HELP!!!!!!!!!!!!!

last SG · 2007-10-29T15:01:59+00:00

SmitRem is not updated, SmitfraudFix is. Use SmitfraudFix.

ndmmxiaomayi SG

What program?

And you must be talking pillow's brother. Laughing

MyPillowTalks SG

Laughing

i saw my pillow's picture in the background! i ish soooo heypi

just now the SDfix

ndmmxiaomayi SG

Did SDFix run ?

MyPillowTalks SG

eat eat eat Laughing

MyPillowTalks SG

back to the same lea

wa is the last step?

MyPillowTalks SG

SDFix: Version 1.112

Run by Administrator on 10/29/2007 Mon at 03:34 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDfix\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\ATHPRX~1.DLL - Deleted
C:\WINDOWS\dat.txt - Deleted
C:\WINDOWS\regedit.com - Deleted
C:\WINDOWS\rs.txt - Deleted
C:\WINDOWS\search_res.txt - Deleted
C:\WINDOWS\MOVCTR~1.DLL - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Westwood\\RA2\\mphmd.exe"="C:\\Westwood\\RA2\\mphmd.exe:* Very Happy isabled:mphmd"
"C:\\Westwood\\RA2\\gamemd.exe"="C:\\Westwood\\RA2\\gamemd.exe:*isabled:Main executable for Yuri's Revenge"
"C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:RTC App Sharing"
"C:\\Westwood\\RA2\\game.exe"="C:\\Westwood\\RA2\\game.exe:*:Enabled:Main executable for Red Alert 2"
"C:\\Program Files\\WIZET\\MapleStory\\Patcher.exe"="C:\\Program Files\\WIZET\\MapleStory\\Patcher.exe:* Very Happy isabled Razz atcher MFC ?? ????"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice"
"C:\\WINDOWS\\system32\\ftp.exe"="C:\\WINDOWS\\system32\\ftp.exe:*:Enabled:File Transfer Program"
"C:\\Program Files\\WIZET\\MapleStory\\MapleStory.exe"="C:\\Program Files\\WIZET\\MapleStory\\MapleStory.exe:*:Enabled:MapleStory"
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"="C:\\Program Files\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVU Player Component"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"="C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe:*:Enabled:Adobe Version Cue CS3 Server"
"D:\\E.G. Tuners\\System\\New Folder\\utorrent.exe"="D:\\E.G. Tuners\\System\\New Folder\\utorrent.exe:*:Enabled:¦ÌTorrent"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:
---------------

File Backups: - C:\SDfix\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sat 14 Jul 2007 56 ..SHR --- "C:\WINDOWS\system32\B70676004E.sys"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Sun 15 Jul 2007 952 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sat 17 Dec 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 9 Sep 2007 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Wed 22 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Fri 23 Feb 2007 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Mon 18 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 8 Aug 2007 85,946 A..H. --- "C:\Documents and Settings\Dennis\Local Settings\Temp\BIT5B.tmp"
Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Mon 10 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Mon 10 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Wed 11 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Mon 10 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Mon 10 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Fri 5 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\573b8bee2d25ffedabde94732ae6dbae\BIT2.tmp"
Sun 22 Jul 2007 444 ...HR --- "C:\Documents and Settings\Dennis\Application Data\SecuROM\UserData\securom_v7_01.bak"
Wed 18 Apr 2007 51,712 A..H. --- "C:\Documents and Settings\Dennis\Desktop\Desktopbackup\thumbdrive\Literature\~WRL0002.tmp"

Finished!

ndmmxiaomayi SG

I go home first. School lab closing.

MyPillowTalks SG

i still see the icons, the background gone back to white and when right click, it is the same as right clicking on a webpage Crying or Very sad

MyPillowTalks SG

i going out for some stuff

see u later mayi Laughing

mean whiel i update and scan wid trendmicro in safe mode
see if there is any improvement

ndmmxiaomayi SG

Please go to Virus Total or Jotti and upload C:\WINDOWS\system32\B70676004E.sys for scanning, then post back the results.

MyPillowTalks SG

cannot find the file u stated lea

i tink trendmicro delete when i was out

the background of desktop is still the virus thingy, excdept it is white, when i see the properties, it is : file://C:\WINDOWS\privacy_danger\index.htm

but i cannot find that privacy_danger that folder Confused

MyPillowTalks SG

just updated:

just now i shift my mouse to the top, there is a 'slide' down then there is a close button, i click liao it dissapears Surprised Confused

ndmmxiaomayi SG

How about this?

1. Right click on your desktop and select Properties

2. Select Desktop tab

3. Select Customize Desktop...

4. Select Web tab

5. Uncheck and Delete everything you find in there. (Except for "My Current Home Page.")

MyPillowTalks SG

YAY!!!
no more!

refreshments are on the 2nd page Wink Wink Laughing

bo liao SG

Ya. tis is my account.

*Kudus to all that help..

I'm really impress with IT Support & Tech Corner's Mods & people.
Very helpful, & all steps so details..

Edited: so now computer is good & safe liao?Me can go back on-line transzations liao?
*(Cun ask Pillow,as he's asleep as he tomolo morning need go sch.)

ndmmxiaomayi SG

If have no problems, just scan with your antivirus. Update before scanning.

kenn3th SG

Originally posted by MyBlosterWhines:
[b]IF u have already install flash, but when u are watching utube vide, it ask u to install active x, dun install, that's how my bro got the virus i tink[/b]

is youtube of P0rn tube Twisted Evil

ps: i dont watch p0rn, i dunno if there is porn tube or not.

ndmmxiaomayi SG

There is, some idiot posted before. I can't remember the link, but it also ends with tube. Laughing

MyPillowTalks SG

ALRIGHT! PICS are here!

thanks to everyone! Laughing Embarassed

This is wad happens, i never purposely go and open for everyone to see.....note that at the bottom right, it shows trendmicro blocking hard

this pic shows the changed background and the warnings

Finally help is here! Mr. Green

My desktop is super laggggggggggggggggg, task manager is said to be disabled by the admin(come on...im the admin Laughing )

MyPillowTalks SG

Mr. Green

« Previous Page Next Page »