Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Antivirus software not playing ball

Discuss Antivirus software not playing ball in the Antivirus Protection forum on Dev Shed.
Antivirus software not playing ball Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Record onscreen activity, your voice & webcam video. Turn everyday presentations into HD-quality videos.

For perfectly clear screencasts every time.
At the IBM® developerWorks Developer Knowledge Center you'll find resources for FREE ekits, Tutorials, Webcasts, Trial Downloads and more.


We cover the world of technology like no one else, constantly updating you with the best information available on open source software, Microsoft technologies, hardware and news from around the world.

Try Camtasia Studio today!
Visit the IBM® Developer Knowledge Center today!
Sign up today!

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Page 1 of 3 1 2 3 >
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old May 9th, 2009, 03:41 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
Antivirus software not playing ball
Hi,

newby here with first post, having probs with google links not working properly and done some reading in many threads. Started going through the instructions in this thread

/forums.devshed.com/antivirus-protection-117/if-you-have-infection-issues-start-here-first-519852.html

but when I installed Malwarebytes' Anti-Malware it will not run, so I moved to the next step and when I tried to install SUPERAntiSpyware it will not install and I get the pop up offering me the option to send Microsoft an error report.

Does anyone have any advise to allow me to go through all steps and ride myself of this problem.

Cheers
Scoffers74
Reply With Quote
  #2  
Old May 9th, 2009, 04:32 PM
seack79 seack79 is offline
Contributing User
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: May 2004
Location: surfing the interwebz
Posts: 1,917 seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level)seack79 User rank is General 12nd Grade (Above 100000 Reputation Level) 
Time spent in forums: 1 Week 5 Days 12 h 42 m 59 sec
Reputation Power: 1760
Hi, welcome to DevShed. Can you please post the exact error you're getting? If your PC is already infected, it is possible that the virus is preventing you from installing known anti-virus programs. Try installing the program in safe-mode if it will let you. If not, see if you can download a copy of hijackthis and post a hijackthis log file.
Reply With Quote
  #3  
Old May 9th, 2009, 04:53 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
Hi,

re-booted in to safe mode and still the same Malwarebytes' Anti-Malware will not run and SUPERAntiSpyware it will not install.

here is my hijackthis log file........

cant post it as cant seem to get rid of all the URL's can you let me know what I need to remove from it?
Reply With Quote
  #4  
Old May 9th, 2009, 05:07 PM
hiker's Avatar
hiker hiker is offline
They're coming to take me away
Click here for more information
 
Join Date: Jan 2005
Location: Florida
Posts: 4,149 hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)  Folding Points: 33832 Folding Title: Starter FolderFolding Points: 33832 Folding Title: Starter Folder
Time spent in forums: 2 Months 2 Weeks 8 h 53 m 20 sec
Reputation Power: 3178
Quote:
Originally Posted by scoffers74
Hi,

re-booted in to safe mode and still the same Malwarebytes' Anti-Malware will not run and SUPERAntiSpyware it will not install.

here is my hijackthis log file........

cant post it as cant seem to get rid of all the URL's can you let me know what I need to remove from it?


A lot of infections may prevent the installation and execution of certain keyword filenames, such as malware, spyware, etc.... Try renaming these file names for installation and/or execution. For example, you mentioned that superantispyware won't install, but malwarebytes did. Rename the executable for malwarebytes to, for example, cleaner.exe. Same with the installation file for superantispyware.
Reply With Quote
  #5  
Old May 9th, 2009, 05:19 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
ok... gave that a try

changed the .exe file for malware and nothing changes, changed the install file for superantispyware and got it to install but when I tried to run it I got the same message telling me it had encountered a problem and had to end. changed the .exe file name and still get the same message

????

scoffers74
Reply With Quote
  #6  
Old May 9th, 2009, 05:28 PM
hiker's Avatar
hiker hiker is offline
They're coming to take me away
Click here for more information
 
Join Date: Jan 2005
Location: Florida
Posts: 4,149 hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)  Folding Points: 33832 Folding Title: Starter FolderFolding Points: 33832 Folding Title: Starter Folder
Time spent in forums: 2 Months 2 Weeks 8 h 53 m 20 sec
Reputation Power: 3178
Quote:
Originally Posted by scoffers74
ok... gave that a try

changed the .exe file for malware and nothing changes, changed the install file for superantispyware and got it to install but when I tried to run it I got the same message telling me it had encountered a problem and had to end. changed the .exe file name and still get the same message

????

scoffers74


Try this:

Open Device Manager:
Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices

Then:
Scroll down to Non-plug and Play Drivers and click the plus icon to open those drivers.
Then search forTDSSserv.sys
Let me know if you find this or not.
If you do find it, right click on it, and select Disable. Do not try to uninstall it.
Also if TDSSserv.sys is found and you disable it, then you must reboot immediately.
After reboot, try running those programs again.
Reply With Quote
  #7  
Old May 9th, 2009, 05:33 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
No it is not there....
Reply With Quote
  #8  
Old May 9th, 2009, 05:38 PM
hiker's Avatar
hiker hiker is offline
They're coming to take me away
Click here for more information
 
Join Date: Jan 2005
Location: Florida
Posts: 4,149 hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)  Folding Points: 33832 Folding Title: Starter FolderFolding Points: 33832 Folding Title: Starter Folder
Time spent in forums: 2 Months 2 Weeks 8 h 53 m 20 sec
Reputation Power: 3178
Quote:
Originally Posted by scoffers74
No it is not there....


Alright... To post a HJT log, you need to edit out all of the URL's. For this, just do a search for http:// and remove them. I believe you can still post www.domain.com ... if not, try seperating the dots by spaces. Also, you should be able to post URL's after you get to 5 posts. So you may be able to post URL's with your next post... If you try and can't, then post back with the following information:

What OS are you running?
What browser are you running?

Then after you post this information, create another post with the HJT log... URL's shouldn't be purged at that point.
Reply With Quote
  #9  
Old May 9th, 2009, 05:46 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
Still not allowing URL's so my OS is windows XP pro and I have both Firefox and IE7
Reply With Quote
  #10  
Old May 9th, 2009, 05:47 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:41:53, on 09/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=2070814
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/hws/sb/dell-usuk/en/side.html?channel=uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk/hws/sb/dell-usuk/en/side.html?channel=uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=2070814
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {bedf7e36-50f4-4b60-a2b0-d689f474ede9} - C:\WINDOWS\system32\tajokigu.dll (file missing)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [V Stuff Backup] "C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" /delayed
O4 - HKUS\S-1-5-19\..\Run: [megesegaso] Rundll32.exe "C:\WINDOWS\system32\nujeruze.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [megesegaso] Rundll32.exe "C:\WINDOWS\system32\nujeruze.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\windows\system32\yenuhaja.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenuhaja.dll (file missing)
O22 - SharedTaskScheduler: flaxen - {257f6f44-2c64-46bb-acb4-55f9b9e0ae08} - C:\WINDOWS\system32\wakjs.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenuhaja.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--
End of file - 11465 bytes
Reply With Quote
  #11  
Old May 9th, 2009, 06:36 PM
hiker's Avatar
hiker hiker is offline
They're coming to take me away
Click here for more information
 
Join Date: Jan 2005
Location: Florida
Posts: 4,149 hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)  Folding Points: 33832 Folding Title: Starter FolderFolding Points: 33832 Folding Title: Starter Folder
Time spent in forums: 2 Months 2 Weeks 8 h 53 m 20 sec
Reputation Power: 3178
Now, I'm not a professional with AV, but I will help as much as I can. There are some additional items which I noticed, but let's start here:

Download HostsXpert and then follow these steps:
- Unzip HostsXpert.zip
- It will create a folder named HostsXpert in whatever folder you extract it to.
- Run HostsXpert.exe by double-clicking on it.
- Click Restore MS Hosts File and then click OK.
- Click the X to exit the program.
- Restart the computer.

Next:
Quote:
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)

Fix these by running HJT again (Do scan only).
Place a checkmark next to these entries and click Fix Checked.

After these have been done, try running malwarebytes and superantispyware again...
Reply With Quote
  #12  
Old May 9th, 2009, 06:54 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
all instructions carried out but no change, still nothing when I run malwarebytes and the same error when I run superantispyware

find below new HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:54:23, on 09/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=2070814
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/hws/sb/dell-usuk/en/side.html?channel=uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk/hws/sb/dell-usuk/en/side.html?channel=uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=2070814
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {bedf7e36-50f4-4b60-a2b0-d689f474ede9} - C:\WINDOWS\system32\tajokigu.dll (file missing)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [V Stuff Backup] "C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" /delayed
O4 - HKUS\S-1-5-19\..\Run: [megesegaso] Rundll32.exe "C:\WINDOWS\system32\nujeruze.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [megesegaso] Rundll32.exe "C:\WINDOWS\system32\nujeruze.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\windows\system32\yenuhaja.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenuhaja.dll (file missing)
O22 - SharedTaskScheduler: flaxen - {257f6f44-2c64-46bb-acb4-55f9b9e0ae08} - C:\WINDOWS\system32\wakjs.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenuhaja.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--
End of file - 11576 bytes
Reply With Quote
  #13  
Old May 9th, 2009, 07:09 PM
hiker's Avatar
hiker hiker is offline
They're coming to take me away
Click here for more information
 
Join Date: Jan 2005
Location: Florida
Posts: 4,149 hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)  Folding Points: 33832 Folding Title: Starter FolderFolding Points: 33832 Folding Title: Starter Folder
Time spent in forums: 2 Months 2 Weeks 8 h 53 m 20 sec
Reputation Power: 3178
There are other items from the HJT log that should be removed, however, from what I've seen, another program should be used. I am not familiar with the program, and it should not be run without knowledge of the program, so I'm not going to instruct on how to do so.

If you want, I can list the other items and you can go ahead and remove them, but again, I am not a trained malware analyst.

Have you tried superantispyware in Safe Mode? You mentioned it wasn't installed when you tried safe mode previously.

Also, have you tried Bitdefender online scanner yet? (From the Sticky).
Reply With Quote
  #14  
Old May 9th, 2009, 07:15 PM
scoffers74 scoffers74 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2009
Location: Paisley, Scotland
Posts: 16 scoffers74 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 h 3 m 43 sec
Reputation Power: 0
Send a message via Google Talk to scoffers74 Send a message via Skype to scoffers74
If you could list the other items so that I have a note of them, that would be great...

I need to sign off for tonight but will have a go in safe mode again and try Bitdefender as soon as I can and let you know how I get on

Thanks
Scoffers74
Reply With Quote
  #15  
Old May 9th, 2009, 08:25 PM
hiker's Avatar
hiker hiker is offline
They're coming to take me away
Click here for more information
 
Join Date: Jan 2005
Location: Florida
Posts: 4,149 hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)hiker User rank is General 33rd Grade (Above 100000 Reputation Level)  Folding Points: 33832 Folding Title: Starter FolderFolding Points: 33832 Folding Title: Starter Folder
Time spent in forums: 2 Months 2 Weeks 8 h 53 m 20 sec
Reputation Power: 3178
O4 - HKUS\S-1-5-19\..\Run: [megesegaso] Rundll32.exe "C:\WINDOWS\system32\nujeruze.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [megesegaso] Rundll32.exe "C:\WINDOWS\system32\nujeruze.dll",s (User 'NETWORK SERVICE')
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
O20 - AppInit_DLLs: c:\windows\system32\yenuhaja.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenuhaja.dll (file missing)
O22 - SharedTaskScheduler: flaxen - {257f6f44-2c64-46bb-acb4-55f9b9e0ae08} - C:\WINDOWS\system32\wakjs.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenuhaja.dll (file missing)

Also, post an uninstall log from HJT. Listed in the Sticky is how to do so.
Reply With Quote
Reply
Page 1 of 3 1 2 3 >

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Antivirus software not playing ball

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump




 Free IT White Papers!
 
How to Present Effectively Online
This white paper offers practical and actionable advice on the key steps that any presenter should consider as they plan and execute a Webinar or online meeting.
 
Open Source Security Myths
Open Source Software (OSS) is computer software whose source code is available to the general public with relaxed or non-existent intellectual property restrictions (or arrangement such as the public domain), and is usually developed with the input of many contributors.
 
Power and Cooling Capacity Management for Data Centers
This paper describes the principles for achieving power and cooling capacity management.
 
Scalable, Fault-Tolerant NAS for Oracle - The Next Generation
For several years NAS has been evolving as a storage alternative for Oracle databases, and for good reason: NAS is quite often the simplest, most cost-effective storage approach for Oracle. Learn about the benefits that HP's approach to scalable NAS brings to Oracle environments in this comprehensive white paper.
 
Understanding Web Application Security Challenges
This white paper discusses many common threats and preventive measures for Web application security, and explains what you can do to help protect your organization.
 

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 




© 2003-2009 by Developer Shed. All rights reserved. DS Cluster 3 Hosted by Hostway. 
Stay green...Green IT