1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Virus problems!

Discussion in 'Windows - Virus and spyware problems' started by CovMan, Oct 22, 2007.

  1. CovMan

    CovMan Member

    Joined:
    May 20, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Hi,

    This forum has been so helpful in the past that I thought I would see if anyone had any ideas about the following. I have followed many steps to try to sort this computer out but, including hijackthis etc but these Viruses still seem to keep popping up (McAfee VirusScan)

    22/10/2007 12:48:49 Deleted C:\qoobox\Quarantine\C\WINDOWS\system32\bmopbehj.dll.vir Vundo
    22/10/2007 12:48:58 Deleted C:\qoobox\Quarantine\C\WINDOWS\system32\dgxsifpy.dll.vir Vundo
    22/10/2007 12:49:08 Deleted C:\qoobox\Quarantine\C\WINDOWS\system32\tcyxtpot.dll.vir Vundo
    22/10/2007 12:49:10 Moved (Clean failed because the file isn't cleanable) PC003\broker C:\QUARANTINE\A0033203.exe.Vir New Malware.ee

    Does the fact they have been identified/removed mean that the computer is now clean or is there likely to be an underlying problem which will allow them to keep coming back!?

    Many thanks!
     
  2. svtstang

    svtstang Regular member

    Joined:
    Apr 23, 2006
    Messages:
    4,565
    Likes Received:
    0
    Trophy Points:
    46
    1.Clean your registry! Two free apps to do this are Spybot Search and Destroy and Ccleaner.

    2.Post a frsh HJT log after gutting the registry and I will take a look at it :)
     
  3. bluecoal

    bluecoal Guest

    Hi CovMan,

    The first 3 messages look to me like they are files that have already been quarantined by a cleaning program called qoobox. I think you could delete that entire quarantine folder and eliminate alarms from that source.

    If you are currently using it for cleaning, it would probably be best to remove all the qoobox files and then download the most current version at a later time if you need it again.

    The last one I am not sure about, it is in a quarantine folder but I am not sure if it is one created by your earlier cleaning efforts or a subsequent problem. You could try deleting the contents of that quarantine folder and then see if McAfee continues to give you warning messages.
     
  4. CovMan

    CovMan Member

    Joined:
    May 20, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Thank you both for the advice!

    Here is the new hijackthis log:

    Logfile of HijackThis v1.99.1
    Scan saved at 11:14:41, on 03/11/2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\TridiaVNC\win32\WinVNC.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Documents and Settings\broker\My Documents\My Internet\hijackthis\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TridiaVNC\win32\WinVNC.exe" -servicehelper
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O14 - IERESET.INF: START_PAGE_URL=about:blank
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{57AD14CC-EFE1-43BF-9BFF-B3A02CCA963D}: NameServer = 192.168.100.244
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: TridiaVNC Server (winvnc) - Unknown owner - C:\Program Files\TridiaVNC\win32\WinVNC.exe" -service (file missing)

     

Share This Page