SBS1985C SG My computer kena Spyware. One of them I know it as Brave Sentry. How do I remove them? Here is my logfile. I hope I did not miss out any. Logfile of HijackThis v1.99.1 Scan saved at 1:05:49 AM, on 7/17/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\System32\scrovfpo.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\cleanmgr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Documents and Settings\Scania Volvo\Desktop\hijackthis\HijackThis.exe R3 - Default URLSearchHook is missing O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [rpcc] rpcc.exe O4 - HKLM\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe O4 - HKLM\..\Run: [Explorer 2238] C:\WINDOWS\System32\dxvwjuvk.exe O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\SCANIA~1\LOCALS~1\Temp\28.tmp3072.exe O4 - HKCU\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\WINDOWS\System32\lolfacga.dll O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_27.dll O21 - SSODL: VtjQKRFnSKcN - {305EFB84-9AF4-512E-6F39-5A4861C58094} - C:\WINDOWS\System32\yaes.dll O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe -------------- Spy Sweeper. 9:21 PM: | Start of Session, Sunday, July 16, 2006 | 9:21 PM: Spy Sweeper started 9:21 PM: Sweep initiated using definitions version 719 9:21 PM: Found Trojan Horse: trojan-backdoor-cyn 9:21 PM: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\artm_newreg\ || dllname (ID = 1532249) 9:21 PM: artm_new.dll (ID = 1532249) 9:21 PM: Found Trojan Horse: trojan-backdoor-msdcom32 9:21 PM: HKCR\clsid\{2c1cd3d7-86ac-4068-93bc-a02304bb2236}\inprocserver32\ (2 subtraces) (ID = 1532296) 9:21 PM: 2236_27.dll (ID = 1532296) 9:21 PM: Found Trojan Horse: trojan-downloader-evko.biz 9:21 PM: HKLM\software\microsoft\windows\currentversion\run\ || system (ID = 1532301) 9:21 PM: testtestt.exe (ID = 1532301) 9:21 PM: Found Trojan Horse: trojan-backdoor-securemulti 9:21 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || taskdir (ID = 1220571) 9:21 PM: taskdir.exe (ID = 1220571) 9:21 PM: Found Trojan Horse: trojan-backdoor-adagoe 9:21 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || winmedia (ID = 1374371) 9:21 PM: 28.tmp3072.exe (ID = 1374371) 9:21 PM: Starting Memory Sweep 9:22 PM: Detected running threat: C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll (ID = 425) 9:25 PM: Memory Sweep Complete, Elapsed Time: 00:04:22 9:25 PM: Starting Registry Sweep 9:34 PM: Found Adware: bravesentry 9:34 PM: HKLM\software\microsoft\windows\currentversion\uninstall\bravesentry\ (5 subtraces) (ID = 1198509) 9:34 PM: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\artm_newreg\ (4 subtraces) (ID = 1499383) 9:34 PM: HKCR\clsid\{2c1cd3d7-86ac-4068-93bc-a02304bb2236}\ (3 subtraces) (ID = 1531605) 9:34 PM: HKLM\software\classes\clsid\{2c1cd3d7-86ac-4068-93bc-a02304bb2236}\ (3 subtraces) (ID = 1531609) 9:34 PM: HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload\ || dcom server 2236 (ID = 1531611) 9:34 PM: HKLM\software\microsoft\windows\currentversion\run\ || system (ID = 153229 9:34 PM: HKLM\software\microsoft\windows\currentversion\runservices\ || systemtools (ID = 1532300) 9:34 PM: HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler\ || {2c1cd3d7-86ac-4068-93bc-a02304bb2236} (ID = 1533943) 9:37 PM: Found Adware: bravesentry fakealert 9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || windows update loader (ID = 119843 9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\bravesentry\ (12 subtraces) (ID = 1198479) 9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || bravesentry (ID = 1199973) 9:37 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\software\microsoft\windows\currentversion\run\ || winmedia (ID = 1333205) 9:40 PM: Registry Sweep Complete, Elapsed Time:00:14:41 9:40 PM: Starting Cookie Sweep 9:40 PM: Found Spy Cookie: atlas dmt cookie 9:40 PM: scania [email protected][2].txt (ID = 2253) 9:40 PM: Found Spy Cookie: 2o7.net cookie 9:40 PM: scania [email protected][1].txt (ID = 195 9:40 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 9:40 PM: Starting File Sweep 9:42 PM: taskdir.exe (ID = 321110) 9:42 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run || taskdir (ID = 0) 9:42 PM: desktop.html (ID = 258792) 9:43 PM: Found Adware: spysheriff fakealert 9:43 PM: vxt4.game (ID = 242074) 9:43 PM: Found Trojan Horse: trojan-downloader-asdbiz.biz 9:43 PM: vxgamet4.exe (ID = 80237) 9:43 PM: 2.dlb (ID = 318284) 9:44 PM: dlh9jkdq2.exe (ID = 318284) 9:44 PM: qvxt2.game (ID = 80237) 9:44 PM: qvxgamet2.exe (ID = 80237) 9:44 PM: qvxt4.game (ID = 80237) 9:44 PM: desktop.htt (ID = 321134) 9:44 PM: qvxgamet4.exe (ID = 80237) 9:44 PM: vxgamet1.exe (ID = 273845) 9:44 PM: ipod[1].raw (ID = 321110) 9:44 PM: vxgamet3.exe (ID = 318419) 9:44 PM: vxt1.game (ID = 290922) 9:44 PM: Found Trojan Horse: rsysinit 9:44 PM: rsysinit.exe (ID = 119324) 9:45 PM: xpupdate.exe (ID = 318284) 9:45 PM: HKU\WRSS_Profile_S-1-5-21-484763869-776561741-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run || Windows update loader (ID = 0) 9:45 PM: vx3.game (ID = 80237) 9:45 PM: vxgame3.exe (ID = 80237) 9:45 PM: Found Trojan Horse: trojan-backdoor-satellite 9:45 PM: thematrixhasyou.exe (ID = 28733 9:45 PM: Found Trojan Horse: trojan-downloader-game4all.biz 9:45 PM: vx4.game (ID = 311176) 9:45 PM: vx6.game (ID = 80237) 9:45 PM: vxgame6.exe (ID = 80237) 9:45 PM: testtestt.exe (ID = 318419) 9:45 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || System (ID = 0) 9:45 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices || SystemTools (ID = 0) 9:46 PM: qvxt3.game (ID = 32117 9:46 PM: ipod.raw.exe (ID = 321110) 9:46 PM: _zskwrkni05ldlagbpjq^caw]he.dll (ID = 319296) 9:46 PM: taskdir.dll (ID = 271080) 9:46 PM: _zskwrkni05`lbqwk`k`xw[^cje.dll (ID = 319296) 9:46 PM: _zskwrkni05jobftohgk_qse]vd.dll (ID = 319296) 9:47 PM: _zskwrkni05vg^gcupay^hfn_`x.dll (ID = 319296) 9:49 PM: Found Trojan Horse: trojan-backdoor-agegalaxy 9:49 PM: yaes.dll (ID = 29469 10:22 PM: desktop.html.lnk (ID = 258792) 10:22 PM: File Sweep Complete, Elapsed Time: 00:41:43 10:22 PM: Full Sweep has completed. Elapsed time 01:01:01 10:22 PM: Traces Found: 91
MosPosterior SG Hahaha... Finally your turn liao... Your com si bei juay torjon... one of them is rpcc... Remove these things... O4 - HKLM\..\Run: [rpcc] rpcc.exe O4 - HKLM\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe O4 - HKLM\..\Run: [Explorer 2238] C:\WINDOWS\System32\dxvwjuvk.exe O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\SCANIA~1\LOCALS~1\Temp\28.tmp3072.exe O4 - HKCU\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\WINDOWS\System32\lolfacga.dll O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_27.dll O21 - SSODL: VtjQKRFnSKcN - {305EFB84-9AF4-512E-6F39-5A4861C58094} - C:\WINDOWS\System32\yaes.dll O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe Edit: Spyware Doctor is not spyware.
ndmmxiaomayi SG O4 - HKCU\..\Run: [BraveSentry] C:\Program Files\BraveSentry\BraveSentry.exe Solving Brave Sentry Follow the instructions in the above site. If it doesn't work, then do the manual way as stated below. C:\WINDOWS\System32\scrovfpo.exe R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe O4 - HKLM\..\Run: [Explorer 2238] C:\WINDOWS\System32\dxvwjuvk.exe O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\SCANIA~1\LOCALS~1\Temp\28.tmp3072.exe O4 - HKCU\..\Run: [ÿ_zskejc^[wx`k`kwqbl`50inkrwksz_] c:\windows\system32\_zskwrkni05`lbqwk`k`xw[^cje.exe O20 - AppInit_DLLs: sysiusrc.dll hhsedpvo.dll O20 - Winlogon Notify: scrovfpo - C:\WINDOWS\System32\scrovfpo.dll O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\WINDOWS\System32\lolfacga.dll O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_27.dll O21 - SSODL: VtjQKRFnSKcN - {305EFB84-9AF4-512E-6F39-5A4861C58094} - C:\WINDOWS\System32\yaes.dll O21 - SSODL: DCOM Server 2238 - {2C1CD3D7-86AC-4068-93BC-A02304BB2238} - C:\WINDOWS\System32\dxvwjuvk.exe Tick these entries and click Fix Checked. O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\testtestt.exe Solve testtestt.exe. Select the Advanced tab. Follow the instructions there. O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe Solve xpupdate.exe. Again, click on the Advanced tab and follow instructions. To update your XP, go to Start, All Programs, Windows Update. It's at the top. As for the Webroot Spysweeper log, did you try using the program to clear anything that was found?
ndmmxiaomayi SG Don't think he surfed porn. More like he tio conned, because he never patch his system.
ndmmxiaomayi SG Indeed. I think elindra's description of him can change liao. Ok, no more jokes. Where's SBS1985C? Too jialat until cannot online?
Rejected SG update your Service Pack to SP2 if your computer is currently running on SP1, update your Anti-Virus programme. If the problem still persist, you have no choice but to reboot your computer. cheers mate.
ndmmxiaomayi SG Like that is ask me for fun de ar? Waste my time doing research sia... if not I finish my school work long ago...
