Help!

True_Snake · 03-15-2005, 04:48 PM

I have this problem with my computer! And I need your help.

On C: drive I have these hidden files as shown in the attachment.

When I delete them, they come back. They also close any internet explorer pages with words like "V - I -R - U - S" etc.
????: NamePros.com http://www.namepros.com/the-break-room/75565-help.html

I even tried S a f e m o d e and they still came back.

I GOOGLED it and I figured that there's a tool by Symantic for it but the link isnt working!

See if it works for you:

http: / /securityresponse.symantec.com/avcenter/venc/data/w32.serflog.a.removal.tool.h t m l

(just remove the spaces at the beginning and end.)

This "problem" also was on my other computer and got into this one through a CD I burned on the other one.

It basically burns "a u to r u n .d l l" (without spaces) on to the CD and transferrs to the other computers.

It also closes C T RL A L T D E L every time I press it!

I hope whoever made this virus burns in hell....

Please help!

Thanks !

True_Snake

snoopi · 03-15-2005, 05:02 PM

Download this stand alone application and God bless you my child.

http://download.nai.com/products/mca...rt/stinger.exe

True_Snake · 03-15-2005, 05:07 PM

Originally Posted by snoopi

Download this stand alone application and God bless you my child.
????: NamePros.com http://www.namepros.com/showthread.php?t=75565

http://download.nai.com/products/mca...rt/stinger.exe

I already downloaded that and used it; didn't detect anything for some reason. I'll try it again.

By the way, when I click on this thread, the window closes.

I have to use a THIRD computer now.

Thanks snoopi!

Anyone else??

True_Snake

Mark · 03-15-2005, 05:12 PM

What spyware/virus programs you got True ?

I know most cringe at the thought - But the new Microsoft one is picking up a lot of stuff on mine (But there is a bug or 2 still in it as well) But I'll take their gliches over Viruses any day !

- as well as -

Norton
spybot
etc ...

True_Snake · 03-15-2005, 05:20 PM

Ah! I'm in safe mode now; and can access this thread.

Anyways: All4:

I have on this one:

Norton
Hijack This
And That's about it.

On the other one I have:

Spybot
Lavasoft's Adaware
Spy Sweeper
Norton
Hijack This

I fixed the problem on the other one; but my internet screwed up with it!

HELP!

Can I please get the link for the Microsoft one?

Thanks.

EDIT:

Here's my Hijack this log; it's the same on the other one too!

I delete all those hosts and they come back after restarting!

Originally Posted by HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 8:23:52 PM, on 15/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Desktop\stinger.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O1 - Hosts: 64.233.167.104 www.symantec.com
????: NamePros.com http://www.namepros.com/showthread.php?t=75565
O1 - Hosts: 64.233.167.104 www.sophos.com
O1 - Hosts: 64.233.167.104 www.mcafee.com
O1 - Hosts: 64.233.167.104 www.viruslist.com
O1 - Hosts: 64.233.167.104 www.f-secure.com
O1 - Hosts: 64.233.167.104 www.avp.com
O1 - Hosts: 64.233.167.104 www.kaspersky.com
O1 - Hosts: 64.233.167.104 www.networkassociates.com
O1 - Hosts: 64.233.167.104 www.ca.com
O1 - Hosts: 64.233.167.104 www.my-etrust.com
O1 - Hosts: 64.233.167.104 www.nai.com
O1 - Hosts: 64.233.167.104 www.trendmicro.com
O1 - Hosts: 64.233.167.104 www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
????: NamePros.com http://www.namepros.com/showthread.php?t=75565
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.mcafee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.mcafee.com
O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.mcafee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
O4 - HKLM\..\Run: [serpe] C:\WINDOWS\system32\serbw.exe
O4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\system32\serbw.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

NEED HELP

!

Thanks.

True_Snake

Mark · 03-15-2005, 05:53 PM

I think the "Old Lady" installed it (Microsoft) - and She's 800 miles away

I think it is in Beta test still and More than likely it was part of an Update ~

http://www.microsoft.com/athome/secu...s/default.mspx

suthra · 03-15-2005, 06:59 PM

I have uploaded that symantec tool in
http://thankyouspammers.com/FixSflog.exe

incase if u need it

s.s

sufi · 03-15-2005, 07:03 PM

How about formatting your hard drive and installing a fresh windows copy

True_Snake · 03-15-2005, 07:14 PM

WOHOOO! It's fixed!

Thanks snoopi, All4, suthra and sufi

!

The Symantic tool fixed it!

Thanks guys!

Just one thing though; these Symantic "Security Alerts keep popping up!

I've attached a screenshot.
I keep pressing "Okay" and even tried un-checking the box, etc. Just pops up every 30 or so seconds.

I opened Norton, and looked around, can't seem to find a way to stop that.

BTW: I have Norton 2004.

Thaks again

!
????: NamePros.com http://www.namepros.com/showthread.php?t=75565

True_Snake

PS: I gave all of you reputation points, but All4, sorry, I need to "spread it around first"

.

redhippo · 03-15-2005, 11:05 PM

glad you found a solution snake...!

03-15-2005, 04:48 PM	THREAD STARTER #1 (permalink)
True_Snake In-House Graphic Designer Join Date: Aug 2004 Location: Toronto, Canada Posts: 4,288	Help! I have this problem with my computer! And I need your help. On C: drive I have these hidden files as shown in the attachment. When I delete them, they come back. They also close any internet explorer pages with words like "V - I -R - U - S" etc. ????: NamePros.com http://www.namepros.com/the-break-room/75565-help.html I even tried S a f e m o d e and they still came back. I GOOGLED it and I figured that there's a tool by Symantic for it but the link isnt working! See if it works for you: http: / /securityresponse.symantec.com/avcenter/venc/data/w32.serflog.a.removal.tool.h t m l (just remove the spaces at the beginning and end.) This "problem" also was on my other computer and got into this one through a CD I burned on the other one. It basically burns "a u to r u n .d l l" (without spaces) on to the CD and transferrs to the other computers. It also closes C T RL A L T D E L every time I press it! I hope whoever made this virus burns in hell.... Please help! Thanks ! True_Snake __________________ Logos:PM ME! OVECHKIN.INFO! Rising Star!

03-15-2005, 05:02 PM	#2 (permalink)
snoopi Senior Member Join Date: May 2004 Location: E.U. Posts: 1,038	Download this stand alone application and God bless you my child. http://download.nai.com/products/mca...rt/stinger.exe __________________ WebProxy.cc - Browse what & when you want! :kickass: Brand New Media Site Script MyMediaScript.com:kickass:

03-15-2005, 05:12 PM	#4 (permalink)
Mark Hi :) Join Date: Mar 2004 Location: NC Posts: 9,537	What spyware/virus programs you got True ? I know most cringe at the thought - But the new Microsoft one is picking up a lot of stuff on mine (But there is a bug or 2 still in it as well) But I'll take their gliches over Viruses any day ! - as well as - Norton spybot etc ... __________________ When the man at the door yelled "Alcohol , Tobacco , and Firearms" .... I just assumed it was a delivery !

03-15-2005, 05:53 PM	#6 (permalink)
Mark Hi :) Join Date: Mar 2004 Location: NC Posts: 9,537	I think the "Old Lady" installed it (Microsoft) - and She's 800 miles away I think it is in Beta test still and More than likely it was part of an Update ~ http://www.microsoft.com/athome/secu...s/default.mspx __________________ When the man at the door yelled "Alcohol , Tobacco , and Firearms" .... I just assumed it was a delivery !

03-15-2005, 06:59 PM	#7 (permalink)
suthra Senior Member Join Date: Feb 2004 Posts: 2,656	I have uploaded that symantec tool in http://thankyouspammers.com/FixSflog.exe incase if u need it s.s __________________ A single smile can be a solution to several problems.:) www.adult.ec is for Sale! Why not make an Offer?

	NamePros Account Upgrade	Forum Sponsorship
	Take advantage of our upgraded membership levels (2 levels to choose from) so you can have MORE active sales threads, Custom Titles, A Directory Listing, Invisible Mode, Message Tracking, And MORE!

03-15-2005, 07:03 PM	#8 (permalink)
sufi NamePros Expert Join Date: Mar 2005 Location: LinksHut.com Posts: 7,697	How about formatting your hard drive and installing a fresh windows copy

03-15-2005, 11:05 PM	#10 (permalink)
redhippo NamePros Expert Join Date: Oct 2003 Location: ANForum Posts: 5,218	glad you found a solution snake...! __________________ \|www.vb-skins.com\|- Quality Premade Vbulletin skins for Your VB forum makeover \|www.Banjir.com\|-Free image hosting?[B]For Sale!\|AlphaScripts\|Money Generating Scripts FREE VB Skins

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)