You all are the only forums that truly help, but issch.exe and Flexnet macrovision

You all are the only forums that truly help,...

Rate Topic

Display Mode

Topic Options

Author

Message

Capuchin

Posted 8/18/2008 1:21 PM

New Member

Group: Forum Members
Last Login: 8/2/2008 11:00 AM
Posts: 84, Visits: 133

Is there any thing else you could suggest to me other than the complimentary links most likely I will be directed tooo on how to better protect my computer. I am just curious as to what you may use? i use both the comodofirewall and the anti vir virus both free programs. any advice would be great and should I delete shadow copies and restore points to start fresh/

" Hello Monkey, this is Captain TweakXP, you need to get out of the house now, the hacker is in your house get out NOW!"
God B
monkey

Post #243383

RichieUK

Posted 8/18/2008 3:11 PM

Senior Forum Moderator

Group: Moderators
Last Login: 8/9/2008 10:14 AM
Posts: 29,030, Visits: 54,734

I am just curious as to what you may use? i use both the comodofirewall and the anti vir virus both free programs.

I personally use Avira AntiVir Personal - FREE Antivirus on all my pc's.
As for firewalls i use a mixture of Sygate Personal Firewall [Free] and PC Tools Firewall Plus [Free].

should I delete shadow copies and restore points to start fresh/

Yes,you could do that.
Click Start/All Programs/Accessories/Run
Type cleanmgr into the 'Open:' space then press OK
In the 'Disk Cleanup: Drive Selection' box select the disk to clean up and then click OK
In the 'Disk Cleanup' dialog box, select the 'More Options' tab.
To remove all system restore points and shadow copies except the most recent,click 'Clean Up' under 'System Restore And Shadow Copies'.
When prompted to confirm that you want to delete this data, click Delete.

________________________________________

ASAP & UNITE member since 2006

Post #243388

Capuchin

Posted 8/19/2008 5:37 PM

New Member

Group: Forum Members
Last Login: 8/2/2008 11:00 AM
Posts: 84, Visits: 133

Just when I thought it was safe to compute again. I just bought a DXG video camera and all the fixins it came with two cds of software for the camera. One called total media extreme for DV and the other is called Prestol Video Works and Prestol Mr. Photo 4 which I got an error message late last night for it didn't install right. So this morning I decided after our weeklong kick butt virus hijack this mayhem ran the Avira anti virus full system scan since it was practically screaming at me to do so. It found 2 suspicious and 5 warnings the other on the captured attachment has been sitting in limbo and until something doesn't work I will leave it there for the time being. I have no idea as to what these new virus warnings are but they are part of new software never installed on this computer, your suggestion?

" Hello Monkey, this is Captain TweakXP, you need to get out of the house now, the hacker is in your house get out NOW!"
God B
monkey

Post #243399

RichieUK

Posted 8/19/2008 5:53 PM

Senior Forum Moderator

Group: Moderators
Last Login: 8/9/2008 10:14 AM
Posts: 29,030, Visits: 54,734

Sounds like false positives to me,lets try the following.
Download the 30 day free trial of Kaspersky Anti-Virus 2009:
http://www.kaspersky.com/trials

Next uninstall Avira AntiVir Personal - FREE Antivirus,restart your pc,then install Kaspersky.
Run a full system scan,let me know if Kaspersky detects anything.

________________________________________

ASAP & UNITE member since 2006

Post #243401

Capuchin

Posted 8/20/2008 5:27 PM

New Member

Group: Forum Members
Last Login: 8/2/2008 11:00 AM
Posts: 84, Visits: 133

HELP

It did detect something and here is the full report and I don't want to try to fix it until I hear from you my computer is just crawling now all of a sudden. I don't know if it is this virus stuff or my new DXG camcorder software by arcsoft doing the drag...here is the report and a capture of the detections

Quick Scan: completed 8/20/2008 3:04:58 PM   (events: 2, objects: 3380, time: 00:01:35)
8/20/2008 3:03:22 PM Task started
8/20/2008 3:04:58 PM Task completed
Quick Scan: completed 8/20/2008 3:04:58 PM   (events: 2, objects: 3380, time: 00:01:35)
8/20/2008 3:19:50 PM Task started
8/20/2008 3:30:09 PM Task completed
Quick Scan: completed 8/20/2008 3:04:58 PM   (events: 2, objects: 3380, time: 00:01:35)
8/20/2008 3:30:54 PM Task started
8/20/2008 3:33:36 PM Detected: http://www.viruslist.com/en/advisories/31106 c:\program files\mozilla firefox\firefox.exe
8/20/2008 3:53:40 PM Detected: http://www.viruslist.com/en/advisories/31106 c:\program files\mozilla firefox\firefox.exe
8/20/2008 5:06:08 PM Detected: http://www.viruslist.com/en/advisories/31106 K:\Program Files\firefox profiles bkup\firefox.exe
8/20/2008 5:07:05 PM Task completed

" Hello Monkey, this is Captain TweakXP, you need to get out of the house now, the hacker is in your house get out NOW!"
God B
monkey

Post #243412

RichieUK

Posted 8/21/2008 2:03 AM

Senior Forum Moderator

Group: Moderators
Last Login: 8/9/2008 10:14 AM
Posts: 29,030, Visits: 54,734

www.viruslist.com/en/advisories/31106

Read and follow the advice given in the link below.
Mozilla Firefox 3 URI Launching and XUL Error Page Vulnerabilities:
http://www.viruslist.com/en/advisories/31106

I don't know if it is this virus stuff or my new DXG camcorder software by arcsoft doing the drag...here is the report and a capture of the detections

Uninstall Kaspersky Antivirus if you're not interested in buying it,then reinstall Avira AntiVir Personal - FREE Antivirus.

Your pc is virus free,check on the Arcsoft website for any DXG camcorder program updates,if still no joy i suggest you contact their technical support department,see if they can throw any light on the issue.

________________________________________

ASAP & UNITE member since 2006

Post #243413

Capuchin

Posted 8/25/2008 11:19 PM

New Member

Group: Forum Members
Last Login: 8/2/2008 11:00 AM
Posts: 84, Visits: 133

Dear RitchieUK

I just wanted to post what I hope to be my last hijack this log for some time and was wondering if you could give my log a clean bill of health. I read you can omit files from Hijack this Scans so if there ever was a God forbid next time we or I could have a more narrowed down look into my registry. If you agree with this idea please drop a line and let me know. one last thing I have been using the Glary Utilities from Cnet along with CCleaner and Glary has to be the best cleaning, speeding, educating, filing, etc. utility I have ever used and it is free. It was released just a week ago and it is number 2 on Cnet. Just thought I would let your readers and yourself know about something I discovered that was good and not always bad. Take care

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:56 PM, on 8/25/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Logitech\SetPoint\LBTWiz.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\KbdStub.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Common Files\Logishrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Windows\system32\WerFault.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe" -delete
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [NVIDIA nTune] C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe resetprofile
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3933180567-1906462313-899874194-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-3933180567-1906462313-899874194-1000\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent (User 'IUSR_NMPR')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html