DMusic.com | for indie musicians and fans | Free MP3 music downloads - Forums: Help: dmusic pop up survey is spam or virus

Forums > Help

dmusic pop up survey is spam or virus

victorsskull	Date: December 19, 2009 @ 6:15 PM dont take it.
victorsskull	Date: December 19, 2009 @ 6:17 PM not sure if it is in your computer or from the site yet. I will update you when I know for sure. Im pretty sure its not on the site. I had this virus and it came from my computer after I downloaded some thing from another site.
sunshine	Date: December 19, 2009 @ 6:17 PM seriously if f-ed my stuff up browser hijack. DO NOT TAKE THIS SURVEY.
sunshine	Date: December 19, 2009 @ 6:18 PM i got it off my computer vic. it is no longer affected. two straight days of fighting it! UGH@
Distilled1	Date: December 19, 2009 @ 7:25 PM not from here It sounds like those ones that you get from video links and such that spread on FB and myspace like wildfire. In fact I have never received a pop up from here in all these years except the pop out shoutbox LOL
AdNauseam	Date: December 19, 2009 @ 9:42 PM I suggest putting a large, capital-letters announcement on the front page or in the header. Only active members will see this announcement in the forum, and people who are linked directly to artist pages will not even go through the main page or the forums.
potatohead	Date: December 19, 2009 @ 9:49 PM i didnt even get the pop up?
vilifiend	Date: December 19, 2009 @ 9:55 PM i suggest giving me back PB consider this a curse. give up the PB, and the curse will be lifted.
vilifiend	Date: December 19, 2009 @ 9:56 PM im friends with god. just so you know.
Opossum	Date: December 19, 2009 @ 9:56 PM I never get pop-ups, and even when one is pending, it asks me if I want to allow it, but I haven't gotten anything. It's very possible that server is already host-blocked on my computer anyway.
vilifiend	Date: December 19, 2009 @ 10:02 PM same here possum
vilifiend	Date: December 19, 2009 @ 10:02 PM adblock ftw
Distilled1	Date: December 20, 2009 @ 12:14 AM there is none here at DMusic period Or I would see they are here I search and look for them I try and get them
Distilled1	Date: December 20, 2009 @ 12:16 AM Sunshine or anyone having an issue Run Hijack this if you are ok deleting registry stuff ttp://majorgeeks.com/download3155.html Copy the text file log and note it to me or go here http://www.hijackthis.de/ after and paste the log to see what are issues or not, you must really look somethings will show bad but you have to investigate first.. or note me I will walk you through
Distilled1	Date: December 20, 2009 @ 12:16 AM http://majorgeeks.com/download3155.html
sunshine	Date: December 20, 2009 @ 8:37 AM distilled - i dnoted you the log. how did vic get rid of it? this has wore me out. its like fighting the wind. i can't win. i MUST win. help!
victorsskull	Date: December 20, 2009 @ 9:35 AM I did a system restore. went back about a week
sunshine	Date: December 20, 2009 @ 9:48 AM hhhmmm. we tried that. i will try it again and go back further.
Distilled1	Date: December 20, 2009 @ 5:32 PM sent you some help sunshine.
victorsskull	Date: December 20, 2009 @ 7:38 PM hmmmm work for me
pog	Date: December 20, 2009 @ 8:19 PM Send me the log? I'm curious to exactly what this spyware is... I dont always think hijackthis is a good solution if it's a malware infection that spreads when you remove single components. It can get very messy. Does anyone have a name for this infection??
sunshine	Date: December 21, 2009 @ 5:41 AM i call it dirty bastard. i will send you the log file later now the hijack this wont run. i have to go off the log i ran for distilled. print it at work and deal with it once again tonite. i just have so much music and pictures on this one i dont want to wipe it out.
miraclemaker	Date: December 21, 2009 @ 7:01 AM yep, Ive been there before I deffinitely would suggest going back to the future but, make sure you go back to a date when your computer was working fine.... have you tried malware bytes, its a free prog - just a thought
Distilled1	Date: December 21, 2009 @ 12:50 PM I don't know about but sunshine had quite a few BHO no names with reg keys as known Trojans, but I didn't research any further, I always use maleware bytes first then again after hijack this. I find hijack this can normaly grab the little basterd that keeps coming back not leting the other programs remove it. Bu the sound of it it sure seems to be acting like that 2000virus protector thing, although I saw no coolwebsearch url hooks in the log. and speaking of logs sunshine can you get a copy of the maleware bytes one? I wish I could remember what it is I have on my CDr I take to friends houses its a slew of free programs maleware removers and the like there's two others besides maleware bytes that I have found invaluable and for the life of me i can't remember them both free or free trials the CD is in the car I will look when it gets home tonight. pog yes its not good to just run hijack this but if you can stop the recreating of it in other spots for even a few min it can sure help, and as well its really good at getting all those HOLE's taken care of with old BHO and toolbars that let these things in in the first place.
victorsskull	Date: December 21, 2009 @ 1:06 PM I killed mine pretty quick. didnt really study it at all.
sunshine	Date: December 21, 2009 @ 2:00 PM i can try distilled. i have to get some things done tonight, and it seems a lot of my time has already gone into trying to get rid of that creepy bastad. the only way to get to a site is type the url in directly. everything else redirects. honestly i am getting tired of fooling with the thing. malwarebytes didnt find anything last scan and it is still doing it. so,, i can try again, but might not have much time tonight...sooooo frustrating..
sunshine	Date: December 21, 2009 @ 5:48 PM vundo it wont go away. i did exctly what you said to do with hijack this then ran avg still found virus vundo and still browser hijack. i am going to run the hijack this and post it here so pog can look too. this is such a pain! it said ati technologies is where the virus is and it has some other file associated that wont let me delete it. i will do the hijack this again and post it here. i am about to give up.
sunshine	Date: December 21, 2009 @ 5:50 PM Logfile of HijackThis v1.99.1 Scan saved at 6:52:16 PM, on 12/21/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\gearsec.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\stsystra.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\SQ931STI.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Location Finder\LocationFinder.exe C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe C:\Program Files\BigFix\bigfix.exe C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe C:\Program Files\Lexicon\Omega\Driver\ASIOSysTray.exe C:\Program Files\Java\jre6\bin\javaw.exe C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Documents and Settings\Owner.YOUR-DF1FB84A3F\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\WINDOWS\system32\TwcToolbarBho.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6028\SiteAdv.exe O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe O4 - HKLM\..\Run: [SQ931STI] C:\WINDOWS\SQ931STI.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem O4 - Startup: MP3 Rocket (Minimized).lnk = C:\Program Files\MP3 Rocket\MP3Rocket.exe O4 - Startup: Omega ASIO Control Panel.lnk = C:\Program Files\Lexicon\Omega\Driver\ASIOSysTray.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe O4 - Global Startup: REALTEK RTL8187 Wireless LAN Utility.lnk = ? O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - (no file) O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GearSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing) O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe O23 - Service: M-Audio CMIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program Files\M-Audio MA_CMIDI\MA_CMIDI_Inst.exe (file missing) O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing) O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6028\SAService.exe (file missing) O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
sunshine	Date: December 21, 2009 @ 5:51 PM i hate this problem and my dog is really sad because i cant pet her.
Distilled1	Date: December 21, 2009 @ 6:28 PM Run. 2. Type regedit Then click OK. 3. Navigate to and delete the following registry entries: * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents\CLSID\"[DEFAULT VALUE]" = "{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}" * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents.1\CLSID\"[DEFAULT VALUE]" = "{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}" * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce\"WinLogon = "[TROJAN FULL PATH FILE NAME] ren time:[RANDOM NUMBER]" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\"[TROJAN FILE NAME]" = "[TROJAN FULL PATH FILE NAME] rerun" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FILE NAME]" = "[TROJAN FULL PATH FILE NAME]" 4. Navigate to and delete the following registry subkeys: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ActiveState * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800} * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02F96FB7-8AF6-439B-B7BA-2F952F9E4800} * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2353FCBC-012D-487B-8BF3-865C0929FBEB} * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLDistrib.ATLDistrib\CLSID\ * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLDistrib.ATLDistrib.1\CLSID\ * HKEY_USERS\S-1-5-21-2068663838-1736639611-1443527720-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2353FCBC-012D-487B-8BF3-865C0929FBEB} * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22E85F2A-4A67-4835-B2C3-C575FE4EC322} * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADOUsefulNet.ADOUsefulNet * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ADOUsefulNet.ADOUsefulNet.1 * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22E85F2A-4A67-4835-B2C3-C575FE4EC322} * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60} * HKEY_CLASSES_ROOT\CLSID\{DE8BDE42-16D9-4CCC-9F4F-1C3167B82F60} * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DPCUpdater.DPCUpdater * HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DPCUpdater.DPCUpdater.1 5. Exit the Registry Editor. 6. Restart the computer in Normal mode. For instructions, read the section on returning to Normal mode in the document, "How to start the computer in Safe Mode."
Distilled1	Date: December 21, 2009 @ 6:32 PM and run AVG again then update it and run again. THis is an OLD Trojan surprised you have it You may need to try a trial of Norton or McAfee "MAY" but heres a link to Nortons removal instructions. one of the reasons I don't use AVG on my "used" a lot PCs is it really dose not seem to catch this stuff well. but I give up some performance with the main stay paid for security
Distilled1	Date: December 21, 2009 @ 6:32 PM http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&tabid=3
Distilled1	Date: December 21, 2009 @ 6:35 PM and you need to disable sys restore to kill it
Distilled1	Date: December 21, 2009 @ 6:36 PM AVG wasn't designed to remove a vundo infection. Also, while Superantispyware as advised above is effective in removing many variants of vundo, the tool of choice is still VundoFix, followed by RogueFix. Then Super can be used to clean up any malware that VundoFix and RogueFix didn't. But Super shouldn't be your first tool against vundo. VundoFix: http://www.majorgeeks.com/download4954.h… RogueFix: http://www.internetinspiration.co.uk/rog…
Distilled1	Date: December 21, 2009 @ 6:37 PM ^ that is old info but should work
miraclemaker	Date: December 21, 2009 @ 11:06 PM avg is good, but I noticed that if you need something destroyed as Distilled1 said you should have a paid for virus prog like mcafee/norton. I heard that microsoft has a full featured virus prog called ms essentials. Ive heard its pretty good and its free too. I hope you nab the bastard :bug:
pog	Date: December 22, 2009 @ 11:12 AM Okay... now I see why it is giving you such a hard time. Most antivirus programs will have a hard time of getting rid of this infection as it cannot be easily killed unless it's active processes are stopped. Also, apps like malwarebytes wont even work as it can delete files that it needs to work properly. I have seen mcafees have issues with this infection, but I have had success in removing it with vundofix by atribune You can get it at http://vundofix.atribune.org/ these guys are constantly updating as the infection uses random names, and mutates a lot. Also, you can get clamwin portable from http://portableapps.com/apps/utilities/clamwin_portable I would install it afterwards, and scan my system for anything else that may be infecting the system. If you find anything with clamwin portable, (which can be installed on a flash drive for portability and wont conflict with you antivirus) you can configure it to kill/remove any infections it finds, or quarantine them... by default it will only detect. Apart from that clamwin works like any other antivirus application. If vundofix doesnt get rid of it, then I would consider running through this instructional http://www.bleepingcomputer.com/virus-removal/remove-vundo-virtumonde But you should not need to do that unless vundofix and clamwin are unsuccessful. Keep us posted.
sunshine	Date: December 22, 2009 @ 12:24 PM thanks pog! one more night ! hopefully i can get it!
sunshine	Date: December 22, 2009 @ 12:25 PM actually thanks EVERYONE!
pog	Date: December 22, 2009 @ 6:14 PM Hope it helps... Good luck with that.
sunshine	Date: December 22, 2009 @ 6:32 PM vundofix did not work
BOWILLIE	Date: December 22, 2009 @ 6:41 PM i went thru the same virus a while back..distilled was kind enough to help me thru it.. if i remember right..the virus attached itself to my screen saver image..so after running the fixes..i had to discard my screensaver image for a new one..dunno if that info is helpful..i hope it is.
Distilled1	Date: December 22, 2009 @ 7:12 PM yes its a tough one to get. it could be hiding in any file, and will re create it self over and over. one thing I would do is completely remove with add/remove programs any tool bars (as you have a few) just because these things seem to really like those to breed in. and these are things you can easily re install later. Like BO said screen saver are you running one or any screen saver program? if you are you can try removing that as well, again easy to re install after its fixed. I can't believe vundofix didn't get it, that makes me think you have even more than that one probably quite a few. Personally I would start backing up all my music and pictures etc either to a partition on the hard drive (after I fully scanned the partition, most PCS if its off the shelf store bought, will have a partition that was set for saving install files and such. it may be very small though. Or transfer to CDRs or an external HD. If I couldn't get it after a day or so I would do a full re format (I normally don't as I hate trying to re install all the software I have that was Downloaded some that I can't just get again as I have no clue where the key went or where the purchase link went. Its a hard one but keep trying. can you get a free trial of symantic? or McAfee.. I know many say the free ones work better, but I have found those two work well as long as they are not more than a few updates into them after a few they seem to take over the computer and slow you down... Did you try this and follow it to the i ? http://www.bleepingcomputer.com/virus-removal/remove-vundo-virtumonde you will need to download a new maleware bytes and the exe for it as well your's is probably missing a lot of its components
pog	Date: December 22, 2009 @ 7:20 PM k... I would be disabling system restore and running housecall 1) http://housecall.trendmicro.com/ then 2) then clamwin portable set up to delete any nasties it finds then 3) then ccleaner http://www.filehippo.com/download_ccleaner/ 4) re-run vundofix then restart system restore.
pog	Date: December 22, 2009 @ 7:23 PM ...and like Distilled1 says... back up what you can before attempting this stuff.
Distilled1	Date: December 22, 2009 @ 7:24 PM combofix may be a good one to run in that mix as well. I forgot about ccleaner.. duh, and I use that all the time just to clean up all the temp crap
victorsskull	Date: December 22, 2009 @ 7:26 PM if I remember right I went into my processes and shut almost every thing off and then did a history restore
Distilled1	Date: December 22, 2009 @ 7:30 PM your still going to have it Russ it will come back eventually if you didn't remove it totally. thats what makes this one a nasty little bitch
pog	Date: December 23, 2009 @ 12:10 AM ...sometimes with these things, I feel like I'm peddling snake oil, then we finally nail it and my confidence is restored
Distilled1	Date: December 23, 2009 @ 5:44 PM yep ^ I kinda love trying to get them. I have friends bring me PCs that are so full of crap and I love cleaning them up and getting the wow...it was never this fast.
victorsskull	Date: December 23, 2009 @ 6:47 PM I will be ready for the bastard when it returns
sunshine	Date: December 25, 2009 @ 6:12 PM i got it i got it i got it i got it i got it! yeH!!!!!! puter faster than ever! I de-gunked it and i so happy!!!!!!!!!!!!!!! it was in the yahoo. everything is a ok! YEARRRRHHHHH!
Distilled1	Date: December 25, 2009 @ 6:21 PM
pog	Date: December 25, 2009 @ 7:38 PM Nice... this thread was one of the best Christmas presents I opened this year
zedsalt	Date: December 26, 2009 @ 9:31 AM Nothing should ever be slipped in anyone's yahoo that that person doesn't want there.
BOWILLIE	Date: December 26, 2009 @ 9:45 AM On 26th Dec 2012, zedsalt said: Nothing should ever be slipped in anyone's yahoo that that person doesn't want there.
miraclemaker	Date: December 27, 2009 @ 6:28 AM Good deal!!
Opossum	Date: December 27, 2009 @ 6:50 AM On 26th Dec 2012, zedsalt said: Nothing should ever be slipped in anyone's yahoo that that person doesn't want there. For a moment, I thought you meant the drink, until I read it again.
zedsalt	Date: December 27, 2009 @ 9:36 AM What, YooHoo, that chocolate flavored stuff? I'll happily go on the record as being firmly against drink tampering, too! Even when you're slipping something in there that the drinker usually enjoys, doing so without their knowledge is still a really bad idea.
sunshine	Date: December 27, 2009 @ 9:57 AM yoo hoo is good

Post A Reply
From:	Guest	(Icons - Linking)
Post: