I have a virus on my computer and Im having trouble getting rid of it. I keep getting a message that pops up saying... "SYSTEM ERROR!" youre computer was infected by an unknown trojan. Its dangerous for your system(critical files may be lost) Click OK to download antispyware program to clean youre system. I think it is gnida[1].swf virus, but Im not sure. can someone please help me get rid of harmful things on my computer? Greg Sain sainsauce@yahoo.com

We will need to run a few scans to find all the bad files. To start with please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Im pumped to see that I got jabuck on the case. I saw how you helped somone else and Im sure you can do the same for me. Heres what I got... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:31:21 AM, on 1/13/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Owner\Desktop\HiJackThis.exe C:\Program Files\Messenger\msmsgs.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Office toolbar - {F0B18D6F-3541-4AB4-A231-79F15FA29ED1} - C:\WINDOWS\sysosa.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: NETGEAR Smart Wizard.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 7313 bytes Greg Sain sainsauce@yahoo.com

Sorry for the delay, I overlooked your post. Go to the following link and follow their direction to disable Norton’s script blocking or it may not allow the programs we use to remove certain baddies to run. Once your compter is clean turn Script Blockung back on. Disable Norton's Script Blocking Run Hijack This, close all windows and browseres except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: Office toolbar - {F0B18D6F-3541-4AB4-A231-79F15FA29ED1} - C:\WINDOWS\sysosa.dll Exit Hijack This. Set up the computer to view hidden files: To show hidden files do the following: Click Start > My Computer On the Tools menu, click Folder Options. Click the View tab. Uncheck Hide file extensions for known file types. Uncheck Hide protected operating system files. Under the Hidden files folder, locate and check Show hidden files and folders. If you see a warning message, click Yes. Click Apply > OK. Navigate to and delete this file if found: C:\WINDOWS\sysosa.dll Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: ATF Cleaner Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Please download ComboFix to the desktop from this link: ComboFix Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

Here is the ATF log. I wasnt able to find sysosa.dll. ComboFix 08-01-09.2 - Owner 2008-01-14 12:21:29.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.212 [GMT -8:00] Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Owner\Application Data\AntiSpywareBot C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Log\2008 Jan 12 - 11_16_56 PM_984.log C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Log\2008 Jan 12 - 11_17_00 PM_015.log C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\rs.dat C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Settings\CustomScan.stg C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Settings\IgnoreList.stg C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Settings\ScanInfo.stg C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Settings\ScanResults.stg C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Settings\SelectedFolders.stg C:\Documents and Settings\Owner\Application Data\AntiSpywareBot\Settings\Settings.stg C:\WINDOWS\Tasks.\AntiSpywareBot Scheduled Scan.job E:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-12-14 to 2008-01-14 ))))))))))))))))))))))))))))))) . 2008-01-14 12:20 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 23:29 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-01-12 23:29 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-01-12 23:29 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-01-12 23:29 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-01-12 23:29 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-01-12 23:29 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-01-10 23:10 . 2008-01-10 23:10 46 --a------ C:\tmp.bat 2007-12-25 00:18 . 2007-12-25 00:18 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\MySpace 2007-12-25 00:17 . 2007-12-25 00:17 <DIR> d-------- C:\Program Files\MySpace 2007-12-19 22:22 . 2007-12-19 22:22 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Viewpoint 2007-12-19 21:24 . 2007-12-19 21:24 <DIR> d-------- C:\Documents and Settings\Owner\.realobjects . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-14 20:05 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-14 20:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus 2008-01-13 06:36 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-01-12 05:13 --------- d-----w C:\Program Files\Azureus 2008-01-11 10:15 --------- d-----w C:\Program Files\Norton AntiVirus 2008-01-11 10:09 --------- d-----w C:\Program Files\Symantec 2007-12-19 09:59 --------- d-----w C:\Program Files\AIM6 2007-12-19 09:58 --------- d-----w C:\Program Files\Viewpoint 2007-12-19 09:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-12-19 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2007-12-19 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-28 01:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2005-03-10 21:45 265,984 ----a-w C:\WINDOWS\inf\WG511v2\WG511v2XP.sys 2005-03-10 21:45 265,856 ----a-w C:\WINDOWS\inf\WG511v2\WG511v2.sys 2004-08-05 23:06 212,992 ----a-w C:\WINDOWS\inf\WG511v2\CopyWHQLDriver.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 03:40 68856] "Aim6"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 20:05 344064] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 17:32 58984] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-01-11 02:08 100056] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 17:47 8720384] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] NETGEAR Smart Wizard.lnk - C:\WINDOWS\Installer\{B93D24B3-928D-4805-B379-4AA47CB3794E}\NewShortcut1_1.exe [2006-10-01 22:45:14] S3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 16:43] *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder "2008-01-14 20:05:04 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe "2008-01-14 06:17:51 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Owner.job" - C:\PROGRA~1\NORTON~1\Navw32.exeh/task: . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-14 12:22:51 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-14 12:23:16 ComboFix-quarantined-files.txt 2008-01-14 20:23:14 . 2008-01-11 07:01:22 --- E O F --- Greg Sain sainsauce@yahoo.com

You log is clean, but you should do some cleanup. Empty the restore folder. Go to start> control panel> system> system restore tab> check the box beside "turn off system restore> apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on> apply> ok. Download ATF Cleaner from this link: ATF Cleaner Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. It only takes a little while to run a online scan to follow up these results. And it only takes a little while to run an online scan to follow-up these results. Please run the BitDefender online scan this link: Bitdefender Online Scanner You will need to allow an active x install for the scan to run. Leave the scanning options at default and press "click here to scan" When finished scanning, click on "click here to export the scan report" Save it to your desktop, at "file name" type in "bdscan" then click save. Post a log in your reply.

BitDefender Log File !!!!! Product : BitDefender Total Security 2008 Version : BitDefender UIScanner v.11 Log date : 15:18:12 14/01/2008 Log path : C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\quick_scan\1200352692_1_01.xml Scan Paths:Path0000: C:\WINDOWS Path0001: C:\Program Files Scan Options:Scan for viruses : Yes Scan for adware : Yes Scan for spyware : Yes Scan for applications : Yes Scan for dialers : Yes Scan for rootkits : No Target selection options:Scan registry keys : No Scan cookies : No Scan boot sectors : No Scan memory processes : No Scan archives : No Scan runtime packers : Yes Scan emails : Yes Scan all files : Yes Heuristic Scan : Yes Scanned extensions : Excluded extensions : Target ProcessingDefault action for infected objects : Disinfect Default action for suspicious objects : None Default action for hidden objects : None Scan engines summaryNumber of virus signatures : 971293 Archive plugins : 41 Email plugins : 6 Scan plugins : 12 Archive plugins : 41 System plugins : 4 Unpack plugins : 7 Overall scan summaryScanned items : 116088 Infected items : 1 Suspicious items : 0 Resolved items : 1 Individual viruses found : 1 Scanned directories : 2585 Scanned boot sectors : 0 Scanned archives : 1 Input-output errors : 15 Scan time : 00:00:41:17 Files per second : 46 Scanned processes summaryScanned : 0 Infected : 0 Scanned registry keys summaryScanned : 0 Infected : 0 Scanned cookies summaryScanned : 0 Infected : 0 Remaining issues:Object Name Threat Name Final Status Resolved issues:Object Name Threat Name Final Status C:\WINDOWS\Downloaded Program Files\ClientAX.dll Adware.180solution.C Deleted Greg Sain sainsauce@yahoo.com