Computing.Net > Forums > Security and Virus > Msn virus help!!!!!

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Msn virus help!!!!!

Reply to Message Icon

Original Message
Name: alesha
Date: October 29, 2008 at 06:24:48 Pacific
Subject: Msn virus help!!!!!
OS: (don't know)
CPU/Ram: (don't know)
Manufacturer/Model: Windows XP
Comment:

I kno i was stupid for opening it but i really need help
i tried scanninf and downloading all these different types of msn virus removers
tried following ppls instructions and searched for numerous system things... but none of them were it
when my friend sent it to me she said she had dyed her hair and if it was to dark the file was
photo-041_jpg.zip
she has sent me variations of that including
photo_275-jpg.zip
pic05s80.zip
k712ye317w.zip
j492dt510t.zip
img55_f0-JPG.zip

i really need help!
i don't kno which type it is!
any help i would appreaciate!


Report Offensive Message For Removal


Response Number 1
Name: XpUser4Real
Date: October 29, 2008 at 10:25:34 Pacific
Reply:

Are you saying you can't open the zip files?

Some HELP in posting on Computing.net plus free progs and instructions Cheers


Report Offensive Follow Up For Removal

Response Number 2
Name: jabuck
Date: October 29, 2008 at 14:24:56 Pacific
Reply:

Please download Malwarebytes' Anti-Malware from one of these sites:

MalwareBytes1

MalwareBytes2

1. Double Click mbam-setup.exe to install the application.
2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
3. If an update is found, it will download and install the latest version.
4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.
5. When the scan is complete, click OK, then Show Results to view the results.
6. Make sure that everything found is checked, and click Remove Selected.
7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
9. Copy&Paste the entire report in your next reply.


Please download and install the latest version of HijackThis v2.0.2:


Download the "HijackThis" Installer from this link:
Hijack This


1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.


Report Offensive Follow Up For Removal

Response Number 3
Name: alesha
Date: October 30, 2008 at 02:16:13 Pacific
Reply:

This is the log i got from Malware:

Malwarebytes' Anti-Malware 1.30
Database version: 1338
Windows 5.1.2600 Service Pack 3

30/10/2008 6:05:53 PM
mbam-log-2008-10-30 (18-05-53).txt

Scan type: Quick Scan
Objects scanned: 66295
Time elapsed: 16 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 37
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3160f356-e8c3-4de2-a698-92eeeb3d3400} (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c1a6d8b8-93c3-4186-9dd1-13983f9f1d9b} (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp.1 (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\rotator.gizmo3 (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\rotator.gizmo3.1 (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e015787-b1e3-404a-95de-3e71e1fa0305} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9c8a568e-4201-478a-8536-526cf371d2e2} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8e015787-b1e3-404a-95de-3e71e1fa0305} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8e015787-b1e3-404a-95de-3e71e1fa0305} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\superiorads (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{a471012f-e2e5-48eb-9a8b-9d4090b1d0c7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b5533239-2826-4fa8-bcfb-a9a44008ff4b} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{dfb574f4-1846-42f5-9694-1f09223800f9} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1648e328-3e5a-4ea5-a9c6-e5f09ee272da} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1648e328-3e5a-4ea5-a9c6-e5f09ee272da} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1648e328-3e5a-4ea5-a9c6-e5f09ee272da} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{315108e4-e3af-460f-b264-f2acc9e1aceb} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{315108e4-e3af-460f-b264-f2acc9e1aceb} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b5533239-2826-4fa8-bcfb-a9a44008ff4b} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcadssearchassistant (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AdvRemoteDbg (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\HID_Layer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcadssocial (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a10ead50-a239-3753-0eeb-fcfa2b24ee35} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a10ead50-a239-3753-0eeb-fcfa2b24ee35} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\segevou (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\vivoon.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\WINDOWS\system32\iebrowserc.dll (Adware.RightOnAds) -> Delete on reboot.
C:\WINDOWS\system32\WhoisCL.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dcads_sidebar.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rightonadz-uninst.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\superiorads-uninst.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\DcadsSocial-uninstall.exe (Adware.RightOnAds) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ClickToFindandFixErrors_4.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ClickToFindandFixErrors_Intl.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ClickToFindandFixErrors_RON.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jeff Heath\Application Data\urlredir.cfg (Adware.RightOnAds) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nsa144.dll (Trojan.BHO) -> Quarantined and deleted successfully.


Report Offensive Follow Up For Removal

Response Number 4
Name: jabuck
Date: October 30, 2008 at 03:38:08 Pacific
Reply:

Please post your Hijack This log.


Report Offensive Follow Up For Removal

Response Number 5
Name: XpUser4Real
Date: October 30, 2008 at 08:08:40 Pacific
Reply:

alesha, you didn't answer my question in response 1????

Some HELP in posting on Computing.net plus free progs and instructions Cheers


Report Offensive Follow Up For Removal


Response Number 6
Name: alesha
Date: November 1, 2008 at 04:26:39 Pacific
Reply:

no its all ok now
i didn't need to do the Hijack This coz the other one got rid of it
thanks so much jabuck

and to XpUser4Real no it had nothing to do with not being able to open the zip files.. but don't worry coz it is all fixed now
thanks


Report Offensive Follow Up For Removal

Response Number 7
Name: jabuck
Date: November 1, 2008 at 04:54:29 Pacific
Reply:

Glad we could help.


Report Offensive Follow Up For Removal






Use following form to reply to current message:

Not Logged In!

You will not be able to post.

Register | Login
   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: Msn virus help!!!!!

Comments:



Results for: Msn virus help!!!!!

backdoor trojan virus..help needed
    Summary: Hi any boody knows how to remove backdoor.trojan virus its effected in C:\WINNT\SYSTEM\service.exe .. i used norton 2002 but no use it wont delete and quaratine.. i tried deleting the file but it say...
www.computing.net/answers/security/backdoor-trojan-virushelp-needed/4851.html

MSN Virus Update
    Summary: I think I have finally conquered my MSN Virus. Because your Task Manager, MSCONFIG, Regedit won't work, and you can't access any websites concerning viruses, you have to do it the hard way. I found ...
www.computing.net/answers/security/msn-virus-update/16836.html

MSN virus
    Summary: anyone know of a MSN virus that: creates hosts file stops other apps from running (cmd, task manager, IE etc) creates MS-DOS files in c:\ root, upon deletion they get recreated. I didnt' accept a down...
www.computing.net/answers/security/msn-virus/15301.html








Which MP3 player do you have?

iPod/iPhone
Zune
Something Else
None


View Results

Poll Finishes Today.
Discuss in The Lounge
Poll History






Data Recovery Software