Any way to check if Windows\32 is working before turning computer off ?

littlejoelittlejoe
edited February 2008 in Spyware & Virus Removal
Hi, I was surfing yesterday and hit a website that caused my AVG free virus check to send up all these red flags saying my computer was infected. I ran a scan and according to AVG, all parasites are now quarenteened. However, when I checked virus details afterwards, they had nearly all the same info:

Object path: Windows\system32
Healable: No
Source: Backup copy
Status: Infected

I have been afraid to turn the computer off because it sounds like when I do, i'll not be able to restart it. My friend got the dreaded "Windows\system32\config is in error or corrupt etc. It sounds like I'll have the same problem if I turn the computer off.

Is there any way of checking whether my Windows\system32 folder is in fact damaged? If it is, how can I fix it?

I am a complete computer newbie and I apologize in advance but any advice would have to be VERY simply given as if addressing a child! I've browsed other forums and not understood the advice given.

Thank you SO much. I really appreciate any help.

Joseph

I was wonder

Comments

  • littlejoelittlejoe
    edited January 2008
    forgot to add that I'm running Windows XP

    Thanks again.

    Joseph
  • TroganTrogan London, UK
    edited February 2008
    I've never known a folder to be infected, but a file inside could be.

    Download HJTInstall.exe to your Desktop.
    • Doubleclick HJTInstall.exe to install it.
    • By default it will install to C:\Program Files\Trend Micro\HijackThis .
    • Click on Install.
    • It will create a HijackThis icon on the desktop.
    • Once installed, it will launch Hijackthis.
    • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    • Save the log to a convenient location as you'll need to post it soon.
    • Don't use the Analyse This button, its findings are dangerous if misinterpreted.
    • Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
    Post the HijackThis log back here.
  • littlejoelittlejoe
    edited February 2008
    Thank you very much Trogan. I am doing what you suggested now. Thank you again!!!!

    PS: I take your point about the folder itself not being infected. I meant one of the files inside although I didn't phrase that right.
  • littlejoelittlejoe
    edited February 2008
    Hello Trogan. This is the log. Thank you once again for looking at this for me.

    Joseph

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 6:48:13 PM, on 2/1/2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\WINDOWS\system32\tbctray.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Common Files\Teleca Shared\Generic.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\Program Files\BitTorrent\bittorrent.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://edit.europe.yahoo.com/config/mail?.intl=uk
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-21-2000478354-2111687655-1343024091-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User 'Sinead')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1191827645219
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194169109956
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    --
    End of file - 6716 bytes
  • TroganTrogan London, UK
    edited February 2008
    Hi Joseph,

    Nothing malicious is showing in the HijackThis log, but lets run some scans anyway.

    Please do the following...

    1. Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

    - Close ALL open windows (especially Internet Explorer!)
    - Click Fix Checked
    Close HiajckThis

    2. Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases
        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer
        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.
        3. I need to see another log from HijackThis.
        • Run Hijackthis.
        • Click on Open the Misc Tools section.
        • Next click on Open uninstall manager.
        • Press the Save list button.
        • Save the file to your desktop, with the default name of uninstall_list
        • Copy & Paste the entire contents of that file in your in your next post.
        4. Please post the following...

        Uninstall list
        Kaspersky report
        New HijackThis log
      • littlejoelittlejoe
        edited February 2008
        Hello Trogan,

        This did take some time, as you suggested it would. Here's what you requested.

        Uninstall List

        Adobe Flash Player ActiveX
        Adobe Flash Player Plugin
        Adobe Reader 8.1.1
        Adobe® Photoshop® Album Starter Edition 3.0
        AoA Audio Extractor 1.0
        Apple Software Update
        AVG 7.5
        AVG Anti-Spyware 7.5
        Dell ResourceCD
        FinePixViewer Ver.3.2
        FUJIFILM USB Driver
        getPlus(R)_ocx
        Google Toolbar for Internet Explorer
        Google Toolbar for Internet Explorer
        HijackThis 2.0.2
        ImageMixer VCD for FinePix
        Kaspersky Online Scanner
        Microsoft Internationalized Domain Names Mitigation APIs
        Microsoft National Language Support Downlevel APIs
        Microsoft Office Professional Edition 2003
        Microsoft Office Publisher 2003
        MicroStaff WINASPI
        Mozilla Firefox (2.0.0.11)
        Picasa 2
        QuickTime
        RealPlayer
        Security Update for Windows XP (KB923789)
        Sony Ericsson PC Suite
        Turtle Beach Santa Cruz Driver
        VideoLAN VLC media player 0.8.5
        Windows Internet Explorer 7
        WinRAR archiver

        KASPERSKY ONLINE SCANNER REPORT
        Friday, February 01, 2008 11:03:37 PM
        Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
        Kaspersky Online Scanner version: 5.0.98.0
        Kaspersky Anti-Virus database last update: 1/02/2008
        Kaspersky Anti-Virus database records: 545650
        Scan Settings:
        Scan using the following antivirus database: extended
        Scan Archives: true
        Scan Mail Bases: true
        Scan Target - My Computer:
        A:\
        C:\
        D:\
        E:\
        F:\
        Scan Statistics:
        Total number of scanned objects: 104083
        Number of viruses found: 5
        Number of infected objects: 11
        Number of suspicious objects: 0
        Duration of the scan process: 02:22:52
        Infected Object Name / Virus Name / Last Action
        C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
        C:\Documents and Settings\Joseph\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\appLauncher_all_log.txt Object is locked skipped
        C:\Documents and Settings\Joseph\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\DM_log.txt Object is locked skipped
        C:\Documents and Settings\Joseph\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\FM_log.txt Object is locked skipped
        C:\Documents and Settings\Joseph\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\HookStarter_log.txt Object is locked skipped
        C:\Documents and Settings\Joseph\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped
        C:\Documents and Settings\Joseph\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\TlibCmnDlgs_log.txt Object is locked skipped
        C:\Documents and Settings\Joseph\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\Joseph\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\Joseph\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\Joseph\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Joseph\Local Settings\Temp\asmfiles.cab/asm.exe Infected: not-a-virus:AdWare.Win32.Altnet.l skipped
        C:\Documents and Settings\Joseph\Local Settings\Temp\asmfiles.cab/asmps.dll Infected: not-a-virus:AdWare.Win32.Altnet.t skipped
        C:\Documents and Settings\Joseph\Local Settings\Temp\asmfiles.cab CAB: infected - 2 skipped
        C:\Documents and Settings\Joseph\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Joseph\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\Joseph\NTUSER.DAT.LOG Object is locked skipped
        C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
        C:\Documents and Settings\Sinead\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\appLauncher_all_log.txt Object is locked skipped
        C:\Documents and Settings\Sinead\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\DM_log.txt Object is locked skipped
        C:\Documents and Settings\Sinead\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\HookStarter_log.txt Object is locked skipped
        C:\Documents and Settings\Sinead\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped
        C:\Documents and Settings\Sinead\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\TlibCmnDlgs_log.txt Object is locked skipped
        C:\Documents and Settings\Sinead\Cookies\index.dat Object is locked skipped
        C:\Documents and Settings\Sinead\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
        C:\Documents and Settings\Sinead\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
        C:\Documents and Settings\Sinead\Local Settings\History\History.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Sinead\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
        C:\Documents and Settings\Sinead\NTUSER.DAT Object is locked skipped
        C:\Documents and Settings\Sinead\ntuser.dat.LOG Object is locked skipped
        C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP56\A0006548.exe Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP56\A0006549.exe Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006572.exe Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006573.exe Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006574.exe Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006576.exe Object is locked skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006585.dll Infected: not-a-virus:AdWare.Win32.Altnet.a skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006586.dll Infected: not-a-virus:AdWare.Win32.Altnet.a skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006587.exe Infected: not-a-virus:AdWare.Win32.Altnet.a skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006589.dll Infected: not-a-virus:AdWare.Win32.BrilliantDigital.3039 skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006590.dll Infected: not-a-virus:AdWare.Win32.Altnet.j skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006591.dll Infected: not-a-virus:AdWare.Win32.Altnet.a skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006592.exe Infected: not-a-virus:AdWare.Win32.Altnet.l skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\A0006594.dll Infected: not-a-virus:AdWare.Win32.Altnet.t skipped
        C:\System Volume Information\_restore{51855DF3-3E8F-417D-A4F7-5ABABEA7790A}\RP57\change.log Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\cmdevtgprov.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\evtgprov.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
        C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
        C:\WINDOWS\Debug\oakley.log Object is locked skipped
        C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
        C:\WINDOWS\SchedLgU.Txt Object is locked skipped
        C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
        C:\WINDOWS\Sti_Trace.log Object is locked skipped
        C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\default Object is locked skipped
        C:\WINDOWS\system32\config\default.LOG Object is locked skipped
        C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
        C:\WINDOWS\system32\config\SAM Object is locked skipped
        C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\SECURITY Object is locked skipped
        C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
        C:\WINDOWS\system32\config\software Object is locked skipped
        C:\WINDOWS\system32\config\software.LOG Object is locked skipped
        C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
        C:\WINDOWS\system32\config\system Object is locked skipped
        C:\WINDOWS\system32\config\system.LOG Object is locked skipped
        C:\WINDOWS\system32\h323log.txt Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
        C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
        C:\WINDOWS\wiadebug.log Object is locked skipped
        C:\WINDOWS\wiaservc.log Object is locked skipped
        C:\WINDOWS\WindowsUpdate.log Object is locked skipped
        Scan process completed.


        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 11:06:38 PM, on 2/1/2008
        Platform: Windows XP SP1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
        Boot mode: Normal
        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
        C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
        C:\WINDOWS\system32\tbctray.exe
        C:\WINDOWS\System32\ctfmon.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Picasa2\PicasaMediaDetector.exe
        C:\Program Files\DNA\btdna.exe
        C:\Program Files\FinePixViewer\QuickDCF.exe
        C:\Program Files\Common Files\Teleca Shared\Generic.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\Program Files\BitTorrent\bittorrent.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://edit.europe.yahoo.com/config/mail?.intl=uk
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
        O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
        O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
        O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
        O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
        O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
        O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
        O4 - HKUS\S-1-5-21-2000478354-2111687655-1343024091-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User 'Sinead')
        O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
        O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1191827645219
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194169109956
        O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

        Again, thank you so much for your time, effort and patience.

        Joseph
        --
      • TroganTrogan London, UK
        edited February 2008
        Hi Joseph,

        Thanks for the logs.

        Please do the following...

        1. Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
        This program is for XP and Windows 2000 only!
        • Double-click ATF Cleaner.exe to open it.
        • Under Main select the following:
          • Windows Temp
          • Current User Temp
          • All Users Temp
          • Temporary Internet Files
          • Java Cache
        *The other boxes are optional*
        Then click the Empty Selected button

        Click Exit on the Main menu to close the program.

        2. Run HijackThis and click on Open the Misc Tools section.
        Click on Delete a file on reboot...
        Copy and paste the following into the "File name:" text box and then click Open:

        C:\Documents and Settings\Joseph\Local Settings\Temp\asmfiles.cab

        When you are asked "Do you want to restart your computer now?", click OK.

        Your PC MUST reboot to delete the file!

        Apart from that, the computer is clean.

        I notice you still have XP Service Pack 1 (SP1) on the computer. This is no longer supported by Microsoft. The latest is Service Pack 2 (SP2); is there a reason why you have not upgraded to this?
      • littlejoelittlejoe
        edited February 2008
        Dear Trogan,

        I did everything you suggested this morning and everything is working fine! Thank you so much. You've been extraordinary help and I really appreciate the time you've taken. Your directions were at all times completely clear and easy to follow. Again, thank you.

        Joseph

        PS: There's no reason to have not upgraded to SP2. Now that I know about this, I'll go to the Microsoft site and do just that. Thanks again so much.
      • TroganTrogan London, UK
        edited February 2008
        You're welcome! Yes, I suggest getting SP2 for the computers protection. Make sure you have backups of important files/documents before starting the upgrade.

        Let me know how it goes.
      Sign In or Register to comment.