I have tried virus detectors and spyware detection programs, but a lot of times when I open up Internet Explorer, I get a popup from 540.filost.com. This is my HijackThis log. Also (I apologize if this is the wrong board for this question), but I have recently reinstalled Norton AntiVirus, and now have that and AOL Safety and Security Center installed, which provides virus, firewall, and spyware protection. I would like to remove it, and want to know if Ad-Aware and Windows Firewall are good alternatives.
540.filost.com
- Thread starter tm872110
- Start date
- Status
howard_hopkinso
Posts: 21,238 +17
Hello and welcome to Techspot.
Your system is infected with quite a few nasties.
Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.
If after reading the above, you wish to clean your system, do the following.
Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.
Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.
Regards Howard :wave: :wave:
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Your system is infected with quite a few nasties.
Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.
If after reading the above, you wish to clean your system, do the following.
Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.
Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.
Regards Howard :wave: :wave:
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
You didn`t attach an AVG Antispyware log as requested. Please do so in your next reply.
Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.
Go to add remove programmes in your control panel and uninstall anything to do with(if there).
PartyGaming
PartyPoker
Close control panel.
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
RunApp.exe
Close task manager.
Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Unilever/Coupons.ca b
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll
Click on the fix checked button.
Close HJT.
Locate and delete the following bold files and/or directories(if there).
c:\ex.cab
c:\eied_s7.cab
C:\Program Files\PartyGaming<Delete the entire folder.
Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.
This is the filepath you need to enter into killbox.
C:\WINDOWS\System32\vbsys2.dll
Once your system has rebooted, rehide your protected OS files.
Post a fresh HJT log as well as an AVG Antispyware log.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.
Go to add remove programmes in your control panel and uninstall anything to do with(if there).
PartyGaming
PartyPoker
Close control panel.
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
RunApp.exe
Close task manager.
Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Unilever/Coupons.ca b
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll
Click on the fix checked button.
Close HJT.
Locate and delete the following bold files and/or directories(if there).
c:\ex.cab
c:\eied_s7.cab
C:\Program Files\PartyGaming<Delete the entire folder.
Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.
This is the filepath you need to enter into killbox.
C:\WINDOWS\System32\vbsys2.dll
Once your system has rebooted, rehide your protected OS files.
Post a fresh HJT log as well as an AVG Antispyware log.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
PartyPoker and more specifically the RunApp.exe file is classed as adware. See HERE for more info. It is of course upto you if you want to keep it or not.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
All the items in your AVG Antispyware log are ignored. You need to do a fresh scan with AVG Antispyware and set the programme to quarantine the results as per the instructions in this thread HERE. For a guide to using AVG Antispyware, look HERE.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
setup.exe
regsvr32.exe
silent_ventura5.exe
Close task manager.
Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).
O4 - HKLM\..\Run: [AOLSSCASPUpgrade] C:\Documents and Settings\Miller's\Local Settings\Temp\ssc_asp_upgrade_1.1.3.4\setup.exe
O4 - HKCU\..\RunOnce: [SSCSUD] regsvr32.exe /S
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
Click on the fix checked button.
Close HJT.
Locate and delete the following bold files and/or directories(if there).
C:\Documents and Settings\Miller's\Local Settings\Temp\ssc_asp_upgrade_1.1.3.4\setup.exe
C:\WINDOWS\system32\silent_ventura5.exe
Reboot into normal mode and rehide your protected OS files.
Post fresh HJT and AVG Antispyware logs.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
setup.exe
regsvr32.exe
silent_ventura5.exe
Close task manager.
Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).
O4 - HKLM\..\Run: [AOLSSCASPUpgrade] C:\Documents and Settings\Miller's\Local Settings\Temp\ssc_asp_upgrade_1.1.3.4\setup.exe
O4 - HKCU\..\RunOnce: [SSCSUD] regsvr32.exe /S
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
Click on the fix checked button.
Close HJT.
Locate and delete the following bold files and/or directories(if there).
C:\Documents and Settings\Miller's\Local Settings\Temp\ssc_asp_upgrade_1.1.3.4\setup.exe
C:\WINDOWS\system32\silent_ventura5.exe
Reboot into normal mode and rehide your protected OS files.
Post fresh HJT and AVG Antispyware logs.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
You can delete the Killbox backups file.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
Yes, the files in AVG can be safely removed. In fact it is definitely a good idea to get rid of them as they are not good. That`s why I always ask that items be quarantined, rather than deleted/ignored. That way I can see what needs getting rid of and anything that needs to be kept.
Ignore the files in the C:\System Volume Information\_restore for now as we`ll deal with them separately.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Ignore the files in the C:\System Volume Information\_restore for now as we`ll deal with them separately.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
Your HJT log is now clean.
Delete all files in AVG Antispyware quarantine.
Run the Ccleaner programme as per the instructions in this thread HERE.
You can safely delete the TrackingCookie.2o7, if Ccleaner doesn`t get rid of it for you.
Turn off system restore.(XP/ME only) See how HERE.
Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.
If you have any further virus/spyware problems, please post in this thread.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Delete all files in AVG Antispyware quarantine.
Run the Ccleaner programme as per the instructions in this thread HERE.
You can safely delete the TrackingCookie.2o7, if Ccleaner doesn`t get rid of it for you.
Turn off system restore.(XP/ME only) See how HERE.
Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.
If you have any further virus/spyware problems, please post in this thread.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
Keep AVG Antispyware and Ccleaner, both are very good programmes and Ccleaner is especially useful for removing temp files etc.
You can get rid of HJT and Killbox, including any Killbox backups.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
You can get rid of HJT and Killbox, including any Killbox backups.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
Run Ccleaner and click on the Windows tab. Untick Recent documents. Close Ccleaner.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
Nothing to worry about there. I take it you had Ad-Aware fix the entries?
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
howard_hopkinso
Posts: 21,238 +17
howard_hopkinso
Posts: 21,238 +17
In that case, run Ad-Aware and click on the padlock icon, delete whatever is in quarantine.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Regards Howard
This thread is for the use of tm872110 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Okay (sorry about all of this), I just scanned my computer with Spybot and found these entries, after scanning with Ad-Aware and finding nothing at all. I don't know how to create a Spybot log, so I'll list the file names.
Accoona
CAS-Client
eAcceleration
Microsoft.WindowsSecurityCenter.AntiVirusOverride
Virtual Bouncer
Web-Nexus
What do you recommend that I do with these files?
Accoona
CAS-Client
eAcceleration
Microsoft.WindowsSecurityCenter.AntiVirusOverride
Virtual Bouncer
Web-Nexus
What do you recommend that I do with these files?
- Status
Similar threads
Latest posts
-
How to play PS1 Doom on PC (and why you might want to)- amghwk replied
-
Modder builds a Nintendo Wii the size of a deck of cards- WhiteLeaff replied
-
PlayStation 5 Pro will be bigger, faster, and better using the same CPU- Squid Surprise replied
-
Apple is rolling out AirPlay support for TVs in hotel rooms- RudyBob replied
-
The Best Phones: Top Picks for Every Price Range- DanteSmith replied
