 |  |  |  |  |  |  |  |
Trojan Virus & Quickbooks Software Won't Open
 |
Thank you all for being here to help me with this problem I'm having. I've used computers for years but this is over my head. I saw a post here when you guys helped a lady a few years back having a similiar problem with her software. I hope you have the same good results with mine.
About a week ago, my Quickbooks Software wouldn't open. It shows up in the task tray but won't open. It shows in Task Manager that it's running. I get an error message QBW caused a General Protection Fault in module QBWIN.DLL at 002A:0168. It gives an error message to end program WOWEXEC when shutting down the computer. When I tried to re install Quickbooks, it said that the program already running and waiting on a response from me. I had tried to reinstall the program disks after I tried a couple of things below.
I have Windows XP Home Edition. My AGV anti virus program detected Trojan Horse Dropper.Agent.JOC, Adware Generic. NTR, Trojanhorse Generic11.PWW and VirusFound JS/Psyme. I deleted the items through AGV and I had to delete them in groups because they were large. In the recycle bin they showed up as 46ab9 Windows Install Package 22,864KB and as A0009164 Windows Installer Package 22,864KB. I have a list of the individual items that was deleted through AVG if it's needed at this point.
I have ran scans with a-squared Free and Ad-Aware that were installed on my computer by my computer repair store. I deleted cookies that were low or medium risk. This computer had a new hard drive installed in August 2008 after the power supply and the C hard drive went bad.
I used some instructions that I found from the Quickbooks website that suggested to download Microsoft .NET Framework Version 2.0 Redistributable Package (x86) and where someone solved their problem but it didn't work for me. I've also updated the Windows Updates along the way.
I followed the PP instructions here for this forum.
Following is the MalwareBytes' Anti-Malware log:
Malwarebytes' Anti-Malware 1.28
Database version: 1142
Windows 5.1.2600 Service Pack 3
9/12/2008 12:00:56 PM
mbam-log-2008-09-12 (12-00-44).txt
Scan type: Full Scan (C:\|)
Objects scanned: 92776
Time elapsed: 42 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> No action taken.
There was no log from ESET as it found no problems.
I wasn't able to use the Deckard's System so no log from them.
Following is the Uninstall List from Hi Jack This:
Acrobat.com
Acrobat.com
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 9
AOL Toolbar 5.0
a-squared Free 3.5
AVG Free 8.0
Brother MFL-Pro Suite
Coupon Printer for Windows
ESET Online Scanner
Google Earth
Google Toolbar for Internet Explorer
Google Updater
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hotfix for Windows XP (KB952287)
Java(TM) 6 Update 7
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
MySurvey Messenger
Nero OEM
OLYMPUS CAMEDIA Master 4.1
PaperPort
PowerDVD
QuickTime
Realtek AC'97 Audio
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Windows XP Service Pack 3
WordPerfect Office 11
Nothing was found through the Microsoft WIN Malicious Software Removal Tool.
Again thank you for the help. I'm in a bind here, I am suppose to mail my taxes for our small business by the extension deadline on Monday the 15th but can't without my bookkeeping program and data. I surely appreciate anything you can do to help me.
Thanks,
Terri
About a week ago, my Quickbooks Software wouldn't open. It shows up in the task tray but won't open. It shows in Task Manager that it's running. I get an error message QBW caused a General Protection Fault in module QBWIN.DLL at 002A:0168. It gives an error message to end program WOWEXEC when shutting down the computer. When I tried to re install Quickbooks, it said that the program already running and waiting on a response from me. I had tried to reinstall the program disks after I tried a couple of things below.
I have Windows XP Home Edition. My AGV anti virus program detected Trojan Horse Dropper.Agent.JOC, Adware Generic. NTR, Trojanhorse Generic11.PWW and VirusFound JS/Psyme. I deleted the items through AGV and I had to delete them in groups because they were large. In the recycle bin they showed up as 46ab9 Windows Install Package 22,864KB and as A0009164 Windows Installer Package 22,864KB. I have a list of the individual items that was deleted through AVG if it's needed at this point.
I have ran scans with a-squared Free and Ad-Aware that were installed on my computer by my computer repair store. I deleted cookies that were low or medium risk. This computer had a new hard drive installed in August 2008 after the power supply and the C hard drive went bad.
I used some instructions that I found from the Quickbooks website that suggested to download Microsoft .NET Framework Version 2.0 Redistributable Package (x86) and where someone solved their problem but it didn't work for me. I've also updated the Windows Updates along the way.
I followed the PP instructions here for this forum.
Following is the MalwareBytes' Anti-Malware log:
Malwarebytes' Anti-Malware 1.28
Database version: 1142
Windows 5.1.2600 Service Pack 3
9/12/2008 12:00:56 PM
mbam-log-2008-09-12 (12-00-44).txt
Scan type: Full Scan (C:\|)
Objects scanned: 92776
Time elapsed: 42 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> No action taken.
There was no log from ESET as it found no problems.
I wasn't able to use the Deckard's System so no log from them.
Following is the Uninstall List from Hi Jack This:
Acrobat.com
Acrobat.com
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 9
AOL Toolbar 5.0
a-squared Free 3.5
AVG Free 8.0
Brother MFL-Pro Suite
Coupon Printer for Windows
ESET Online Scanner
Google Earth
Google Toolbar for Internet Explorer
Google Updater
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hotfix for Windows XP (KB952287)
Java(TM) 6 Update 7
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
MySurvey Messenger
Nero OEM
OLYMPUS CAMEDIA Master 4.1
PaperPort
PowerDVD
QuickTime
Realtek AC'97 Audio
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Windows XP Service Pack 3
WordPerfect Office 11
Nothing was found through the Microsoft WIN Malicious Software Removal Tool.
Again thank you for the help. I'm in a bind here, I am suppose to mail my taxes for our small business by the extension deadline on Monday the 15th but can't without my bookkeeping program and data. I surely appreciate anything you can do to help me.
Thanks,
Terri
•
•
Join Date: Jul 2008
Posts: 2,899
Reputation: 
Solved Threads: 165
Did you delete these all the way out or are they still in the Recycle Bin?
I am a bit concerned because when checking on the few you noted these could have been false postitives, meaning they were not a trojan or virus at all. This is why it is recommended that you keep items removed in Quarantine for awhile to be certain they actually were not false positives and files key to running of specific programs. If a file is moved to Quarantine then it is not active anymore but available for restoration in case it really was a valuable file.
You may need to fully uninstall the Quicken program and reinstall it. If you have stored files I would back them up to an outside source to be sure you don't lose the information contained in them...a CDR or Flash drive would be good if possible.
To assure a clean install of Quicken you should be certain that you totally uninstall it and all remaining files of the corrupt version. This way when you reinstall you will have totally, fresh and clean program files there.
Quicken has a removal tool for this which can be found here, with instructions for it's use.
https://quicken.custhelp.com/cgi-bin...p?p_faqid=4108
Judy
I am a bit concerned because when checking on the few you noted these could have been false postitives, meaning they were not a trojan or virus at all. This is why it is recommended that you keep items removed in Quarantine for awhile to be certain they actually were not false positives and files key to running of specific programs. If a file is moved to Quarantine then it is not active anymore but available for restoration in case it really was a valuable file.
You may need to fully uninstall the Quicken program and reinstall it. If you have stored files I would back them up to an outside source to be sure you don't lose the information contained in them...a CDR or Flash drive would be good if possible.
To assure a clean install of Quicken you should be certain that you totally uninstall it and all remaining files of the corrupt version. This way when you reinstall you will have totally, fresh and clean program files there.
Quicken has a removal tool for this which can be found here, with instructions for it's use.
https://quicken.custhelp.com/cgi-bin...p?p_faqid=4108
Judy
Well, mine is Quickbooks for Windows Version 3.0 which was bought in the 90's. Quicken is a different product.
I don't know if I should unistalling it and re installing Quickbooks on my own because the computer repair store had a difficult time getting the data back up correctly when they installed the hard drive. It worked fine for over a month and the tech has some files on the computer called old PC quickbooks. So I don't know if I should try this.
The deleted files from AVG are no longer in the recycle bin.
Thanks Judy for your help.......
Is there any thing else I could try?
I don't know if I should unistalling it and re installing Quickbooks on my own because the computer repair store had a difficult time getting the data back up correctly when they installed the hard drive. It worked fine for over a month and the tech has some files on the computer called old PC quickbooks. So I don't know if I should try this.
The deleted files from AVG are no longer in the recycle bin.
Thanks Judy for your help.......
Is there any thing else I could try?
•
•
Join Date: Jul 2008
Posts: 2,899
Reputation:
Solved Threads: 165
Sorry, didn't read it correctly, thought it was Quicken. You know that Quickbook program is way out of date, may be the reason it was so hard to reinstall. That may be your only option though.
Hopefully somebody smarter than I will come along and read this and offer a solution. Sorry I couldn't be of more help.
Judy
Hopefully somebody smarter than I will come along and read this and offer a solution. Sorry I couldn't be of more help.
Judy
Last edited by jholland1964; Sep 12th, 2008 at 5:32 pm.
Would you please take a look at my hi jack log and see if everything looks normal? A couple of other things I forgot about at first, my acrobat reader doesn't come up when I need it. This and the QBooks problem happened right after I installed Internet Explorer 7. I didn't like it, so I uninstalled and went back to Internet explorer 6. So, when the Quickbooks wouldn't open, I tried updating again to the Internet Explorer 7 but it still didn't work and that was before I deleted the AVG Quaratined Files. If this hi jack log looks ok, I will either get the courage to unistall QB or take it back to the repair store. Could it be that I'm now missing some Explorer type files?
I have installed my QBooks program on my husband's computer and the data is on there so I'm ok there plus the computer store probably still has my data too. I just can't work on his computer like I need to to get my taxes done.
The Hi Jack Log:
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MySurvey Messenger\MySurveyMessenger.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\S1QFGDEN\HijackThis[1].exe
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: MySurvey Messenger.lnk = C:\Program Files\MySurvey Messenger\MySurveyMessenger.exe
O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I have installed my QBooks program on my husband's computer and the data is on there so I'm ok there plus the computer store probably still has my data too. I just can't work on his computer like I need to to get my taxes done.
The Hi Jack Log:
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MySurvey Messenger\MySurveyMessenger.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\S1QFGDEN\HijackThis[1].exe
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: MySurvey Messenger.lnk = C:\Program Files\MySurvey Messenger\MySurveyMessenger.exe
O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
•
•
Join Date: Jul 2008
Posts: 2,899
Reputation:
Solved Threads: 165
Am looking at your HJT now but one thing you do need to do is run Malwarebytes' Anti-Malware again and this time have it fix everything found.
Then run a new HJT log and post that one along with the new Malwarebytes' log
Judy
Then run a new HJT log and post that one along with the new Malwarebytes' log
Judy
•
•
Join Date: Jul 2008
Posts: 2,899
Reputation:
Solved Threads: 165
You know in reading through all of this again, couple things I missed...you say these removed items ended up in your Recycle Bin...Why? Normally if my antivirus program removes something it is sent to the Quarantine OR just plain deleted, not to the Recycle Bin but deleted.
The other thing you say, these were supposedly viruses or trojans but what showed in the Recycle Bin were two Windows Installer Packages and the file sizes were just about right for the Windows Installer 3.1
I am wondering, were these uninstalled by mistake?
Look in Add/Remove and see if it is listed there, should be there but I also don't see it on your Uninstall list either.
You do need this to install many programs, maybe that is why you can't get the Quickbooks to install
Go HERE and download and see if that helps. Meanwhile I will take a look at your log.
The other thing you say, these were supposedly viruses or trojans but what showed in the Recycle Bin were two Windows Installer Packages and the file sizes were just about right for the Windows Installer 3.1
I am wondering, were these uninstalled by mistake?
Look in Add/Remove and see if it is listed there, should be there but I also don't see it on your Uninstall list either.
You do need this to install many programs, maybe that is why you can't get the Quickbooks to install
Go HERE and download and see if that helps. Meanwhile I will take a look at your log.
Thanks Judy
The 8 items that Malwarebytes' found before is in the quarantine section there. Should they be deleted from there? Also, I did a computer restart before I ran the hi jack log.
I found a txt log at the site too, I opened it and I'm pasting it here. It shows that they were deleted....??
Malwarebytes' Anti-Malware 1.28
Database version: 1142
Windows 5.1.2600 Service Pack 3
9/12/2008 12:03:57 PM
mbam-log-2008-09-12 (12-03-57).txt
Scan type: Full Scan (C:\|)
Objects scanned: 92776
Time elapsed: 42 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> Quarantined and deleted successfully.
Do you still want me to re run the MalwareBytes? If so, will the quick scan do?
Terri
The 8 items that Malwarebytes' found before is in the quarantine section there. Should they be deleted from there? Also, I did a computer restart before I ran the hi jack log.
I found a txt log at the site too, I opened it and I'm pasting it here. It shows that they were deleted....??
Malwarebytes' Anti-Malware 1.28
Database version: 1142
Windows 5.1.2600 Service Pack 3
9/12/2008 12:03:57 PM
mbam-log-2008-09-12 (12-03-57).txt
Scan type: Full Scan (C:\|)
Objects scanned: 92776
Time elapsed: 42 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> Quarantined and deleted successfully.
Do you still want me to re run the MalwareBytes? If so, will the quick scan do?
Terri
About the Windows Installer 3.1, I have Windows XP Service Pack 3 (would it be there?) but I don't see Windows Insaller 3.1 in the Add or Remove Programs area. Should I download still?
What happened with the recycle bin is; I found out that AVG had quarantined all of the Trojan horse files and the other ones too. So I was going to delete them one by one but it gave me a note that said it was too large and then the computer took me to an area of the start menu where all of the folders of the computer are listed and automatically showed me the packs of files to delete. When I did, they then went to the recycle bin. I emptied the recycle bin thinking that these scans would pick up info from all files. So my bad there.
I have all of the files listed that were deleted though. I did a print screen and posted them in a Word File and printed them also if you want me to type them out for you to see or if there is a way to attach a word file to you, I could do that.
Terri
What happened with the recycle bin is; I found out that AVG had quarantined all of the Trojan horse files and the other ones too. So I was going to delete them one by one but it gave me a note that said it was too large and then the computer took me to an area of the start menu where all of the folders of the computer are listed and automatically showed me the packs of files to delete. When I did, they then went to the recycle bin. I emptied the recycle bin thinking that these scans would pick up info from all files. So my bad there.
I have all of the files listed that were deleted though. I did a print screen and posted them in a Word File and printed them also if you want me to type them out for you to see or if there is a way to attach a word file to you, I could do that.
Terri
•
•
Join Date: Jul 2008
Posts: 2,899
Reputation:
Solved Threads: 165
•
•
•
•
About the Windows Installer 3.1, I have Windows XP Service Pack 3 (would it be there?) but I don't see Windows Insaller 3.1 in the Add or Remove Programs area. Should I download still?
•
•
•
•
I have all of the files listed that were deleted though. I did a print screen and posted them in a Word File and printed them also if you want me to type them out for you to see or if there is a way to attach a word file to you, I could do that.
Last edited by jholland1964; Sep 12th, 2008 at 8:05 pm.
|
Other Threads in the Viruses, Spyware and other Nasties Forum
- Previous Thread: Virus on my computer that wont let me access Gmail and connect to the internet
- Next Thread: error message in internet explorer
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest Viruses, Spyware and other Nasties Posts
adware anti-malware anti-virussitesaccessissue antivirus apple attack audio avg backtoschoolspeech bar blackhat botnet botnets censorship china commercial commercials conficker connect control crosssitescripting cyber cybercrime cyberwarfare ddos domains e-mafia education email europe exam exploit facebook fake fancheckvirus gaming gtaiv gumblar hijack hosting internet iphone kaspersky legal logfiles mail malware mcafee mega-d messagelabs microsoft mobile msn news obama paedophile panel parents patch phishing police policeprovirusmba-mblockedinternetaccess president privacy pro problem redirect redirecting reliability report research risk rogueantivirus scareware school search security seopoisoning sites software spam spyware spywareexternalwindows7adminstratortrojans sqlinjection symantec system teen translate trojan unabletoaccessanti-virussites unwanted update usa virus viruses vista warning windows worm zeroday
