User User name Password  
   
Thursday 6.3.2025 / 13:48
Search AfterDawn Forums:        In English   Suomeksi   På svenska
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > computer virus (trojan gaslide b) xp windows antivirus 2008
Show topics
 
Forums
Forums
Computer Virus (trojan gaslide b) Xp windows antivirus 2008
  Jump to:
 
Posted Message
dymx
Suspended due to non-functional email address
_
23. June 2008 @ 11:57 _ Link to this message    Send private message to this user   
I was downloading a file and Xp windows 2008 installed itself on my pc and I uninstalled it but it keeps coming back. I ran spydoctore it deleted (trojan gaslide b) Xp windows 2008 but when I restart my pc it comes back. I've also tried zonealarm, ad aware, trend micro none work. My desktop background is blue and contains a message saying "warning, spyware is detected on your computer." I really need help because my computer is really slow now.

maggie
Advertisement
_
__
dymx
Suspended due to non-functional email address
_
23. June 2008 @ 12:00 _ Link to this message    Send private message to this user   
here's a hijackthis logfile
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:58:31 AM, on 6/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\lphc38pj0ee5j.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [lphc38pj0ee5j] C:\WINDOWS\system32\lphc38pj0ee5j.exe
O4 - HKLM\..\Run: [SMrhc78pj0ee5j] C:\Program Files\rhc78pj0ee5j\rhc78pj0ee5j.exe
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4186 bytes


maggie
ddp
Moderator
_
23. June 2008 @ 13:41 _ Link to this message    Send private message to this user   
moved to correct forum as not an all others topics issue. look in your msconfig\startup as most likely there besides maybe in programs\startup.
AfterDawn Addict
_
23. June 2008 @ 14:35 _ Link to this message    Send private message to this user   
Hi dymx,

Download and run => remove-windows-antivirus-2008

Post back and let us know if it worked and if you have any other problems.

2OG



There are three kinds of men: The ones that learn by reading; The few who learn by observation;
The rest of them have to pee on the electric fence and find out for themselves...
dymx
Suspended due to non-functional email address
_
23. June 2008 @ 17:38 _ Link to this message    Send private message to this user   
it removes it but then when i restart my computer it comes back

maggie
ddp
Moderator
_
23. June 2008 @ 18:43 _ Link to this message    Send private message to this user   
did you check in msconfig\startup? when you click start, you'll see the program & lefthand side, click on it & uninstall it. have 2 customers with that program & that is how i got rid of it by uninstalling it & removing from msconfig\startup. also look in your programs folder thru windows explorer & delete it there.
Senior Member
_
24. June 2008 @ 03:01 _ Link to this message    Send private message to this user   
Quote:
it removes it but then when i restart my computer it comes back

Did you do 2oldgeek's instructions in safe mode?

You say that it is Xp Windows 2008? From your symptons and your hijackthis log, it would say that it sounds a whole lot more like Malware Protector 2008. Try the instructions and websites on this thread: http://forums.afterdawn.com/thread_view.cfm/675505

Also, you can fix these entries:

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O4 - HKLM\..\Run: [lphc38pj0ee5j] C:\WINDOWS\system32\lphc38pj0ee5j.exe
O4 - HKLM\..\Run: [SMrhc78pj0ee5j] C:\Program Files\rhc78pj0ee5j\rhc78pj0ee5j.exe

Best Regards :D
VSantos
Newbie
_
16. July 2008 @ 04:58 _ Link to this message    Send private message to this user   
Hello :)
I whanted to know if you guys could help me on this one pls.

I have a trojan on my pc that's called the same way but, the effects are different. It made:

- Removed my C drive from the system, including shortcuts and everything else from it. Luckly i have the Windows installed on the E drive.

- Added 3 new icons.

- I can't go into google, it will not let me.

- It replaced my windows clock with words that say "virus found" or something like that.

- It somehow disabled the windows genuine tool because it now says my OS isn't genuine.

- It removed most of my entries on the start menu, the ones on the right side ( my computer, control panel and so on ) are gone!

- It keeps making a pop up saying that i have a virus on the machine and if i whant to visit the site to get the tool to remove it.

My antivirus it the AVG 8 free edition ( can't afford one :( ) it will not remove it, not even in safe mode. Can someone pls help me? The data on my hard drives is too important for me to format the machine.
ddp
Moderator
_
16. July 2008 @ 14:00 _ Link to this message    Send private message to this user   
do a system restore to before the problem started as that is what i had to do with a customer's laptop this morning. ran spybot s&d & found 3 spywares related to that problem & got rid of them.
http://www.majorgeeks.com/download2471.html
Advertisement
_
__
 
_
VSantos
Newbie
_
18. July 2008 @ 04:40 _ Link to this message    Send private message to this user   
Hi ddp, tks for the reply :)

I've tried that without success, the trojan had already done too much damage, and brought some smaller virus with him. I ran spy bot ( gotta love that program, free and effective ), had a look for some way to manualy delete it but, it was too late. It did give me some time to backup some of my files, almost all of them actualy, but i had to format the drives... The virus the trojan applyed on the pc damaged the OS too much.

Tks for the help just the same, and congrats for this forum, it's always good to know it's a place to go and ask for help with these things. Very well done guys :D
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > computer virus (trojan gaslide b) xp windows antivirus 2008
 

Digital video: AfterDawn.com | AfterDawn Forums
Music: MP3Lizard.com
Gaming: Blasteroids.com | Blasteroids Forums | Compare game prices
Software: Software downloads
Blogs: User profile pages
RSS feeds: AfterDawn.com News | Software updates | AfterDawn Forums
International: AfterDawn in Finnish | AfterDawn in Swedish | AfterDawn in Norwegian | download.fi
Navigate: Search | Site map
About us: About AfterDawn Ltd | Advertise on our sites | Rules, Restrictions, Legal disclaimer & Privacy policy
Contact us: Send feedback | Contact our media sales team
 
  © 1999-2025 by AfterDawn Ltd.

  IDG TechNetwork