Help - Search - Members - Calendar
Full Version: guarduptodate.net
Lavasoft Support Forums > Archived Topics > Archives: Resolved/Inactive Topics > Resolved/Inactive General Support Issues
Keefer
I have some problems on my PC. First, there are 2 strange icons on my system tray saying that my computer is infected with virus (one is flashing and the other one isn't), and there are 2 strange icons on my desktop too (Security Troubleshooter & Security Update). Also, my IE homepage has been changed to guarduptodate.net, and every 5 minutes or so some popups keep appearing (ULWindowSeek & ULWindowURL). After I scan my computer with Ad-Aware, the Security Troubleshooter & Security Update icons disappeared, but the flashing icon saying Virus Alert! are still there (the other one disappeared), and those annoying popups still appear as well.

This is my latest logfile from Ad-Aware scan :

Ad-Aware SE Build 1.06r1
Logfile Created on:Friday, June 02, 2006 12:47:54 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R110 31.05.2006
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

References detected during the scan:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
MRU List(TAC index:0):17 total references
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


6-2-2006 12:47:54 PM - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\Freddy\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office


MRU List Object Recognized!
Location: : C:\Documents and Settings\Freddy\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\mediaplayer\preferences
Description : last playlist index loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\windows\currentversion\applets\regedit
Description : last key accessed using the microsoft registry editor


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\windows\currentversion\explorer\runmru
Description : mru list for items opened in start | run


MRU List Object Recognized!
Location: : S-1-5-21-507921405-1177238915-682003330-1004\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


Listing running processes
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 444
ThreadCreationTime : 6-2-2006 5:41:52 AM
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 492
ThreadCreationTime : 6-2-2006 5:41:54 AM
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 516
ThreadCreationTime : 6-2-2006 5:41:56 AM
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 560
ThreadCreationTime : 6-2-2006 5:41:56 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 572
ThreadCreationTime : 6-2-2006 5:41:56 AM
BasePriority : Normal
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 756
ThreadCreationTime : 6-2-2006 5:41:57 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 824
ThreadCreationTime : 6-2-2006 5:41:58 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 976
ThreadCreationTime : 6-2-2006 5:41:59 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1012
ThreadCreationTime : 6-2-2006 5:42:00 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [ccevtmgr.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1112
ThreadCreationTime : 6-2-2006 5:42:01 AM
BasePriority : Normal
FileVersion : 1.00.37
ProductVersion : 1.00.37
ProductName : Event Manager
CompanyName : Symantec Corporation
FileDescription : Event Manager Service
InternalName : ccEvtMgr
LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : ccEvtMgr.exe

#:11 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1316
ThreadCreationTime : 6-2-2006 5:42:03 AM
BasePriority : Normal
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:12 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 1420
ThreadCreationTime : 6-2-2006 5:42:04 AM
BasePriority : Normal
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE

#:13 [ctfmon.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1448
ThreadCreationTime : 6-2-2006 5:42:04 AM
BasePriority : Normal
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:14 [dcomcfg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1616
ThreadCreationTime : 6-2-2006 5:42:09 AM
BasePriority : Normal


#:15 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1692
ThreadCreationTime : 6-2-2006 5:42:10 AM
BasePriority : Normal
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:16 [navapsvc.exe]
FilePath : C:\Program Files\Norton AntiVirus\
ProcessID : 1732
ThreadCreationTime : 6-2-2006 5:42:10 AM
BasePriority : Normal
FileVersion : 9.00.1104
ProductVersion : 9.00.1104
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Auto-Protect Service
InternalName : NAVAPSVC
LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : NAVAPSVC.EXE

#:17 [nvsvc32.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1844
ThreadCreationTime : 6-2-2006 5:42:11 AM
BasePriority : Normal
FileVersion : 6.14.10.6672
ProductVersion : 6.14.10.6672
ProductName : NVIDIA Driver Helper Service, Version 66.72
CompanyName : NVIDIA Corporation
FileDescription : NVIDIA Driver Helper Service, Version 66.72
InternalName : NVSVC
LegalCopyright : © NVIDIA Corporation. All rights reserved.
OriginalFilename : nvsvc32.exe

#:18 [srvany.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1872
ThreadCreationTime : 6-2-2006 5:42:11 AM
BasePriority : Normal


#:19 [resetservice.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1916
ThreadCreationTime : 6-2-2006 5:42:12 AM
BasePriority : Normal


#:20 [ccapp.exe]
FilePath : C:\Program Files\Common Files\Symantec Shared\
ProcessID : 1988
ThreadCreationTime : 6-2-2006 5:42:12 AM
BasePriority : Normal
FileVersion : 1.00.104
ProductVersion : 1.00.104
ProductName : Common Client
CompanyName : Symantec Corporation
FileDescription : Common Client CC App
InternalName : ccApp
LegalCopyright : Copyright © 2000-2002 Symantec Corporation. All rights reserved.
OriginalFilename : ccApp.exe

#:21 [wdfmgr.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 2016
ThreadCreationTime : 6-2-2006 5:42:13 AM
BasePriority : Normal
FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act)
ProductVersion : 5.2.3790.1230
ProductName : MicrosoftR WindowsR Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows User Mode Driver Manager
InternalName : WdfMgr
LegalCopyright : c Microsoft Corporation. All rights reserved.
OriginalFilename : WdfMgr.exe

#:22 [realsched.exe]
FilePath : C:\Program Files\Real Alternative\Update_OB\
ProcessID : 232
ThreadCreationTime : 6-2-2006 5:42:15 AM
BasePriority : Normal
FileVersion : 0.1.0.3208
ProductVersion : 0.1.0.3208
ProductName : RealPlayer (32-bit)
CompanyName : RealNetworks, Inc.
FileDescription : RealNetworks Scheduler
InternalName : schedapp
LegalCopyright : Copyright c RealNetworks, Inc. 1995-2004
LegalTrademarks : RealAudio™ is a trademark of RealNetworks, Inc.
OriginalFilename : realsched.exe

#:23 [msmsgs.exe]
FilePath : C:\Program Files\Messenger\
ProcessID : 396
ThreadCreationTime : 6-2-2006 5:42:19 AM
BasePriority : Normal
FileVersion : 4.7.0041
ProductVersion : Version 4.7
ProductName : Messenger
CompanyName : Microsoft Corporation
FileDescription : Messenger
InternalName : msmsgs
LegalCopyright : Copyright © Microsoft Corporation 1997-2001
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msmsgs.exe

#:24 [opera.exe]
FilePath : D:\Opera\
ProcessID : 2448
ThreadCreationTime : 6-2-2006 5:43:06 AM
BasePriority : Normal
FileVersion : 7730
ProductVersion : 8.54
ProductName : Opera Internet Browser
CompanyName : Opera Software
FileDescription : Opera Internet Browser
InternalName : Opera
LegalCopyright : Copyright c Opera Software 1995-2006
OriginalFilename : Opera.exe

#:25 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 1404
ThreadCreationTime : 6-2-2006 5:47:06 AM
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright c Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17


Started registry scan
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Registry Scan result:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17


Started deep registry scan
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Deep registry scan result:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17


Started Tracking Cookie scan
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»


Tracking cookie scan result:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17



Deep scanning and examining files (C:)
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Disk Scan Result for C:\
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17


Deep scanning and examining files (D:)
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Disk Scan Result for D:\
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17


Deep scanning and examining files (E:)
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Disk Scan Result for E:\
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï
½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Hosts file scan result:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
1 entries scanned.
New critical objects:0
Objects found so far: 17




Performing conditional scans...
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»

Conditional scan result:
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
New critical objects: 0
Objects found so far: 17

12:55:20 PM Scan Complete

Summary Of This Scan
ササササササササササササササササササササササササササï½
»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»ï½»
Total scanning time:00:07:26.516
Objects scanned:109448
Objects identified:0
Objects ignored:0
New critical objects:0
GRAFX
Keefer,
Please can you try at least two if not more of these On-line scans
Panda
Symantec
McAfee
TrendMicro
Bit Defender
Kaspersky
CommandonDemand
Computer Associates
CyberTechHelp
PC Pitstop
Stinger
Also please use one or both of these Trojan scanners
a2
or download and try
TrojanHunter (Note Trojan Scanner 30 day Trial)

Then once you have done clear out your cache folder again ie: Run
CCleaner
(Note in CCleaner: go to >options > advanced > Uncheck "Only delete files in Windows Temp folders older than 48 hours"). but see CCleaner Set up

Then after doing that can you download HijackThis
After you have downloaded it and Unzipped it, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, and then can you please post you Logfile in the
HijackThis Logs forum.
Call it some ting like "my HijachThis log" in the Topic Title
and then put "referred by GRAFX" as the Topic Description

Also Please can you include a link to this post for reference

GRAFX
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2010 Invision Power Services, Inc.