Issues with your account? Bug us in the Discord!

Antivirus

ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie."London, UK
in Zocalo v2.0
question: what good is fecking antivirus software if it can detect a virus, but not do anything about it?!:mad: i dont want it to tell me about it, i want it to bloody kill the thing!

Comments

  • BigglesBiggles <font color=#AAFFAA>The Man Without a Face</font>
    For the company that made it, a very good one. It means you have to give them more money to get a new/upgraded version that can kill it.
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    thats just it, ive already got the full version. got it licked about an hour tho: i downloaded a free trial version of one:D
  • Data CrystalData Crystal Pencil Artist
    What was your faulty AV software to begin with, just out of curiosity? I mean the one that failed to remove the virus?
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    Norton Antivirus.
  • E.TE.T Quote-o-matic
    You mean Bloatware Antivirus.

    Considering other side of security it just gets better, Symantec bought Sygate so now we might be left with one non bloatware firewall less.
    (best to happen would be Sygate's programmers putting Symantecs bloatware to diet)
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    i dont believe it! the goddamn thing is back again!! what the hell do you have to do to kill this thing?!?:mad: :mad: :mad:
  • Data CrystalData Crystal Pencil Artist
    What are the symptoms, what virus, how's it problematic? Mebbe we can help?
  • PSI-KILLERPSI-KILLER Needs help
    GO to a back up if available.

    If not try restore if in windows. your hard drive might be DOOMED
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    it appears to be a trojan of some kind, that can download stuff onto my pc. theres also some sort of adware junket that nothing can get rid of.

    ive tried using system restore in safe and normal modes, but the damn thing cant restore to any point, be it 5 days or 3 months ago. what more can i do? reinstalling XP aint an option cos i lost the disk moving flats
  • SanfamSanfam I like clocks.
    First, kill system restore. DIsable it, because it's likely got some infected files in it.

    Second, download a program called HijackThis. Use it to scan the computer and then save the log file, posting its contents here. I'll look over it and tell you what should be removed, and you can do it on your end. That should remove the downloader portion.

    Then, download and run Stinger, an all-in-one freeware scanning/removal package of the bigger bugs. It'll pick up some 70 or so larger virus types, but you just have to hope yours is in there.

    Then, download AVG antivirus from grisoft.com and use that. It is by far the most reliable scanner I have come by recently, and there is a free version available with unlimited upgrades.

    That should fix everything or point the way towards doing so.
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    ok, here's the log file. running stinger now (forgot about that actually, or id have run it already:rolleyes: )

    Logfile of HijackThis v1.99.1
    Scan saved at 20:19:31, on 06/11/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\FSI\F-Prot\fpavupdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\PMJ151LA.BIN
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\program files\u-storage tools2.1\ustorage.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\Twain_32\DigiCam\DigiSrv.exe
    C:\WINDOWS\Mixer.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Generic\Seticon.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\MsMovies\MsMovies.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\FSI\F-Prot\F-Sched.exe
    C:\Program Files\FSI\F-Prot\F-StopW.EXE
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\System32\ctfmon.exe
    X:\program files\valve\steam\steam.exe
    C:\Program Files\CallMe\CallMe.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\WinZip\Wzqkpick.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Jamie Addis\Desktop\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Pixoria\Konfabulator\UnixUtils\bin\sh.exe
    C:\WINDOWS\system32\netstat.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = wwwcache.ed.ac.uk:3128
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ed.ac.uk;127.0.0.1;localhost;10.*
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\Program Files\U-Storage Tools2.1
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [DigiSrv] C:\WINDOWS\Twain_32\DigiCam\DigiSrv.exe
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Generic\Seticon.exe
    O4 - HKLM\..\Run: [UsbPhoneLinker] E:\English\VoiceServe.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [MsMovies] C:\Program Files\MsMovies\MsMovies.exe /auto
    O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
    O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
    O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "x:\program files\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [CallMe] C:\Program Files\CallMe\CallMe.exe
    O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000137.exe
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Startup: Konfabulator.lnk = C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Jamie Addis\Application Data\Mozilla\Firefox\Profiles\default.jlq\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
    O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Jamie Addis\Application Data\Mozilla\Firefox\Profiles\default.jlq\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1EEC3C99-7AA3-4F6E-B381-AF6942B51618} - [url]http://www.lazychestnuts.net/0015/ph/pup.CAB[/url]
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - [url]http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe[/url]
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [url]http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab[/url]
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [url]http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111347963437[/url]
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - [url]http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab[/url]
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - [url]http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab[/url]
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
    O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • SanfamSanfam I like clocks.
    [QUOTE][i]Originally posted by ShadowDancer [/i]
    [B]ok, here's the log file. running stinger now (forgot about that actually, or id have run it already:rolleyes: )

    Logfile of HijackThis v1.99.1
    Scan saved at 20:19:31, on 06/11/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:

    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    Files\Real\Update_OB\realsched.exe (just because it's evil)
    C:\program files\u-storage tools2.1\ustorage.exe
    C:\Program Files\QuickTime\qttask.exe (see above. evil.)
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Generic\Seticon.exe

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\Program Files\U-Storage Tools2.1
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Generic\Seticon.exe
    O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000137.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1EEC3C99-7AA3-4F6E-B381-AF6942B51618} - [url]http://www.lazychestnuts.net/0015/ph/pup.CAB[/url]
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - [url]http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe[/url]
    O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
    [/B][/QUOTE]

    This is just for my reference at the moment. Narrowing the list down, trying to find some suspects...
    it's difficult!

    Don't delete any of these yet.

    If you can, install and run AVG. that should give you something for a while. Also, run over to the Hijack This forums and post thatlog over there. I'm making little progress on this. Way too much seems either standard issue or close enough to it to be dangerous.
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    oh this is interesting: AVG found that out of 97649 scanned objects on my pc, 12981 were infected with something. the scan took 5hrs 26mins to run, it was started at 8.30am this morning, and now at 5.25pm the 'healing' process is still running and is currently 63% complete:rolleyes:

    Edit: then it crashed:rolleyes:
  • SanfamSanfam I like clocks.
    Either way, you've got a decent sized infection there ;)
  • ShadowDancerShadowDancer When I say, "Why aye, gadgie," in my heart I say, "Och aye, laddie." London, UK
    well i figured if your gonna do anything, do it in style;)
  • Morden279Morden279 Genius
    My sympathies mate. :(

    I had to do a complete reformat 3 months ago on my PC, which was a right pain in the arse. However, a combination of McAfee, AdAware, and Spybot seem to be keeping my PC free of buggers and whatnot at the moment.
  • Data CrystalData Crystal Pencil Artist
    Antivir XP, ZoneAlarm, SpyBot, Ad-Aware SE, Microsoft AntiSpyware from time to time and RegCleaner (build 740) keep me pretty well defended. :D

    Mainly just Free-Av for virus, Zone for Fire, Ad-Aware for adware and Spybot for registry vaccination.
Sign In or Register to comment.