First off, thanks for those wonderful instructions. They were very clear. I've attached the HJT logs and the AVG-AntiSpyware logs. The AVG-AS log is an old one. Basically, I entered safe mode and did an AVG-AS scan and saved the log. Then I remembered I had not revealed hidden files. So I redid all the scans and since nothing new showed up, I figured I might as well stick the old log.

I've basically seen the BSoD twice today, which has never happened before.

Attached Files

	hijackthis.log (11.2 KB, 2 views)
	Report-Scan-20061220-173302.txt (53.9 KB, 3 views)

First off, you need to delete everything in AVG's quarantine.
I also noticed quite a few chk files, you should run scandisk on your hard drive.

Once done, post a fresh HJT log.


[B][COLOR="Red"]This thread is for the use of [/COLOR]leosoybean [COLOR="Red"]only. [/COLOR][COLOR="Red"]Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/B][/COLOR]

Hello and welcome to Techspot.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how HERE.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Viewpoint
Viewpoint Manager

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

ViewMgr.exe
YRD45F.EXE
installer.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/tes...enXInstall.cab

O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://asp.mathxl.com/applets/PearsonInstallAsst.cab

O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab

O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} - http://a532.g.akamai.net/f/532/6712/...m/6712/player/ install3.5/installer.exe

O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} (Pearson MyEconLab Player Control) - http://asp.mathxl.com/books/_Players/EconPlayer.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{80CB366D-58AC-4DBF-BCE2-ADBB051C978E}: Domain = rutgers.eduFix this if you don`t recognise the domain.

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\Viewpoint<Delete the entire folder.
C:\WINDOWS\TEMP\YRD45F.EXE

Reboot into normal mode, turn system restore back on and rehide your protected OS files.

Post a fresh HJT log and let us know how your system is running.

Regards Howard

[color=red]This thread is for the use of[/color] leosoybean [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color]

I've amalgamated both of your suggestions:

1) I did a scandisk (I think) by right-clicking on the Crive>Properties>Tools>Error-checking

2) I didn't clear the quarantines only because there was nothing in quarantine. I usually don't quarantine objects (as they tend to be only cookies). The Virus vault was empty as well.

3) Removed Viewpoint and all it's components.

I should note that the processes you listed to kill were not there in safe mode. Also, I've previously read up on the .exe hiding in that Windows/TEMP folder and it turns out that it's connected to Trend Micro OfficeScan, which I use. It apparently renames itself every boot up? At any rate, I've found that it cannot be deleted and it doesn't appear under safe mode.

Otherwise my system seems peachy. The BSoD only popped up while attempting to install some of the scanning programs suggested in the general help page. However, when I did an AVG virus system scan last night in safe mode, it scanned reading errors for the partition table and boot sector of disk C:. A full scan this morning revealed nothing. Should I be concerned?

Again thanks for the help. It is invaluable.

Attached Files

hijackthis12-21.txt (9.4 KB, 2 views)

Mmm, may I ask where you found the info on the Trend office scan temp file?

I`d be very interested and grateful to know.

Regards Howard

[color=red]This thread is for the use of[/color] leosoybean [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color]

http://forums.majorgeeks.com/archive/index.php/t-43052

Apparently it changes names so that mal-ware has a harder time detecting it. Someone looked at it with a hex editor (w/e that is =D).

Thank you very much for the info. I have checked it with several websites, including the Trend website and you info is 100% correct.

Thanks again.

Regards Howard

[color=red]This thread is for the use of[/color] leosoybean [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color]

Hey sorry to have to post again, I went through all the steps for spyware/malware/virus preliminary cleansing and it seemed to have done something good. I was just wondering if anyone could look at the logs? The AVG Antiroot Kit found nothing.

Attached Files

	hijackthis.txt (10.2 KB, 1 views)
	log.txt (4.9 KB, 1 views)
	Report-Scan-20070609-194110.txt (10.3 KB, 1 views)

You appear to be running more than one antivirus programme. Trend and AVG. This is not recommended, will slow your system down and can cause serious conflicts. You should uninstall one antivirus programme immediately.

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop. The Avenger script is attached to the bottom of this post.

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as fresh HJT and Combofix logs.

Regards Howard

[color=red]This thread is for the use of[/color] leosoybean [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color]

Attached Files

avengerscript.txt (203 Bytes, 1 views)

Thanks again

Attached Files

	hijackthis.txt (8.9 KB, 1 views)
	avenger.txt (1.5 KB, 1 views)
	ComboFix.txt (3.6 KB, 1 views)

Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} - http://a532.g.akamai.net/f/532/6712/...m/6712/player/ install3.5/installer.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{80CB366D-58AC-4DBF-BCE2-ADBB051C978E}: Domain = rutgers.edu<Only fix this if you don`t recognise the domain.

Click on the fix checked button.

Close HJT and reboot your system. Delete the Avenger backups.

Other than the above, your logfiles look clean.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

[color=red]This thread is for the use of[/color] leosoybean [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color]