Psw.onlinegames3 / done all 8 steps but still stays

By Kold
Nov 17, 2009
  1. Kold

    Kold TS Rookie Topic Starter

    im not sure if this might help but when i run Malwarebytes and SUPERantispyware in safe mode my computer seems to be clean but when i switch back to normal mode avg reports me infection .
  2. Kold

    Kold TS Rookie Topic Starter

    Bobbye help pls , where are you ?
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Ha! I'm hiding! There are too many of you with infected systems!

    Okay- first I will welcome you to TechSpot.

    Then I will tell you that if you want support, you're going to have to get rid of two pirated programs:


    After you have done that, please rescan with HijackThis and paste in a new log.

    Please tell me if you are in Iran or could be using a server there.
  4. Kold

    Kold TS Rookie Topic Starter

    Hello there , i solved the problem by reinstalling windows . my pc is clean now . but i doubt those two key generators had anything to do with stubborn psw.gameonline trojan . anyway its gone now
    yes im in iran ,and ill be glad to help out . but how did you know that ? name of my directories ?
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Kold, the pirated programs likely didn't directly cause your problem. However, we don't support piracy so I had to request that you remove them to continue.

    The Iran connection?
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D80E8DC9-59B8-4D94-B1E3-D9E5BB3C8269}: NameServer =,

    Checking the arinwhois database referred me to the RIPE backbone. The IP belongs to:
    descr: SHATEL Network Infrastructure
    country: IR

    So verifying your location would appear to make this a valid entry.

    A DSN Changer will usually cause multiple lines of this type, with a foreign IP.

    The directories? I take it you mean the following:

    Open the Superantispyware log> you will see that this Trojan.Agent/Gen-FSG has been found in the above. So while the programs themselves might not be a cause of the problem, the 'junk' that usually comes with these type of sites usually is.

    Here are the legitimate downloads for this program. Using a crack/key would indicate privacy.
    For private use:
    3DMark05 Pro (Download):
    $14.95 CLICK TO BUY!

    3DMark05 Pro (CD-ROM):
    $24.95 CLICK TO BUY!

    While there is a 3DMark®05 Free Version (Build 1.3.0), it is a limited version to be followed by purchase. You wouldn't have needed a key or license.

    So please remove the program, game, backup and other files that are associated.

    IF you decide to do this, follow with:
    Please download ComboFix HERE:
    • With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
    • Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection.
    • Run Combo-Fix.exe and follow the prompts.
      (Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.)
    • Wait for the scan to be completed.
    • If it requires a reboot, please do it.
    • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)


    • 1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
      2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
      3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
      4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    Then a new scan with HijackThis. Please paste this one log into the next reply.

    But attach the Combofix report.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...