Recommended for Virus and spyware removal?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by d3xt3r, Jul 11, 2004.

  1. d3xt3r

    d3xt3r Private E-2

    Hey all,

    My father-in-law was complaining that his 2.5g intel PC was running slow.
    I automatically thought it was spyware or a virus. He used to have McAFee but he didn't renew it after the 30 days.
    So I DL'd AVG, as soon as I DL'd it it detected Trojan horse and some backdoor virus?
    I ran it and it found several viruses and corrupted files. AVG fixed several corrupted files and viruses. It still has 16 corrupted files. I disabled the System Restore to see if it could fix the rest but it didn't. So I DL'd the McAFee Avert Stinger and another scanner/ repair program. I also DL'd trusty AdAware, ran it and it found tons of spyware, includint that tagent thing.
    Neither did any good. Can anyone reccomend any better ones that are free?
    Are the ones that cost like $29/39 garuanteed?

    I remember the names of the ones that AVG detected and couldn't fix/remove were something like androa, bspy, and one other. Sorry I can't remember.

    Thanks for any help! :D
     
    d3xt3r, Jul 11, 2004
    #1
  2. Just Playin

    Just Playin MajorGeek

    Run it all again in safe boot mode. They may have been active at the timeof the scan. I used to have AVG and had to remove some things manually .
     
    Just Playin, Jul 11, 2004
    #2
  3. Astroman

    Astroman Private E-2

    AVG is great on account that it is free and is better than a lot of AV software that costs money, you should also download Spybot S&D, CWShredder, SpywareBlaster, Spyware Guard update them all and download Spysweeper, A good online scanner is PestPatrol online scanner, however it doesn't remove it but it does give the location of pest in a file or in the Registry. http://www.pestscan.com/Scan.asp
     
    Astroman, Jul 11, 2004
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you have corrupted files, no scanner is going to fix them, unless it is something like a virus or trojan that is attached to a valid file. In those cases a virus scanner can sometimes repair the file but running in safe mode may be necessary. If it not repairable in safe or normal mode, you probably have to reinstall the application or replace the file manually (also may need to be in safe mode).
     
    chaslang, Jul 11, 2004
    #4
  5. d3xt3r

    d3xt3r Private E-2

    OK, so when it boots up, what do I press to go into safe mode?
    I'll run all the programs again.
     
    d3xt3r, Jul 11, 2004
    #5
  6. d3xt3r

    d3xt3r Private E-2

    Yeah I figured I was going to have to DL all those programs, just didn't have the time to do it tonight. I think he already has Pest Patrol on there, but it never found anything.
    Well maybe it found them just didn't remove them.

    I know AVG found some and removed/fixed more than 70% of them.
    What does it do different when in safe mode?
     
    d3xt3r, Jul 11, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Jul 11, 2004
    #7
  8. d3xt3r

    d3xt3r Private E-2

    XP, I'm sure it's pro and not home edition.
    Also, I made all the files show (disabled hidden files) and also disabed the system restore. I read that some files would be able to be fixed if there where hidden in the backup restore file system.
     
    d3xt3r, Jul 11, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You mean "would NOT be able to be fixed". You cannot not fix problem files in system restore. That's one reason why you need to disable it. It gets rid of the restore points which gets rid of the problem. In addition, if you did not delete those system restore points that have problems (virus, trojans, etc), you could some day get a problem back that you had fixed alread since the system could be brought back to a restore point.
     
    chaslang, Jul 11, 2004
    #9
  10. d3xt3r

    d3xt3r Private E-2

    I had him run that Panda scanner and he said it found 16 and fixed 16.
    It seems too easy, but I had him run the AVG again to make sure it's fixed, since AVG is the on that caught/detected all of them. We'll see what happens.

    If not I'll do as you guys recommended and run all of the above in safe mode.
    I'll let you guys know what happens tomorrow.

    Thanks!! :D
     
    d3xt3r, Jul 11, 2004
    #10
  11. d3xt3r

    d3xt3r Private E-2

    edit: He ran AVG and it still found 14. We'll try the rest in safe mode tomorrow.

    Oh do any of those programs/viruses sound familiar to you guys?
     
    d3xt3r, Jul 11, 2004
    #11
  12. Just Playin

    Just Playin MajorGeek

    When Windows boots up in safe mode, It only runs the drivers and Windows OS programs absolutely necessary for you to use your computer. Third party software wont be ran at start-up, including viruses, trojans, and spyware. You need to do this because Windows will not delete a program or file that is in use.
     
    Last edited: Jul 12, 2004
    Just Playin, Jul 12, 2004
    #12
  13. d3xt3r

    d3xt3r Private E-2

    One more thing...
    Just looking to the future if all else fails.

    You all said the Pest Patrol will tell me where the corrupted files are?
    It should tell me the path and I should be able to recognize the program it's attached to, then remove the program and install a fresh one?
    If these files are apart of the OS, like in system32 folders or something, will it fix them in safe mode? If it doesn't how do you fix corrupted OS files and folders?

    Thanks,
     
    d3xt3r, Jul 12, 2004
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What programs/viruses? You did not name any.
     
    chaslang, Jul 12, 2004
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Define corrupted! Do you mean the file has errors or do you mean some sort of malware/virus has infected the file? Some viurs/trojan checkers can repair the latter (sometimes). Truly errored files will have to be replaced. You need to determine whose files they are. Not all files in the system32 folder are part of Windows.
     
    chaslang, Jul 12, 2004
    #15
  16. d3xt3r

    d3xt3r Private E-2

    First post... " remember the names of the ones that AVG detected and couldn't fix/remove were something like androa, bspy, and one other. Sorry I can't remember."

    They're not full/exact names, I was just wondering if they sounded familiar.
     
    d3xt3r, Jul 12, 2004
    #16
  17. d3xt3r

    d3xt3r Private E-2

    Also, when I boot up in safe mode, are these tools/scanners going to be available?
    Or will I have to reinstall them in safe mode?

    What is the best way to determine which files are corrupted if I can't fix any with the scanners? The pest patrol or the HiJackThis log?

    Thanks,
     
    d3xt3r, Jul 12, 2004
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No! Never heard of androa (there is an Andromeda virus though).
    Nothing on just Bspy either but there is a keylogger called ABspy.
     
    chaslang, Jul 12, 2004
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Which scanners in particular are you referring to? Most (if not all) adware scanners and virus scanners work in safe mode. Online scanners will not.

    You are the one that keeps saying you have corrupted files. Why do you say this? Isn't it due to the fact that the scans are telling you that they have found a problem? I would assume they are not saying the file is corrupted but rather that there is a virus or a trojan or some other problem. Aren't they telling you the filename?

    Have you disabled system restore yet?
     
    chaslang, Jul 12, 2004
    #19
  20. d3xt3r

    d3xt3r Private E-2

    Ok, so all of the scanners will work in safe mode but the online ones I know.

    Well AVG says corrupted files found, but it didn't list the names of any. I'll check the options tab for a list of names. When I run McAFee Avert it doesn't find anything.
    Sorry if I keep saying "corrupted files" I'll clear that up tonight when I read exactly what it says. Sorry for the confusion.

    Yes I disabled the system restore when we ran the Panda online scanner, then the AVG right after it. I'll let you guys know how it goes after we try everything in safe mode.
    Will any of these scanners try to delete any critical folders/files needed for the OS?

    Thanks,
     
    d3xt3r, Jul 12, 2004
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If a critical system file is infected and the only way to repair it is to delete it, that could happen.
     
    chaslang, Jul 12, 2004
    #21
  22. d3xt3r

    d3xt3r Private E-2

    Would it affect the OS from working or even booting?
    It's a Dell PC and I don't know if he has support from them, but if I screw up his OS won't that void his warranty? lol
     
    d3xt3r, Jul 13, 2004
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It could impact the ability to boot. Don't delete anything if you are not sure?

    Maybe your problem is with AVG being corrupted. Why don't you uninstall it and reinstall?
    Or perhaps before re-installing, try using Avast! instead. Get it here (also free): http://www.majorgeeks.com/download1968.html
     
    chaslang, Jul 13, 2004
    #23
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to record EXACT error messages and convey them back here. Don't use your own words. If a virus or any other problem is detected and cannot be repaired or deleted you need to tell us what virus name and in what file the problem occurred.
     
    chaslang, Jul 13, 2004
    #24
  25. d3xt3r

    d3xt3r Private E-2

    HijackThis results

    Logfile of HijackThis v1.98.0
    Scan saved at 8:39:36 PM, on 7/13/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\AVGANT~1\avgserv.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\EarthLink 5.0\updatemgr.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\PESTPA~1\PPControl.exe
    C:\WINDOWS\System32\mrtMngr.EXE
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\WINDOWS\System32\DSentry.exe
    C:\Program Files\EarthLink 5.0\ConMgr.exe
    C:\PROGRA~1\AVGANT~1\avgcc32.exe
    C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
    C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\PestPatrol\PestPatrol.exe
    C:\Program Files\Test Scanners\HijackThis.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
    R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
    R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\Test Scanners\SpywareGuard\dlprotect.dll
    O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
    O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F0 - (no file)
    O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F05} - (no file)
    O2 - BHO: BRedObj Class - {7371F073-AC0F-4b80-BB2F-96A488CEFB32} - c:\Program Files\Xmod\xm320.dll
    O2 - BHO: (no name) - {c900b400-cdfe-11d3-976a-00e02913a9e - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
    O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [tapaxwn] C:\WINDOWS\tapaxwn.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [PeerGuardian] C:\Program Files\KMD Lite\peerguardian.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
    O4 - HKLM\..\Run: [Jreg] "c:\Program Files\Common Files\Java\Jreg2b.exe"
    O4 - HKLM\..\Run: [haf] C:\WINDOWS\haf.exe
    O4 - HKLM\..\Run: [Grokster] C:\PROGRA~1\Grokster\Grokster.exe /SYSTRAY
    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
    O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
    O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\AVGANT~1\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
    O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\PestPatrol\ppclean.exe" clean ts:20040713201247359 suite 2 2
    O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKLM\..\RunOnce: [t] "c:\Program Files\Common Files\Java\xclean.exe"
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
    O4 - HKCU\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - Startup: install.lnk = ?
    O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.cab
    O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://inotes.academy.com/iNotes.cab
    O16 - DPF: {8A8F3D75-6564-4599-A7DC-313B43A89E1D} (AdInstaller Control) - http://www.kazaa.net.cn/digital/AdInstaller.ocx
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
     
    d3xt3r, Jul 13, 2004
    #25
  26. d3xt3r

    d3xt3r Private E-2

    AVG results:

    Results of Complete Test, date and time 7/13/2004 20:42:51 :
    Testing C:\ serial 442C-929B
    C:\HIBERFIL.SYS Cannot open; not checked!
    C:\Documents and Settings\LocalService\NTUSER.DAT Cannot open; not checked!
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Cannot open; not checked!
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
    C:\Documents and Settings\NetworkService\NTUSER.DAT Cannot open; not checked!
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Cannot open; not checked!
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
    C:\Documents and Settings\WOODY\NTUSER.DAT Cannot open; not checked!
    C:\Documents and Settings\WOODY\ntuser.dat.LOG Cannot open; not checked!
    C:\Documents and Settings\WOODY\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
    C:\Documents and Settings\WOODY\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
    C:\Program Files\PestPatrol\Quarantine\20040501093912880.zip:\WINDOWS\system32\Gr02.dll Trojan horse Downloader.Bho.A
    C:\Program Files\PestPatrol\Quarantine\20040501093912880.zip:\Program.Fil\rvp\bpc.exe Trojan horse Downloader.Rvp.D
    C:\Program Files\PestPatrol\Quarantine\20040501093912880.zip:\WINDOWS\biprep.exe Trojan horse PSW.Bispy.B
    C:\Program Files\PestPatrol\Quarantine\20040501093912880.zip:\WINDOWS\system32\ia.dll Trojan horse Downloader.Wintrim.AD
    C:\Program Files\PestPatrol\Quarantine\20040501093912880.zip:\WINDOWS\system32\egdial.dll Trojan horse Dialer
    C:\Program Files\PestPatrol\Quarantine\20040501093912880.zip:\WINDOWS\system32\netpal.dll Trojan horse Downloader.Bho.B
    C:\Program Files\PestPatrol\Quarantine\20040514202529218.zip:\Document.s\Woody\local.tti\temp\bi.dll Trojan horse PSW.Bispy.A
    C:\Program Files\PestPatrol\Quarantine\20040514202529218.zip:\WINDOWS\bi.dll Trojan horse PSW.Bispy.A
    C:\Program Files\PestPatrol\Quarantine\20040514202529218.zip:\WINDOWS\biprep.exe Trojan horse PSW.Bispy.B
    C:\Program Files\PestPatrol\Quarantine\20040517060447437.zip:\Document.s\Woody\local.tti\temp\bi.dll Trojan horse PSW.Bispy.A
    C:\Program Files\PestPatrol\Quarantine\20040517060447437.zip:\WINDOWS\bi.dll Trojan horse PSW.Bispy.A
    C:\Program Files\PestPatrol\Quarantine\20040517060447437.zip:\WINDOWS\biprep.exe Trojan horse PSW.Bispy.B
    C:\Program Files\PestPatrol\Quarantine\20040604165500671.zip:\WINDOWS\ARUpdate.exe Trojan horse Downloader.Adroar.A
    C:\Program Files\PestPatrol\Quarantine\20040610101934109.zip:\WINDOWS\ARUpdate.exe Trojan horse Downloader.Adroar.A
    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Cannot open; not checked!

    Test finished, duration 00:07:21.1 s
    20669 objects tested, 14 found infected
     
    d3xt3r, Jul 13, 2004
    #26
  27. d3xt3r

    d3xt3r Private E-2

    How do you remove stuff from start up?
    I did start>run>msconfig>startup tab and it showed a bunch of crap on the list.
    I tried to disable some and they just re-enabled themselves?
    Also I could run AVG in safe mode?
     
    d3xt3r, Jul 13, 2004
    #27
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I don't see any problems with your AVG scan (and note nothing said "corrupted"). If you are worried about the 14 files in the quaranteen folder for PestPatrol, have PestPatrol remove the contents of its quaranatine folder. Then rescan. So basically if this is your problem you don't have one.
     
    chaslang, Jul 14, 2004
    #28
  29. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Exactly which items are you trying to stop from running at startup?
     
    chaslang, Jul 14, 2004
    #29
  30. d3xt3r

    d3xt3r Private E-2

    LOL, Well the funny thing is when I scanned last night, I finally found the AVG vault where it holds the results. I looked at th 14 it's been finding and noticed they were in Pest Patrol's Quaranatine folder. So I said it's not that bad then.

    So If I go to Pest Patrol Quaranatine folder and have it remove/delete the files in the Quarantine folder it won't affect the OS?
     
    d3xt3r, Jul 14, 2004
    #30
  31. d3xt3r

    d3xt3r Private E-2

    Well when the PC starts up he has like a million little icons on his task bar on the right end by the clock.
    I wanted to disable AIM, Real Player, Quicktime, and one or two more.
    Also what is Peer Guardian? I noticed he had a Wild Tangent folder?
    One more thing, he has earthlink and he installed some of there software including their tool bar on IE. Personally it looks like my RR w/Google toolbar blocks popups better than his earthlink. Any truth to that? I was going to uninstall the earthlink stuff and put Google, I just didn't know if it would affect his Outlook mailbox or his IE favorites.

    Thanks for everything, especially your time!!
     
    d3xt3r, Jul 14, 2004
    #31
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If they are already in the Quarantine folder and you have been booting and running okay, your OS does not miss whatever is there. There should be no problem havin PestPatrol cleanup its quarantine.
     
    chaslang, Jul 14, 2004
    #32
  33. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Before worrying about those items you should finish fixing the remaining items the fall into the adware/spyware realm. For example I see TVMedia and MyWebSearch. Try to locate MyWeb or MyWebSearch (or something similar) in Add/Remove Programs and uninstall. If you see something like FunWebProducts, uninstall it too. I personally always remove WildTangent but if you use those on line game sites related to it, it will come back. If you don't use it, uninstall it too (AOL stuck it in there).

    Run HijackThis and fix (some for TVMedia, some just need fixing):
    R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
    R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
    O2 - BHO: (no name) - {c900b400-cdfe-11d3-976a-00e02913a9e - (no file)
    O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKCU\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe

    Then reboot in safe mode and delete the directory:
    C:\Program Files\TV Media

    Check the Earthlink Toolbar for an uninstall program (possibly in Add/Remove Programs too).
     
    chaslang, Jul 14, 2004
    #33
  34. d3xt3r

    d3xt3r Private E-2

    Cool I'll try that.
    I already uninstalled TV Media, if he needs it I'll reinstall it. But I'll check again and delete the directory as requested.
    I remember seeing that My Websearch on his Earthlink Tool bar, is it a part of Earthlink?
    When I looked at the add and remove, I saw an earthlink software bundle, no toolbar.
    I'll look closer tonight. Oh and AOL, I know if I uninstall it, his kid will reinstall it. Is there a lite version? I saw one here on Major Geeks that removes the spywares and junk from AOL?

    Thanks,
     
    d3xt3r, Jul 14, 2004
    #34
  35. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I don't believe MyWebSearch is related to Earthlink at all.
    I was not suggesting to uninstall AOL, especially if it is their ISP, I was only saying that AOL (and AIM) are places where WildTangent can come from.

    Never heard of an AOL lite type application. There is one that trys to block the popups in AIM.
     
    chaslang, Jul 14, 2004
    #35

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds