Hello

thanks for your reply
i will easily uninstall mp4 player ,but it is not the case with ask search.simply i can not get rid of if .when i try to uninstall it i receive an error message.i is not the first time i can only remove it when i use a new windows.what should i do.moreover i have a lot of spywares on the computer which are really difficult to delete.thanks

Ok.





Download This program.

and save it on the desktop. Then double click on it (Fix_download.exe).

You may have to allow the program to download files from the web!

The program download the necessary cleaning programs. Once the program
is downloaded, there will be a folder on your desktop named
Fix. – if the instructions not automatically opens, so
double-click "FIX_manual.htm" in Fix folder.

Please follow the instructions and copy the logs here, in this Topic.



Note : Fix_download.exe is detected by some antivirus programs as a "RiskTool" /infection; it is not a virus. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

If necessary, temporarily disable your anti-virus, real-time protection before downloading






Before you provide them, we ask that you remove any P2P/file sharing programs if you have any, and this includes Bit Torrent software, before we clean your computer.

thanks for your help

i am sorry to have to tell you that i downloaded this programe and it was infected with win32 trojan _gen(other) so is the system volume information,according to the scan by avast.it didnt even work ,when i tried i got an error message.what happened did it got infected the second it entered the computer???

Seems your computer are pretty much messed up.


We´ll try this scanner then ->





Please download DDS: https://download.bleepingcomputer.com/sUBs/dds.scr

to your Desktop and doubleclick on DDs.scr to run it.

If your security software includes script blocking features, please disable these before you run this utility.




When the scan has finished, two logs will open.

Copy and paste both reports in this topic.

The logs will be reasonably large so you may have to divide them into sections and make several posts to post them.



Before you provide them, we ask that you remove any P2P/file sharing programs if you have any, and this includes Bit Torrent software, before we clean your computer.

okay there are the logs .

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 23/08/2009 04:13:13 ص
System Uptime: 23/08/2009 05:44:58 ص (3 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | G31M-S2C
Processor: Intel(R) Celeron(R) D CPU 3.06GHz | Socket 775 | 3067/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 20 GiB total, 16.819 GiB free.
D: is FIXED (NTFS) - 95 GiB total, 4.376 GiB free.
E: is FIXED (NTFS) - 95 GiB total, 21.955 GiB free.
F: is FIXED (NTFS) - 88 GiB total, 82.29 GiB free.
G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 23/08/2009 04:15:13 ص - Installed Windows Media Player 11
RP2: 23/08/2009 04:15:55 ص - Installed Windows XP Wudf01000.
RP3: 23/08/2009 04:17:53 ص - Installed Browser Configuration Utility
RP4: 23/08/2009 04:20:30 ص - Installed Windows XP KB888111WXPSP2.
RP5: 23/08/2009 04:20:57 ص - Installed Realtek High Definition Audio Driver
RP6: 23/08/2009 04:24:38 ص - Installed REALTEK GbE & FE Ethernet PCI-E NIC Driver
RP7: 23/08/2009 04:26:57 ص - Installed COWON Media Center - jetAudio Plus VX
RP8: 23/08/2009 04:31:30 ص - Installed SUPERAntiSpyware Free Edition

==== Installed Programs ======================

Adobe Flash Player 10 Plugin
AlienGUIse Theme Manager
Anti Netcut 2
avast! Antivirus
Browser Configuration Utility
COWON Media Center - jetAudio Plus VX
High Definition Audio Driver Package - KB888111
Hotfix for Windows XP (KB896344)
Intel(R) Graphics Media Accelerator Driver
Microsoft Choice Guard
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.2)
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Replay Media Catcher 3.02
ScanSpyware v3.7
Security Update for Windows Media Player (KB911564)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB911927)
SUPERAntiSpyware Free Edition
WebFldrs XP
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB887797
Windows XP Hotfix - KB892489
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

23/08/2009 04:14:57 ص, information: Windows File Protection [64032] - Windows File Protection is not active on this system.

==== End Of File ===========================

DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 8:02:53.36 on Sun 08/23/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.1013.191 [GMT 3:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Anti Netcut\Anti NetCut.exe
E:\Install\برامج مهمة\very important\wlsetup-custom.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
D:\GAMES\silk road\Silkroad Arabic\sro_client.exe
D:\GAMES\silk road\Silkroad Arabic\sro_client.exe
C:\Program Files\JetAudio\JetAudio.exe
D:\GAMES\silk road\Silkroad Arabic\New Folder (2).exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Documents and Settings\Administrator\Desktop\ssss.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll
mWinlogon: SfcDisable=-99 (0xffffff9d)
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [antinetcut2] c:\program files\anti netcut\Anti NetCut.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\alienw~1.lnk - c:\program files\alienguise\alienwaredock\ObjectDock.exe
uPolicies-explorer: NoSMHelp = 1 (0x1)
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoInstrumentation = 1 (0x1)
dPolicies-explorer: NoSMHelp = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
dPolicies-explorer: NoInstrumentation = 1 (0x1)
IE: Download with IDM - e:\install\new folder\idm9\IEExt.htm
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\internet download manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\internet download manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\internet download manager\IEGetVL.htm
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
Notify: WB - c:\program files\alienguise\fastload.dll
AppInit_DLLs: wbsys.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\yee0ff2l.default\
FF - component: c:\documents and settings\administrator\application data\idm\idmmzcc2\components\idmmzcc.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-8-23 78416]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-8-5 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-8-5 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-23 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-8-23 147640]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-8-23 250040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-8-23 348344]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-8-5 7408]

=============== Created Last 30 ================

2009-08-23 07:07 3,072 a------- c:\windows\system32\drivers\audstub.sys
2009-08-23 07:06 57,472 a------- c:\windows\system32\drivers\redbook.sys
2009-08-23 07:05 74,240 a------- c:\windows\system32\usbui.dll
2009-08-23 07:04 <DIR> --d----- c:\program files\common files\ODBC
2009-08-23 07:03 5,632 a----r-- c:\windows\system32\kbdheb.dll
2009-08-23 07:03 <DIR> --d--r-- c:\documents and settings\all users\Documents
2009-08-23 07:02 <DIR> --d----- c:\windows\system32\CatRoot2
2009-08-23 07:02 <DIR> --d----- c:\windows\system32\CatRoot
2009-08-23 07:02 <DIR> --d----- C:\Documents and Settings
2009-08-23 07:01 1,735 a------- c:\windows\system32\$winnt$.inf
2009-08-23 06:50 <DIR> --d----- c:\program files\Microsoft
2009-08-23 06:40 <DIR> --d----- c:\program files\common files\Windows Live
2009-08-23 05:31 <DIR> --d----- c:\program files\common files\DVDVideoSoft
2009-08-23 05:28 <DIR> --d----- c:\program files\KB823980Scan
2009-08-23 05:23 <DIR> --d----- c:\program files\Anti Netcut
2009-08-23 04:41 <DIR> --d----- c:\program files\Replay Media Catcher
2009-08-23 04:38 <DIR> --d----- c:\program files\common files\Stardock
2009-08-23 04:38 <DIR> --d----- c:\program files\AlienGUIse
2009-08-23 04:36 <DIR> --d----- c:\program files\ScanSpyware v3.7
2009-08-23 04:35 <DIR> --d----- c:\program files\Internet Download Manager
2009-08-23 04:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-08-23 04:31 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-08-23 04:31 <DIR> --d----- c:\docume~1\admini~1\applic~1\SUPERAntiSpyware.com
2009-08-23 04:31 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-08-23 04:30 <DIR> --d----- c:\program files\Yahoo!
2009-08-23 04:29 <DIR> --d----- c:\docume~1\admini~1\applic~1\IDM
2009-08-23 04:29 <DIR> --d----- c:\docume~1\admini~1\applic~1\DMCache
2009-08-23 04:27 <DIR> --d----- c:\docume~1\admini~1\applic~1\COWON
2009-08-23 04:26 <DIR> --d----- c:\program files\JetAudio
2009-08-23 04:26 <DIR> --d----- c:\program files\common files\COWON
2009-08-23 04:21 <DIR> --d----- c:\program files\Realtek
2009-08-23 04:17 <DIR> --d----- c:\program files\Browser Configuration Utility
2009-08-23 04:15 <DIR> --dsh--- c:\documents and settings\all users\DRM
2009-08-23 04:11 <DIR> --d-h--- c:\program files\WindowsUpdate
2009-08-23 04:11 <DIR> --d----- c:\program files\Online Services
2009-08-23 04:10 <DIR> --d----- c:\program files\common files\MSSoap
2009-08-23 04:08 <DIR> --d----- c:\program files\Windows NT

==================== Find3M ====================

2009-08-23 06:43 237,568 a------- c:\windows\system32\rmc_rtspdl.dll
2009-08-23 06:43 156,672 a------- c:\windows\system32\rmc_fixasf.exe
2009-08-23 06:43 323,584 a------- c:\windows\system32\AUDIOGENIE2.DLL
2009-08-23 05:23 286,720 -------- c:\windows\Setup1.exe
2009-08-23 05:23 73,216 a------- c:\windows\ST6UNST.EXE
2009-08-23 04:25 16,608 a------- c:\windows\gdrv.sys
2009-08-23 04:09 21,640 a------- c:\windows\system32\emptyregdb.dat
2006-09-16 16:20 1,880,140 a------- c:\program files\Anti NetCut.CAB
2006-09-16 16:20 3,808 a------- c:\program files\SETUP.LST
1998-06-18 00:00 140,800 a------- c:\program files\setup.exe

============= FINISH: 8:03:15.84 ===============
i hope that is what you need ,thanks

It is.



Please download combofix here ->

https://download.bleepingcomputer.com/sUBs/ComboFix.exe

Before Saving it to Desktop, please rename it to alg.exe to stop malware from disabling it.



Disable your AntiVirus and AntiSpyware applications, they may otherwise interfere with Combofix.



Now, please make sure no other programs are running, close all other windows.


Please double click on the file you downloaded. Follow the onscreen prompts to start the scan.
Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall.
It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after
scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted.

Usually located in c:\combofix.txt, please post it to your next reply

it seems like a very powerful programe can you please tell me what do you suspect.

Infections

hello again ,

can you please have a look at this it may be the problem.



Application Information

=======================



Application Version: ScanSpyware v3.7 build 3.7.0.8

Original Database: pests08-03-04.db

Updated Database: pests08-03-04.db

Current Date: Sunday, August 23, 2009 02:04:30 PM

__________________________________________________



Directories recognized:

=======================



__________________________________________________



Files recognized:

=================



[Gain.Gator]

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\setup.exe



[MySearch]

C:\WINDOWS\SET4.tmp



__________________________________________________



Registry keys recognized:

=========================



[C-Dilla]

HKEY_LOCAL_MACHINE\SOFTWARE\C07ft5Y



[MyWebSearch]

HKEY_CLASSES_ROOT\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}



[MyWebSearch]

HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}



[Download Accelerator Plus]

HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\ftp



[Download Accelerator Plus]

HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\http



__________________________________________________



Registry values recognized:

===========================



__________________________________________________



Cookies recognized:

===================



__________________________________________________

No. I don´t trust ScanSpyware program as it is a Rogue program.




Still waiting for a combofix log.

hello
i don not know why you stopped answering but thanks any way with your help i had most of my problems solved except for one thing .in each scan i perform scan the antivirus detects a trojan horse on the system volume information restore . obviously it can not be deleted by the normal scan because i notice it every time .can you please tell me how dangerous it is and how can i remove it .
thanks again
waiting for your reply

I DO NOT stopped answering, as I mention in my last reply, am I waiting for you to post a combofix log.

i am sorry i did not see it before,i will send you the log as soon as i have it.
thanks


by the way what does rogue program means

No problem.

It means -> unreliable, untrustworthy