VCDQuality Forums - Annoying icon

Show all 9 posts from this thread on one page

VCDQuality Forums (http://www.vcdhq.com/forum/index.php)
- Computer and Audio/Video help (http://www.vcdhq.com/forum/forumdisplay.php?forumid=56)
-- Annoying icon (http://www.vcdhq.com/forum/showthread.php?threadid=80752)

Posted by Spank on 04-10-2008 01:58 PM:

Annoying icon

i have an icon in the bottom right 9system tray) and it looks like the windows 'shield' in that it has a big white cross on a red shield...but it keeps flipping to a blue shield with a question mark on it! every now and then it comes up with a box that says somethings like 'security alert'. you cant right click and get rid of it, you cant left click it because with either mouse button it opens up a web page called 'http://www.virusheat.com/?aff=1012'

i don't know what the program is, its not the normal windows security thing because that brings up a diff icon.

i have a Hijackthis log if anyone can help me at all?

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:57:47, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\pm_proc1.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
c:\windows\system32\pm_proc2.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Downloads\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: 215651 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\system32\215651\215651.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {D810B78A-D010-44DF-8445-AC58086B600E} - C:\WINDOWS\system32\pm_dll.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [plsi] C:\WINDOWS\system32\pm_proc1.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...b?1198630467843
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: asparagine - {65bbf06c-ea06-4818-92a3-f3550d0e1004} - C:\WINDOWS\system32\rkvdr.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5168 bytes

if anyone can help it woudl be appreciated!

__________________
Im The Daddy!

Posted by Linnets on 04-10-2008 03:25 PM:

Look here . There even appears to be a removal tool on that page. I don't see any reason to suspect the linked website to be anything other than honest.

Posted by Neversoft on 04-10-2008 06:21 PM:

Try Linnet's remover, then run RogueRemover through your PC as well: http://www.malwarebytes.org/rogueremover.php

Then switch to Firefox so this shit doesn't just "walk into" your PC next time

Posted by MrEMann on 04-10-2008 06:27 PM:

There are probably 15 variants of the same scenario I have seen from our E.U.s

Each is heinous, each is a bitch to get rid of, and can take 3-4 different tools to get rid of.

For example:

I just removed it from an XPS laptop, had to remove everything from HiJack this, use some vundo tools that do an exceptional job cleaning DNS hijacks, AdAware, Spy Bot, and RootKit Revealer all from an XPE windows disk and safe mode to finally get rid of it.

Good luck.

IF you caught it early enough, a good ASW program can most likely find and remove it, but do it in safe mode. And use Crap Cleaner or the like to blow all your temp, inet, and history files away from the system, as it loads back in some weird places.

__________________

Posted by danimal39 on 04-10-2008 06:46 PM:

quote:
Originally posted by Neversoft
switch to Firefox so this shit doesn't just "walk into" your PC next time [/B]

ns is right ,switch to firefox,and here a few tweaks ounce its set
Tuesday, 23 November 2004
Ok, its no secret..Firefox is my favorite browser.. infact, if you are not using it (for example using... Gasp, IE) you need to change. Well I decided to write an article on how to "hack" Firefox to make it even better. Using a few tweaks here and there, we can make FireFox considerably faster, enable advanced tab options, make newer versions compatible with older extentions, run directly from a flash disk, and on and on.
First, Lets change some hidden options to make it faster...
Open Firefox 1.0 and in the address bar type: about :config

1. Find browser.tabs.showSingleWindowModePrefs and double click on it so it = true
2. Find network.http.pipelining and double click on it so it = true
3. Find network.http.pipelining.maxrequests double click on it and change it from 4 to 100

What do these changes do?
1. Then enables advanced tab options in your Tools/Options page
2. This enables option #3.
3. This makes FF use 8 threads to each page.. Bascially, if you thought FF was fast before, try it after this.

Second, lets make it look better...
Visit the Mozilla Firefox theme page and select a theme that looks good to you.
I personally like the Noia eXtreme skin, but choose one that looks good to you.

Now lets make it work FOR us...
One of the sweetest thing about Firefox is the ability to use extentions. At the time of this writing, there are 226 extentions that we can use to make it better.. I will only touch on a few of them that I use. (Alphabetically Sorted)
Adblock: Remove inline ads.

Bookmarks Synchronizer: Save your bookmarks to an XML file, and sync with an FTP server. Keep your work/home bookmarks current!

Digger: Navigate to parent directories, switch to ftp equivalent of site, climb subdomains, etc.. Very helpful in "scouting" a site.

Download Sort: Automatically send downloads to specific folders based on file's extention.

Gmail Notifier: Lets you know if you have new gmail

Google Pagerank Status: Lets you see the Google PageRank of the page you are visiting.

refspoof: "Spoof" your referer.

Spiderzilla: Download an entire site to a local directory.

Super DragAndGo: Drag a link to blank space on a webpage, and it will open it in a new tab.

SwitchProxy: Manage and switch between multiple proxies. Make sure to read my article on finding and useing proxies.

User Agent Switcher: Switch the user agent of your browser.

MouseGestures:
This is the "Mouse Gestures" firefox extension. Basically, to go forward you draw a line from left to right while holding down the mouse button, to go back you draw a line from right to left while holding down, to close draw a L, to open a new page, from bottom to top - there are other options such as switch tabs, source, view cookies, etc.
I have personally found this to make my browsing experience much easier and much more reflexive (I don't think about pressing the back button, so much as automatically drawing it); when I use internet explorer oftentimes I right click by accident.

x: Gives a Toolbar "paranoia" button, click it and it can clear history, form info, saved passwords, download history, cookies, & cache.

Fasterfox: This extension automatically employs link prefetching, network tweaking, enhanced pop-up blocking, along with simultaneous connections, pipe-lining, enhanced caching, DNS caching, and initial paint delaying to make FireFox so fast it can break servers (or at least hurt them).

Firefox on a USB Thumbdrive
Check out the article on Portable Firefox 1.0

Tell Firefox what we want to see (and what we don't)
Sick of Google Ads on everyone's page? Well lets tell firefox that we don't want to see them anymore. This hack will remove 95% of all Ads, including google Ads. (Yes, even from Gmail. Warning, Removing these ads may violate the TOS of Gmail)

This hack uses the magic of CSS and a Firefox configuration file named UserContent.css. We are going to edit this file, I suggest you download the plugin ChomEdit to make your job easier. (Go install it now & come back after restart)

Ok, now that you have ChromEdit installed, open Firefox and click on Tools / Edit User files. A new window will appear that has five tabs across the top. Click on the tab that is labeled userContent.css. Next click on the link below and copy all the text. Then paste it into the userContent.css file, then click the Save button.
Code

Now restart your browser.. Tada, Google ads are gone!

From Digital Media Minute:

The above rules make use of the *!important* property value to override any rules that may already exist within the page that is being loaded. In the first rule, GMail has an element with an id of rh and we are setting the tables that have a class equal to metatable within that element, to not display (ie . display:none)
A word of caution, we are only hiding the ads from displaying. They are actually still there, just not visible. This means that Google is still indexing your email messages to provide you with “targetted ads”. It is also worth noting that as this hack is based upon creating CSS rules for existing GMail code, it is very possible that this hack will break as GMail continues to evolve.

Other Contributions:
yankeesfan: to get older extensions to work in 1.0, edit extensions.lastAppVersion from '1.0' to '.10'. Bugmenot and others will now work.

...More to come, send me your contributions such as tweaks, favorite extentions, etc..
Last Updated ( Thursday, 06 October 2005 )
from I-hacked

Posted by Spank on 04-10-2008 08:40 PM:

wow...cheers for your replies!

gonna use the couple you mentioned! and for the record, the computer has got firefox on it

__________________
Im The Daddy!

Posted by MrEMann on 04-10-2008 09:04 PM:

quote:
Originally posted by Spank
wow...cheers for your replies!

gonna use the couple you mentioned! and for the record, the computer has got firefox on it

As did the XPS I just fixed AND It was the default browser AND it had all the cool mods/tweaks in place.

Try again.

__________________

Posted by danimal39 on 04-10-2008 09:33 PM:

quote:
Originally posted by eljefeoscuro
As did the XPS I just fixed AND It was the default browser AND it had all the cool mods/tweaks in place.

Try again.

I expected as much out of you,lol,you are the best

Posted by Avenue_1 v5.0b on 04-10-2008 09:52 PM:

Give him an e-wank to show your gratitude.

__________________
..:::RESERVED:::..

All times are GMT. The time now is 03:44 AM.

Show all 9 posts from this thread on one page