What are dummy.class and Verifier.class?

toxicgreen

thank you for looking at my post.
I have NAV 2002 all updated. I use adaware and Spy bot and Spy sweeper,
i cleaned those up. But my NAV says it cant fix the dummy and verifier.class
Is there a way to get rid of it? Thank you!!!!!!!!! Toxicgreen
i dont know if you need it but here is my HJT log:

Logfile of HijackThis v1.97.7
Scan saved at 10:52:36 PM, on 5/15/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\ltmsg.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\PROGRA~1\DATACA~1\FLashKsk.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\sysupd.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft Works\MSWorks.exe
C:\Program Files\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [DataCaching] C:\PROGRA~1\DATACA~1\FLashKsk.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/big/1.1.60-big/GoogleNav.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://sc.communities.msn.com/controls/chat/msnchat42.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/r/neutral/controls/MsnPUpld.cab?5,0,1730,0
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.logitech.com/companion/logitech/ver1.3.1.2083/bin/imvid.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A46FF49E-1C7A-4529-B97B-FE9132EAB2D7}: NameServer = 198.6.1.150 198.6.100.150
O17 - HKLM\System\CS1\Services\Tcpip\..\{A46FF49E-1C7A-4529-B97B-FE9132EAB2D7}: NameServer = 198.6.1.150 198.6.100.150

Kwitko

They could belong to a bunch of different things. I think they were at one time generic classes that have "turned to the Dark Side." I would try finding and deleting them manually, and as a backup, running a trojan scan.

Straight_Man

Mr. Kwitko wrote:

They could belong to a bunch of different things. I think they were at one time generic classes that have "turned to the Dark Side." I would try finding and deleting them manually, and as a backup, running a trojan scan.

There are a few ways to get rid of files manually.

Here's one trick I often use:

Make sure I am logged in as admin if I am looking into issues on a 2000 or XP box.

Use find or search to find the file.

RIGHT-CLICK on file. UNCHECK the archive and\or read-only boxes if checked.

Tell the little properties dialog ok (if apply button is there, I click that first).

Now, right click the file in the finder again.

Thid time, click (left button on mouse) on delete.

Some files will vaporize well this way.

.class is not a legal MIME type for Windows, it is used for Java 2 especially (even within Widnows, Java from Sun does not CARE what O\S is running much at all) and I have seen some things that are actually Javascript (J++ script) of Microsoft variety pretend to be Java. Most of these FAKE Java things that are not Java will be in folders or subfolders that do not have Java in the text of the path.

The real Java ones can be legitimate, but are typically in a folder that has j2re or j2se and\or Java in text showing where it is, or some folder inside a folder with that name in it. With .class type things, where they are can tell you probably if they are legit or not.

toxicgreen

Thank you for your replies!! I did the search for the file, but i guess it's not showing up because it's quaranteened in my NAV. Should i just delete from Norton quarenteen file? or restore and then try your trick.
thanks for taking time with me, it's appreciated, believe me.
Toxic

profdlp

toxicgreen wrote:

Should i just delete from Norton quarenteen file? or restore and then try your trick...

Delete from Quarantine. Otherwise you are just asking to get infected again.

Don't worry if Norton says it "can't repair the infected file". The only reason to try that is if you have a critical, irreplaceable document you need to save. Program files can always be replaced.

toxicgreen

profdlp wrote:

Delete from Quarantine. Otherwise you are just asking to get infected again.

Don't worry if Norton says it "can't repair the infected file". The only reason to try that is if you have a critical, irreplaceable document you need to save. Program files can always be replaced.

Thanks! YEEEHAWWW!! :celebrate
i did it, now my computer is clean clean clean!! For now....
Toxic