Computing.Net > Forums > Security and Virus > Virus Problems

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Virus Problems

Reply to Message Icon

Name: bullets81
Date: April 5, 2008 at 18:13:27 Pacific
OS: Windows Media Edition 200
CPU/Ram: 2 gigs
Product: Dell
Comment:

I have a problem with a virus i had. i deleted a lot of things and ran many scans then i reinstalled my windows but i'm still having issues. It seems to only lag my computer when i open games or large programs very badly. I have an hijack this file that may help anyone who knows whats bad in there please post here or email me if anyone can help me!



Sponsored Link
Ads by Google

Response Number 1
Name: Adii
Date: April 6, 2008 at 08:28:20 Pacific
Reply:

Download the "HijackThis" Installer from this link:

http://www.trendsecure.com/portal/e...


1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Post Hijackthis Log in your next reply.

*Do Safe Computing*


0

Response Number 2
Name: bullets81
Date: April 8, 2008 at 17:17:07 Pacific
Reply:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:14:46 PM, on 4/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Sony\PlanetSide\planetside.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7471 bytes


0

Response Number 3
Name: computerprincess
Date: April 11, 2008 at 12:41:19 Pacific
Reply:

i would try this go to "onecare.live.com"-the new comprehensive, automatic, and self-updating PC care service that helps protect and maintain your PC. ...Windows Live OneCare safety scanner is a free service designed to help ensure the health of your PC.

Check for and remove viruses
Get rid of junk on your hard disk
Improve your PC's performance

Download the free 90 day trial.
if you like it maybe then you might want to buy it i didn't but i used it for 90 days and it worked maybe it will fix your promblem but mine was similar and it fixed mine so maybe it will fix yours i hope so.......-aly


Alysa East


0

Response Number 4
Name: effient
Date: April 11, 2008 at 19:12:47 Pacific
Reply:

PnkBstrA.exe indicates that you may have polymorphic trojan/backdoor. As you state that oyu have delelted viruses bu they come back indiaces the nature of the trojan.

Try AVG antispyware, ComboFix and GMER.
But I think oyu should be preparing to have fresh installation of XP after formatting the hard drive (use: Darik's Boot & Nuke, or BCWipePD from Jetico).


0

Response Number 5
Name: Adii
Date: April 11, 2008 at 21:29:34 Pacific
Reply:

Hello effient,

I have noticed that you are posting randomly replies while there is already reply by experts. Please do not guide improperly to use malware removal tools, these are not toys tools. Also PnkBstrA.exe is not a trojan/backdoor it is Related to PunkBuster from Even Balance, Inc. Service that look for cheats while users are playing on PunkBuster enabled servers. So please do not post if you are not sure of knowledge about security. Thaanks!

*Do Safe Computing*


0

Related Posts

See More



Response Number 6
Name: Adii
Date: April 11, 2008 at 21:31:06 Pacific
Reply:


Please run HijackThis again! and click "Scan." Place checks next to the following entries:


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


Close all browsers and other windows except for HijackThis!, and click "Fix checked".


Please download ATF Cleaner by Atribune. (This program is for XP and Windows 2000 only)

Download: http://www.atribune.org/ccount/clic...

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

Please do an online scan with Kaspersky WebScanner.

online scanner: http://www.kaspersky.com/virusscanner


1.Click on "Kaspersky Online Scanner".
2.You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
3.The program will launch and then begin downloading the latest definition files.
4.Once the files have been downloaded click on "NEXT".
5.Now click on "Scan Settings".
6.In the scan settings make that the following are selected:
7.Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
8.Scan Options:
Scan Archives
Scan Mail Bases
9.Click OK.
10.Under select a target to scan, select "My Computer".
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Upon completion, click on the "Save as Text" button.
Save the file to your desktop.

Copy and paste that information in your next reply.

*Do Safe Computing*


0

Response Number 7
Name: bullets81
Date: April 12, 2008 at 11:56:06 Pacific
Reply:

Saturday, April 12, 2008 2:50:45 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 12/04/2008
Kaspersky Anti-Virus database records: 700176
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 95059
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0
Duration of the scan process 01:16:46

Infected Object Name Virus Name Last Action
C:\Config.Msi\9cf915.rbs Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\acccore\nss\cert8.db Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\acccore\nss\key3.db Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\cert8.db Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\history.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\key3.db Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\parent.lock Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\AOL OCP\AIM\Storage\data\crazydeadman81\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\AOL OCP\AIM\Storage\data\dittoheadilk81\localStorage\common.cls Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Application Data\Mozilla\Firefox\Profiles\38cotygk.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Temp\63bd.rra Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\ntuser.dat Object is locked skipped
C:\Documents and Settings\Daniel Tyler Gantt\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\Common Files\WindowsLiveInstaller\Logs\2008-04-12_10-29_f64.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{B074E896-6759-4305-B311-1A2D6257315E}\RP29\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{786B8548-96D9-451B-A294-61D3A1D95603}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{ECFAD385-B190-4744-B95F-96FF8834B14D}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{F82796A1-C62C-4CC5-82F2-0B62DAB984C1}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\KB900325.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\MCInstaller.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\MCInstEx.dll Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\MCInstUI.dll Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\paths.ini Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsMedia10-KB895572-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsXP-KB888795-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsXP-KB891593-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsXP-KB895961-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsXP-KB899337-v2-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsXP-KB899510-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\WindowsXP-KB902841-x86.exe Object is locked skipped
F:\93f56d55359f078c7710a61c\bin\wmfdist95.exe Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{B074E896-6759-4305-B311-1A2D6257315E}\RP29\change.log Object is locked skipped
Scan process completed.


0

Response Number 8
Name: bullets81
Date: April 19, 2008 at 05:19:06 Pacific
Reply:

i did all that and still having the problem, is it possible this virus is on my motherboard or in my router or something? I'm not sure if Adii has anything more for me to do but i haven't gotten a reply on this. Should i just get a new hard drive?


0

Response Number 9
Name: Adii
Date: April 19, 2008 at 23:26:00 Pacific
Reply:

Hi bullets81,

I did not find anything malicious on your computer with your logs, If you only have computer speed problem with heavy games and applications then you shuld have a look on your hardware, like your system RAM, Processor to meet the requirements of heavy applications to run properly without effecting your system speed.

Anyway,
For further check lets do a scan on your computer.


Download and scan with SUPERAntiSpyware free for home users.

http://www.superantispyware.com/dow...


1. Double-click [b]SUPERAntiSpyware.exe[/b] and use the default settings for installation.
2. An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click [b]"Yes"[/b]. If not, update the definitions before scanning by selecting [b]"Check for Updates"[/b].
Under [b]"Configuration and Preferences"[/b], click the Preferences button.
Click the Scanning Control tab.
3. Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
4. Click the "Close" button to leave the control center screen.
5. Back on the main screen, under [b]"Scan for Harmful Software"[/b] click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under [b]"Complete Scan"[/b], choose Perform Complete Scan.
6. Click "Next" to start the scan. Please be patient while it scans your computer.
7.After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "[b]OK[/b]".
Make sure everything has a checkmark next to it and click "[b]Next[/b]".
8.A notification will appear that "Quarantine and Removal is Complete". Click "[b]OK[/b]" and then click the "[b]Finish[/b]" button to return to the main menu.
If asked if you want to reboot, click "[b]Yes[/b]".

To retrieve the removal information after reboot, launch [b]SUPERAntispyware[/b] again.

Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.

[b]Please copy and paste the Scan Log results in your next reply.[/b]

Click Close to exit the program.


second,

Please download Malwarebytes' Anti-Malware to your desktop. This is an Free Antimalware Application tool.

Download link: http://www.malwarebytes.org/mbam/pr...

>DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
>Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
>If an update is found, it will download and install the latest database updates.
>Once the program has loaded, select Perform full scan, then click Scan.
>When the scan is complete, click OK, then Show Results to view the results.
>Be sure that everything is checked, and click Remove Selected.
>When MBAM finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

Post its Log in your next reply.

*Do Safe Computing*


0

Response Number 10
Name: bullets81
Date: April 20, 2008 at 05:09:21 Pacific
Reply:

Yeah i have been checking for any virus's and i have not found anything. But i have had a file show up every once in a while saying that a certain file in my avast virus software was trying to be changed by something. I started to think maybe hardware was failing on me I am buying a computer now though new hard drive and all of that but thanks for all your help i'll do this before i get the new computer though.


0

Response Number 11
Name: bullets81
Date: April 20, 2008 at 07:32:29 Pacific
Reply:

Malwarebytes' Anti-Malware 1.11
Database version: 660

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 109085
Time elapsed: 2 hour(s), 1 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


0

Response Number 12
Name: bullets81
Date: April 21, 2008 at 17:31:07 Pacific
Reply:

Hello Adii
I also have a virus on my laptop now. I have been doing the same thing i did for my desktop but it is on a file i need for a certain program what should i do to help you help me get rid of this one? let me know what to do i have done almost all the same things and do have a saved text from the online scan you had me do on my desktop would you like me to post it?



0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Virus Problems

virus problem www.computing.net/answers/security/virus-problem/21409.html

? virus problem on start up www.computing.net/answers/security/-virus-problem-on-start-up/21643.html

Virus Problem / Best Scan Method www.computing.net/answers/security/virus-problem-best-scan-method/14480.html