Topic: recycler.exe

[vishwanath99]

You can configure 0% of disk space of that particular disk drive in restore point 
option

[Samker]

i have bit defender total security 2012 will this do?

In that case use Panda or ESET Online Scanner.

Jade, did you finish this Online AV Scans??

We're still waiting for your log...

[jade0220]

sorry my connection is a little slow, still scanning i'll send you the log right away...tnx

[Samker]

sorry my connection is a little slow, still scanning i'll send you the log right away...tnx

No problem, We'll be here...

[jade0220]

at last...here are the logs...


C:\Users\JACKSON0220\AppData\Roaming\IDM\DwnlData\JACKSON0220\chatvibes108_135\chatvibes108.exe   a variant of Win32/MessengerPlus.A application   deleted - quarantined
D:\applications\programs\Cyberlink POWER DIRECTOR Ultra v7.00.1628(NEW-with serial keys)\Cyberlink PowerDirector Ultra v7.00.1628.rar   probably a variant of Win32/Agent.JAMZZKT trojan   deleted - quarantined
D:\applications\utilities\Gamebooster 2.3 [Adrianus217].exe   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
D:\applications\utilities\IObit GameBooster Premium 2.4.1.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
D:\applications\utilities\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
D:\applications\utilities\HDD Regenerator 2011\hr2011.exe   NSIS/TrojanDownloader.FakeAlert.DK trojan   deleted - quarantined
D:\downloads\dell\drivers\chatvibes108.exe   a variant of Win32/MessengerPlus.A application   deleted - quarantined
D:\downloads\Microsoft Office 2010 Activator [ kk ]\Microsoft Office 2010 Activator [ kk ].rar   Win32/HackKMS.A application   deleted - quarantined
F:\antivirus\bitdefender 2012\BitDefender 2012 Crack.rar   a variant of MSIL/Injector.JU trojan   deleted - quarantined
F:\applications\programs\Cyberlink PowerDirector Ultra v7.00.1628.rar   probably a variant of Win32/Agent.JAMZZKT trojan   deleted - quarantined
F:\applications\programs\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
F:\applications\programs\MS OFFICE PRO 2010\Microsoft Office 2010 Activator [ kk ]\Microsoft Office 2010 Activator [ kk ].rar   Win32/HackKMS.A application   deleted - quarantined
F:\applications\utilities\Gamebooster 2.3 [Adrianus217].exe   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
F:\applications\utilities\Product Key_awal.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
F:\Autorun.inf\ImmunityFolder...\antivirus.lnk   Win32/Dorkbot.D worm   cleaned by deleting - quarantined
F:\OS\windows7\Crack\SLIC Dump ToolKit v2.0\SLIC_Dump_ToolKit.EXE   a variant of Win32/Packed.FlyStudio application   cleaned by deleting - quarantined



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:56:27 AM, on 2/15/2012
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\AutorunRemover\AutorunRemover.exe
C:\Program Files (x86)\uTorrent Turbo Accelerator\uTorrent Turbo Accelerator.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
C:\Program Files (x86)\Internet Download Manager\IDMan.exe
C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {c34bfb11-eff0-4123-a7a5-79051ef24cf5} - (no file)
R3 - URLSearchHook: YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: (no name) - {c34bfb11-eff0-4123-a7a5-79051ef24cf5} - (no file)
O4 - HKLM\..\Run: [AutorunRemover.exe] C:\Program Files (x86)\AutorunRemover\AutorunRemover.exe -Hide
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C1770C9-4604-4B9F-9EF5-B9CC2ADCCAC0}: NameServer = 202.126.40.5 222.127.143.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C7209F9-7AF1-477E-AC68-2C5F189018AE}: NameServer = 202.126.40.5 222.127.143.5
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\Windows\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: RtVOsdService Installer (RtVOsdService) - Realtek Semiconductor Corp. - C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
O23 - Service: SafeBox - Bitdefender - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: BitDefender Update Server v2 (Update Server) - BitDefender - C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BitDefender Desktop Update Service (UPDATESRV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9802 bytes

[jade0220]

where do i get those viruses? do i need to change antivirus software?tnx so mch...

[devnullius]

Sigh... All those people... Trying their best...

Try my approach, this is what I do

FIRST start cmd prompt with admin right, type: chkdsk c: /f /v /x
Reboot your computer, confirm that check disk has NO errors. Keep looking, information at the last 5 seconds before auto-reboot is important.

Hard drive ok?

Download:
- combofix http://www.bleepingcomputer.com/download/anti-virus/combofix
- Superantispyware http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
- Cleanup! by Steven Gould http://stevengould.org/downloads/cleanup/CleanUp452.exe

Install & run Cleanup! It proposes to run in DEMO mode. Say no. Configure Cleanup! to Cleanup all users. Also, use last tab of Options to Scan drive for files matching filter. Run it for real (not demo), and log off (just to be sure when you are infected with virii).

After this, scan times will greatly be reduced. You could finish up with a Microsoft Disk Cleanup - it does other things like compressing files. For virii related stuff, all temp sheit is handled by Cleanup! by ~

After log-on again, install Superantispyware. The program is a little paranoid, but not too much. In cases like these, I always run it - just keep a careful eye on what is removed (and might need to be re-installed by you - either falsely, or due to infection).

Scan the complete system. Remove whatever, just be done with it.

Reboot computer, user F8 to boot into safe mode.

In safe mode, run Combofix. Ignore warnings about installed anti-virus solutions. When on XP, install Recovery Console and continue (registry backup). Then, a blue DOS screen will appear showing you approx. 50 steps. CHECK if every step runs successful. If it does, just look at the log file that will appear after the reboot. Look especially at the last part - and post it here anyways? ; p

After these steps, 90% of systems is completely cured. Rare cases exist where Combofix will just hang. I  know of 2 cases on Dell machines where nobody has an answer about why. Including me :s

Let us know - I'll check when I have time ; )

peace!

Devvie


~~~ notemail@facebook.com ~~~

Cuisvis hominis est errare, nullius nisi insipientis in errore persevare
——
All spelling mistakes are my own and may only be distributed under the GNU General Public License! – (© 95-1 by Coredump; 2-012 by DevNullius)

[devnullius]

When you re-post and all looks clean, I'll add some more tricks to prevent sheit in the future. Including some custom scripts and how to schedule them. All depending on your system, thus your feedback.

Peace!

Devvie

[devnullius]

C:\Users\JACKSON0220\AppData\Roaming\IDM\DwnlData\JACKSON0220\chatvibes108_135\chatvibes108.exe   a variant of Win32/MessengerPlus.A application   deleted - quarantined
--> I don't know it. Google?

D:\applications\programs\Cyberlink POWER DIRECTOR Ultra v7.00.1628(NEW-with serial keys)\Cyberlink PowerDirector Ultra v7.00.1628.rar   probably a variant of Win32/Agent.JAMZZKT trojan   deleted - quarantined
--> Unless you downloaded a portable collection of softwares with torrents, I guess this is a false warning.

D:\applications\utilities\Gamebooster 2.3 [Adrianus217].exe   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
D:\applications\utilities\IObit GameBooster Premium 2.4.1.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
--> Gamebooster should be legit too.

D:\applications\utilities\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
--> Should be legit... Upload to online multi virus scanner.

D:\applications\utilities\HDD Regenerator 2011\hr2011.exe   NSIS/TrojanDownloader.FakeAlert.DK trojan   deleted - quarantined
--> Should be legit... Upload to online multi virus scanner.

D:\downloads\dell\drivers\chatvibes108.exe   a variant of Win32/MessengerPlus.A application   deleted - quarantined
--> Again, don't know it. Upload to online multi virus scanner?

D:\downloads\Microsoft Office 2010 Activator [ kk ]\Microsoft Office 2010 Activator [ kk ].rar   Win32/HackKMS.A application   deleted - quarantined
Legit warez. Keep it, needed for Office activation. Add to ignore list of anti-virus.

F:\antivirus\bitdefender 2012\BitDefender 2012 Crack.rar   a variant of MSIL/Injector.JU trojan   deleted - quarantined
F:\applications\programs\Cyberlink PowerDirector Ultra v7.00.1628.rar   probably a variant of Win32/Agent.JAMZZKT trojan   deleted - quarantined
F:\applications\programs\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key\Advanced SystemCare Pro 4.0.1.200 Final ML Software + Serial Key.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
F:\applications\programs\MS OFFICE PRO 2010\Microsoft Office 2010 Activator [ kk ]\Microsoft Office 2010 Activator [ kk ].rar   Win32/HackKMS.A application   deleted - quarantined
F:\applications\utilities\Gamebooster 2.3 [Adrianus217].exe   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
F:\applications\utilities\Product Key_awal.rar   a variant of Win32/Toolbar.Widgi application   deleted - quarantined
F:\Autorun.inf\ImmunityFolder...\antivirus.lnk   Win32/Dorkbot.D worm   cleaned by deleting - quarantined
F:\OS\windows7\Crack\SLIC Dump ToolKit v2.0\SLIC_Dump_ToolKit.EXE   a variant of Win32/Packed.FlyStudio application   cleaned by deleting - quarantined
-->  -->  -->  -->  -->  I guess the story is the same for all that follows above. Probably legit, just triggered by ignorant anti-virus programs.

I'll take a look an what your problems actually were ;)

Peace!

Devvie

[devnullius]

Sounds like we are being trolled? User is just 'worried' if problem will remain... Is it remaing? I guess not?

War!

Dev Nullius