ID = 80237)
  9:44 PM: desktop.htt (ID = 321134)
  9:44 PM: qvxgamet4.exe (ID = 80237)
  9:44 PM: vxgamet1.exe (ID = 273845)
  9:44 PM: ipod[1].raw (ID = 321110)
  9:44 PM: vxgamet3.exe (ID = 318419)
  9:44 PM: vxt1.game (ID = 290922)
  9:44 PM: Found Trojan Horse: rsysinit
  9:44 PM: rsysinit.exe (ID = 119324)
  9:45 PM: xpupdate.exe (ID = 318284)
  9:45 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run || Windows update loader (ID = 0)
  9:45 PM: vx3.game (ID = 80237)
  9:45 PM: vxgame3.exe (ID = 80237)
  9:45 PM: Found Trojan Horse: trojan-backdoor-satellite
  9:45 PM: thematrixhasyou.exe (ID = 28733
  9:45 PM: Found Trojan Horse: trojan-downloader-game4all.biz
  9:45 PM: vx4.game (ID = 311176)
  9:45 PM: vx6.game (ID = 80237)
  9:45 PM: vxgame6.exe (ID = 80237)
  9:45 PM: testtestt.exe (ID = 318419)
  9:45 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || System (ID = 0)
  9:45 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices || SystemTools (ID = 0)
  9:46 PM: qvxt3.game (ID = 32117
  9:46 PM: ipod.raw.exe (ID = 321110)
  9:46 PM: _zskwrkni05ldlagbpjq^caw]he.dll (ID = 319296)
  9:46 PM: taskdir.dll (ID = 271080)
  9:46 PM: _zskwrkni05`lbqwk`k`xw[^cje.dll (ID = 319296)
  9:46 PM: _zskwrkni05jobftohgk_qse]vd.dll (ID = 319296)
  9:47 PM: _zskwrkni05vg^gcupay^hfn_`x.dll (ID = 319296)
  9:49 PM: Found Trojan Horse: trojan-backdoor-agegalaxy
  9:49 PM: yaes.dll (ID = 29469
  10:22 PM: desktop.html.lnk (ID = 258792)
  10:22 PM: File Sweep Complete, Elapsed Time: 00:41:43
  10:22 PM: Full Sweep has completed. Elapsed time 01:01:01
  10:22 PM: Traces Found: 91
• mhcampboy

  17 Jul 06, 10:06

  see la!! surf porn too much!!
  
  now must wait for miss ant to come and advice u..
• rathcycle

  17 Jul 06, 10:15

  Originally posted by mhcampboy:

  see la!! surf porn too much!!
  
  now must wait for miss ant to come and advice u..

  no need sirf porn also will tio 1.... anyhow download stuffs lor...
• MosPosterior

  17 Jul 06, 10:32

  Hahaha... Finally your turn liao...
  
  Your com si bei juay torjon... one of them is rpcc...
  Remove these things...
  O4 - HKLM\..\Run: [rpcc] rpcc.exe
  O4 - HKLM\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe
  O4 - HKLM\..\Run: [Explorer 2238] C:\WINDOWS\System32\dxvwjuvk.exe
  O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe
  O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe
  O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\SCANIA~1\LOCALS~1\Temp\28.tmp3072.exe
  O4 - HKCU\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe
  O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe
  O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll
  O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll
  O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe
  O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\WINDOWS\System32\lolfacga.dll
  O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_27.dll
  O21 - SSODL: VtjQKRFnSKcN - {305EFB84-9AF4-512E-6F39-5A4861C58094} - C:\WINDOWS\System32\yaes.dll
  O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe
  
  Edit: Spyware Doctor is not spyware.
• ndmmxiaomayi

  17 Jul 06, 10:40

  O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe
  
  Solving Brave Sentry
  
  Follow the instructions in the above site. If it doesn't work, then do the manual way as stated below.
  
  C:\WINDOWS\System32\scrovfpo.exe
  R3 - Default URLSearchHook is missing
  O4 - HKLM\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe
  O4 - HKLM\..\Run: [Explorer 2238] C:\WINDOWS\System32\dxvwjuvk.exe
  O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\SCANIA~1\LOCALS~1\Temp\28.tmp3072.exe
  O4 - HKCU\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe
  O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll
  O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll
  O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
  O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe
  O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\WINDOWS\System32\lolfacga.dll
  O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_27.dll
  O21 - SSODL: VtjQKRFnSKcN - {305EFB84-9AF4-512E-6F39-5A4861C58094} - C:\WINDOWS\System32\yaes.dll
  O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe
  
  Tick these entries and click Fix Checked.
  
  O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe
  O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe
  
  Solve testtestt.exe. Select the Advanced tab. Follow the instructions there.
  
  O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
  
  Solve xpupdate.exe. Again, click on the Advanced tab and follow instructions.
  
  To update your XP, go to Start, All Programs, Windows Update. It's at the top.
  
  As for the Webroot Spysweeper log, did you try using the program to clear anything that was found?
• ndmmxiaomayi

  17 Jul 06, 10:42

  Originally posted by mhcampboy:

  see la!! surf porn too much!!
  
  now must wait for miss ant to come and advice u..

  Don't think he surfed porn. More like he tio conned, because he never patch his system.
• davidche

  17 Jul 06, 19:49

  Originally posted by mhcampboy:

  see la!! surf porn too much!!
  
  now must wait for miss ant to come and advice u..

  ant is a female??
• ndmmxiaomayi

  17 Jul 06, 19:50

  Originally posted by davidche:

  ant is a female??

  Yes? I thought the Profile link is so prominent?
• alexkusu

  17 Jul 06, 19:55

  is that iveco?
• ndmmxiaomayi

  17 Jul 06, 19:56

  Originally posted by alexkusu:

  is that iveco?

  What has iveco got to do with spywares?
• alexkusu

  17 Jul 06, 19:58

  Originally posted by ndmmxiaomayi:

  What has iveco got to do with spywares?

  they are both annoying
• ndmmxiaomayi

  17 Jul 06, 20:01

  Originally posted by alexkusu:

  they are both annoying

  
  
  Indeed. I think elindra's description of him can change liao.
  
  Ok, no more jokes. Where's SBS1985C? Too jialat until cannot online?
• Rejected

  17 Jul 06, 20:04

  update your Service Pack to SP2 if your computer is currently running on SP1, update your Anti-Virus programme. If the problem still persist, you have no choice but to reboot your computer.
  
  cheers mate.
• alexkusu

  17 Jul 06, 20:05

  Originally posted by ndmmxiaomayi:

  
  
  Indeed. I think elindra's description of him can change liao.
  
  Ok, no more jokes. Where's SBS1985C? Too jialat until cannot online?

  no la, i mean..
  
  threadstarter = iveco clone?
• Rejected

  17 Jul 06, 20:06

  Spyware Doctor is a nono, the prog sucks to the core. lags the shit out of your PC.
• ndmmxiaomayi

  17 Jul 06, 20:09

  Originally posted by alexkusu:

  no la, i mean..
  
  threadstarter = iveco clone?

  Cannot be.... my sixth sense says so.
• alexkusu

  17 Jul 06, 20:16

  Originally posted by ndmmxiaomayi:

  Cannot be.... my sixth sense says so.

  this one no need 6th sense
  
  ask ditzy
• Rejected

  17 Jul 06, 20:19

  Originally posted by alexkusu:

  this one no need 6th sense
  
  ask ditzy

  
• ndmmxiaomayi

  17 Jul 06, 23:09

  Originally posted by alexkusu:

  this one no need 6th sense
  
  ask ditzy

  Like that is ask me for fun de ar? Waste my time doing research sia... if not I finish my school work long ago...
• SBS1985C

  18 Jul 06, 10:06

  Originally posted by ndmmxiaomayi:

  
  
  Indeed. I think elindra's description of him can change liao.
  
  Ok, no more jokes. Where's SBS1985C? Too jialat until cannot online?

  Spyware until cannot go online at home. Must go school and download these program.
• MosPosterior

  18 Jul 06, 10:10

  Originally posted by alexkusu:

  this one no need 6th sense
  
  ask ditzy

  Hahaha..
  
  To confirm is it iveco is easy...
  
  See whether he can online or not...
• ndmmxiaomayi

  18 Jul 06, 11:55

  Originally posted by SBS1985C:

  Spyware until cannot go online at home. Must go school and download these program.

  
  
  Try Safe Mode with networking options. It should allow you to access the Internet without the spywares bothering you.
• SBS1985C

  21 Jul 06, 22:42

  I gave up on my computer. Formatted everything.
  Thanks to those who helped me!