kmhn583

Members
 View Profile  See their activity

  • Content Count

    3

  • Joined

  • Last visited

 Content Type 

Posts posted by kmhn583

  2. Can't Remove Spyware Guard 2008

    in Malware Removal

    Posted · Edited by kmhn583

    PLEASE FORGIVE ME FOR MULTIPLE POSTING... I ACCIDENTLY POSTED IN THE "Spyware/Adware Information" SECTION.

    Greetings,

    I got the Spyware Guard 2008 virus today...

    I've tried some basic procedures laid out in various forums (listed below) which have all failed. I understand I should be posting a hijack I am not knowledged in this field so please excuse my ignorance...

    1. first tried simply installing MBAM and running the scan. The first time it detects something it gives me an error with an identification number which varies each time. I OK it and the scan continues, but soon it gets shut down by Spyware Guard every time (that is my guess because Spyware Guard always opens up when MBAM shuts down).

    2. I have tried the method described here: http://www.besttechie.net/forums/index.php...mp;#entry122513

    but this has also failed...

    3. I have also tried Spy Hunter 3. It is able to run the scan and the removal process, but soon Spyware Guard is reinstalled.

  3. Can't Remove Spyware Guard 2008

    in Spyware/Adware Information

    Posted · Edited by kmhn583

    I APOLOGIZE, I HAVE POSTED IN THE WRONG SECTION... PLEASE DELETE THIS POST.

    Greetings,

    I got the Spyware Guard 2008 virus today...

    I've tried some basic procedures laid out in various forums (listed below) which have all failed. I understand I should be posting a hijack I am not knowledged in this field so please excuse my ignorance...

    1. first tried simply installing MBAM and running the scan. The first time it detects something it gives me an error with an identification number which varies each time. I OK it and the scan continues, but soon it gets shut down by Spyware Guard every time (that is my guess because Spyware Guard always opens up when MBAM shuts down).

    2. I have tried the method described here: http://www.besttechie.net/forums/index.php...mp;#entry122513

    but this has also failed...

    3. I have also tried Spy Hunter 3. It is able to run the scan and the removal process, but soon Spyware Guard is reinstalled.

    My hijackthis log(I run a japanese environment windows, hence some of the characters):

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 13:47:23, on 2009/01/06

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16762)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\csrss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\acs.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\WINDOWS\RTHDCPL.EXE

    C:\WINDOWS\AGRSMMSG.exe

    C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

    C:\WINDOWS\system32\TPSMain.exe

    C:\Program Files\TOSHIBA\TOSHIBA Smooth View\SmoothView.exe

    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

    C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files\Toshiba\Tvs\TvsTray.exe

    C:\Program Files\McAfee.com\Agent\mcagent.exe

    C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe

    C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

    C:\Program Files\PeerGuardian2\pg2.exe

    C:\WINDOWS\system32\winscenter.exe

    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

    C:\WINDOWS\system32\TPSBattM.exe

    C:\Program Files\Synaptics\SynTP\Toshiba.exe

    C:\WINDOWS\system32\RAMASST.exe

    C:\Program Files\SetPoint\SetPoint.exe

    C:\Program Files\SolidWorks\SolidWorks\swScheduler\swBOEngine.exe

    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

    C:\WINDOWS\system32\DVDRAMSV.exe

    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    C:\Program Files\McAfee\MPF\MPFSrv.exe

    C:\Program Files\SolidWorks\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe

    C:\Program Files\twc\medicsp2\bin\sprtsvc.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

    C:\WINDOWS\system32\TODDSrv.exe

    C:\WINDOWS\system32\wdfmgr.exe

    C:\Program Files\Canon\CAL\CALMAIN.exe

    C:\WINDOWS\System32\alg.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\yphb.exe

    C:\WINDOWS\system32\taskmgr.exe

    C:\Program Files\Spyware Guard 2008\spywareguard.exe

    C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    C:\WINDOWS\system32\wbem\wmiprvse.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Yahoo!ツールバーフィッシング警告 - {1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4} - C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\ypho.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

    O2 - BHO: Yahoo!ツールバーヘルパー - {EEBA90E6-2B14-413F-9BF8-61A8BDF92258} - C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\YahooToolBar.dll

    O3 - Toolbar: The翻訳ツールバー - {FF278623-9AA4-489c-84CE-CF14D90CC70C} - c:\Program Files\TTI_V10LE\def_bar.dll

    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

    O3 - Toolbar: Yahoo!ツールバー - {AEF44653-C059-42CB-A5B7-41C640DA4A67} - C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\YahooToolBar.dll

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

    O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe

    O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Smooth View\SmoothView.exe

    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

    O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe

    O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

    O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe

    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

    O4 - HKLM\..\Run: [iMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32

    O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [solidWorks_CheckForUpdates] "C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe" /scheduler

    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

    O4 - HKLM\..\Run: [spyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe

    O4 - HKLM\..\Run: [spywareguard] C:\Program Files\Spyware Guard 2008\spywareguard.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe

    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl

    O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')

    O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')

    O8 - Extra context menu item: Image Converter 2 で転送 - C:\Program Files\Sony\Image Converter 2\menu.htm

    O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: The翻訳_ページ翻訳 - c:\Program Files\TTI_V10LE\addins\Ie\afi_pagetran.htm

    O8 - Extra context menu item: The翻訳_範囲指定翻訳 - c:\Program Files\TTI_V10LE\addins\Ie\afi_seltran.htm

    O8 - Extra context menu item: The翻訳_翻訳設定 - c:\Program Files\TTI_V10LE\addins\Ie\afi_setdlg.htm

    O8 - Extra context menu item: The翻訳_辞書参照 - c:\Program Files\TTI_V10LE\addins\Ie\ttp_showdic.htm

    O8 - Extra context menu item: Yahoo!ツールバーに追加 - res://C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\YahooToolBar.dll/script_search.htm

    O8 - Extra context menu item: Yahoo!検索で検索 - res://C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\YahooToolBar.dll/script_yahoo.htm

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun の Java コンソール - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra button: The翻訳_ページ翻訳 - {3009C231-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\afi_pagetran.htm

    O9 - Extra 'Tools' menuitem: The翻訳_ページ翻訳 - {3009C231-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\afi_pagetran.htm

    O9 - Extra button: (no name) - {3009C237-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\ttp_showdic.htm

    O9 - Extra 'Tools' menuitem: The翻訳_辞書参照 - {3009C237-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\ttp_showdic.htm

    O9 - Extra button: (no name) - {3009C238-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\afi_seltran.htm

    O9 - Extra 'Tools' menuitem: The翻訳_範囲指定翻訳 - {3009C238-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\afi_seltran.htm

    O9 - Extra button: (no name) - {3009C23A-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\afi_setdlg.htm

    O9 - Extra 'Tools' menuitem: The翻訳_翻訳設定 - {3009C23A-637C-4d4c-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\addins\Ie\afi_setdlg.htm

    O9 - Extra button: 辞書バー - {3009C23C-637C-4D4C-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\IeTbandTate.dll

    O9 - Extra button: 翻訳バー - {3009C23E-637C-4D4C-905F-4D6585D033CA} - c:\Program Files\TTI_V10LE\IeTbandYoko.dll

    O9 - Extra button: リサーチ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://dynabook.com/assistpc/index_j.htm

    O15 - ESC Trusted Zone: http://*.update.microsoft.com

    O16 - DPF: {3ADF17D2-F1A8-45E1-92BA-B72717779075} (あなたのdynabook.com) - http://dynabook.fresheye.com/TWAgent/TWAgent.cab

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://128.195.183.143/activex/AMC.cab

    O21 - SSODL: ieModule - {60494D3D-DDB8-444B-B4AF-AD56D7C09054} - C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll

    O21 - SSODL: InternetConnection - {3B1F9A2A-E01C-4DFB-B0D1-9B239B5CF350} - C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\rykjgwvxpi.dll

    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

    O23 - Service: Atheros 設定サービス (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: BeatJam Music Server - HTTP (BeatJamMusicStreamingServer) - Justsystem Corporation - C:\Program Files\Justsystem\BeatJam Music Server\BeatJamHttpService.exe

    O23 - Service: BeatJam Music Server - UPnP (BeatJamUPnPMusicServer) - Justsystem Corporation - C:\Program Files\Justsystem\BeatJam Music Server\BeatJamUPnPService.exe

    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

    O23 - Service: Remote Solver for COSMOSFloWorks 2008 - Unknown owner - C:\Program Files\SolidWorks\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe

    O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

    O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe

    O23 - Service: SupportSoft Sprocket Service (medicsp2) (sprtsvc_medicsp2) - SupportSoft, Inc. - C:\Program Files\twc\medicsp2\bin\sprtsvc.exe

    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

    O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

    --

    End of file - 13997 bytes