Thursday 6.3.2025 / 11:38
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > .tt1.tmp.vbs, .tt2.tmp.vbs, .tt3.tmp.vbs files not found ------what do i do?
.tt1.tmp.vbs, .tt2.tmp.vbs, .tt3.tmp.vbs files not found ------What do I do?
deemystql
Newbie
2. July 2008 @ 04:48 Link to this message
Dear AfterDawn and Members,
AVG ,and Automatic updates of OPS) do not get connected and thus receive no updates, which wasnt the case prior to this problem.
Hijackthis and post that log here in my next message.
UPDATE: I
Hijackthis , everytime i click on it, it never registers.:(
Advertisement
deemystql
Newbie
2. July 2008 @ 04:58 Link to this message
UPDATE 2:
Hijackthis .
HijackThis v2.0.2
http://www.dell.com
http://www.dell.com
http://127.0.0.1:4664/first_usage&s=BR5AXl7f8sc8-pA54jlKnamBL_4
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
deemystql
Newbie
2. July 2008 @ 06:54 Link to this message
Following is the SUPERAntispyware logfile :
http://www.superantispyware.com
AfterDawn Addict
2. July 2008 @ 07:32 Link to this message
Hi Dee,
Vundofix <HERE!> and VirtumundoBeGone <HERE!> -
Before running these , Please reboot your computer in Safe Mode by doing the following :
tap the F8 key continually;
Enter.
HJT Log so we can see what needs to be done next.
This message has been edited since posting. Last time this message was edited on 2. July 2008 @ 07:35
deemystql
Newbie
2. July 2008 @ 13:38 Link to this message
Hey 2OG,
Vundofix and VirtumundoBeGone and both found nothing.
infected file I think.
AfterDawn Addict
2. July 2008 @ 17:27 Link to this message
Dee,
VundoFix just to be sure..
HijackThis Log and we?ll check it out for anything that remains..
deemystql
Newbie
2. July 2008 @ 21:19 Link to this message
Hey 2OG,
Vundofix and Vundobegone(?), but nothing has changed since and these applications found nothing wrong with the system. I will run a hijakthis and post it here. But like I said earlier, I think the applications arent catching the trojan because the exectutable file that downloaded it into my system has been deleted ( a mistake I made out of freaking out) so I guess when vundofix searches for it it cant find that file? Am I right? or does it not matter whether that file has been deleted or not?
AfterDawn Addict
2. July 2008 @ 21:26 Link to this message
Dee,
HJT Log so ASAP. LOL
deemystql
Newbie
3. July 2008 @ 01:08 Link to this message
Hey 2OG,
HijackThis v2.0.2
http://www.dell.com
http://www.dell.com
http://127.0.0.1:4664/first_usage&s=BR5AXl7f8sc8-pA54jlKnamBL_4
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
AfterDawn Addict
3. July 2008 @ 01:18 Link to this message
Thanks dee,
AfterDawn Addict
3. July 2008 @ 02:17 Link to this message
Hello Dee,
SDFix and save it to your Desktop.
SDFix.exe and it will extract the files to the drive that contains the Windows Directory, typically C:\SDFix
Safe Mode by doing the following :
tap the F8 key continually;
Enter.
RunThis.bat to start the script.
Y to begin the cleanup process.
Finished , press any key to end the script and load your desktop icons.
Report.txt
Reboot to Normal Mode
HijackThis > Do a System Scan Onlyincluding this one , the only program or window you should have open is HijackThis ,Fix Checked.
O4 - HKLM\..\Run: [lphcewkj0ep3e] C:\WINDOWS\system32\lphcewkj0ep3e.exe
Malwarebytes' Anti-Malware to your desktop.
mbam-setup.exe and follow the prompts to install the program.
Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
Perform full scan , then click Scan.
OK, then Show Results to view the results.
Remove Selected.
log-date.txt
HJT Log and reply with the following reports:
Report.txt
log-date.txt
New Hijackthis log
deemystql
Newbie
3. July 2008 @ 04:42 Link to this message
Hey 2OG,
SDFix: Version 1.200
Checking Services :
Name :
Path :
Checking Files :
ADS Check :
Final Check :
Remaining Services :
ram
Remaining Files :
Files with Hidden Attributes :
Finished!
AfterDawn Addict
3. July 2008 @ 04:51 Link to this message
Hey Dee,
INFECTED !
deemystql
Newbie
3. July 2008 @ 07:32 Link to this message
YEAH...I sure was gettin a whoopin'..Ive been up all night
The following is the log from Malware:
Pack 2
deemystql
Newbie
3. July 2008 @ 07:47 Link to this message
Hey 2OG,
HijackThis v2.0.2
http://www.dell.com
http://www.dell.com
http://127.0.0.1:4664/first_usage&s=BR5AXl7f8sc8-pA54jlKnamBL_4
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
AfterDawn Addict
3. July 2008 @ 08:12 Link to this message
Good Morning,
touch up, let?s do this:
ATF Cleaner by Atribune to your desktop.
ATF-Cleaner.exe to run the program.
Main choose: Select All
Empty Selected button.
ATF Cleaner , this is expected but will be back to normal after the first or second boot up
Here or Here to your Desktop.
combofix.exe and follow the prompts.
Combofix log and a HiJackthis Note: Do not mouseclick combofix's window while its running. That may cause it to stall Combofix log and one more HJT Log and I believe we can drive a nail in this one. ; )
deemystql
Newbie
3. July 2008 @ 14:24 Link to this message
Hey 2OG,
Here's the log from combofix: ComboFix 08-07-02.5 - Divz~ 2008-07-03 13:56:15.1 - NTFSx86
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-21 19:27]
Google Desktop Search - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
Gmer , http://www.gmer.net
Pack 2 NTFS
deemystql
Newbie
3. July 2008 @ 14:30 Link to this message
Hello Hello Helloooo!!!
Here's the HJT log after combofix:
HijackThis v2.0.2
http://go.microsoft.com/fwlink/?LinkId=69157
http://go.microsoft.com/fwlink/?LinkId=54896
http://go.microsoft.com/fwlink/?LinkId=54896
http://www.dell.com
http://127.0.0.1:4664/first_usage&s=BR5AXl7f8sc8-pA54jlKnamBL_4
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
AfterDawn Addict
6. July 2008 @ 11:19 Link to this message
Helloooooooooo Dee,
, your log looks CLEAN There are a few things you must do once you are completely clean: 1. Time for some housekeeping
download the OTMoveIt2 by OldTimer
Save it to your desktop.
Run the tool by clicking on the icon.
Cleanup button.
2. Please download ATF Cleaner by Atribune.
ATF-Cleaner.exe to run the program.
Main choose: Select All
Empty Selected button.
Exit on the Main menu to close the program.
Technical Support , double-click the e-mail address located at the bottom of each menu.
3. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.
The easiest and safest way to do this is:
Start > Programs > Accessories > System Tools and click "System Restore ".
Create a Restore Point " on the first screen then click "Next ". Give the R.P. a name then click "Create ". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Start > Run and type: Cleanmgr
OK ".
More Options " Tab.
Clean Up " in the System Restore section to remove all previous restore points except the newly created one.
4. Defragment your Hard Drive
Properties.
Defragment Now.
Defragment.
Here are some tips to reduce the potential for spyware infection in the future: firewall to protect your computer from hackers. We don't recommend the firewall that comes built in to Windows. It doesn't block everything that may try to get in, and the entire firewall is written to the registry. As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions. Two good ones are are ZoneAlarm Free and Sunbelt Kerio Personal Firewall has a "free mode" as well.
ZoneAlarm Make sure you keep your Windows OS current Windows update
I strongly recommend installing the following applications:
Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Malware, Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know Malware sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
So how did I get infected in the first place?
Firefox instead of IE, it?s safer. If you continue to use IE, at least upgrade to IE7, it?s safer than IE6.
emule and utorrent. P2P is a crap shoot at best..LOL
deemystql
Newbie
6. July 2008 @ 21:00 Link to this message
Yes...Thank you for taking the time to write all this, I really really appreciate it 2OG.
WaltFairy
Newbie
14. July 2008 @ 21:39 Link to this message
Dear AfterDawn and Members,
3 .tmp.vbs". I had the same problem with the stupid fake Windows XP 2008 AntiVirus program somehow installing itself on my computer, and also, similar to dee, freaked out when I saw it and immediately deleted "rhcawkj0ep3e.exe" - I hope that that's not going to come back and haunt me. I've since then run my AVG and removed the infection, but have been having problems with this ".tt3.tmp.vbs" file not being found, and my Screensaver and Desktop tabs have been removed from my desktop properties. I followed the RegEdit instrcutions given here , but that seems to do nothing! Help??
AfterDawn Addict
14. July 2008 @ 22:10 Link to this message
Hello WaltFairy, welcome to afterdawn.
That said, All advice given by anyone volunteering here, is taken at own risk.
WaltFairy
Newbie
14. July 2008 @ 22:13 Link to this message
Thank you! I appreciate it!
AfterDawn Addict
14. July 2008 @ 22:22 Link to this message
You?re very welcome, WaltFairy,
First, let?s do a little Pre-Cleaning and Post some Logs so we can see what?s going on?
TrendMicro HijackThis.exe (HJT )
Install button.
C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
HijackThis should open for you.
Close HijackThis and rename it.HijackThis .exeHijackThis .exeRename.
scanner.exe and press Enter.
Right-click on scanner.exe and select Send To > Desktop (create shortcut)
If using Windows Vista, Right-click and Run As Administrator .
Do a system scan and save a log file button
Copy and then paste the entire contents of the log in your post.
Do not ATF Cleaner by Atribune & save it to your desktop. DO NOT use yet. SUPERAntiSpyware Free
SUPERAntiSypware.exe and use the default settings for installation.
Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)
Configuration and Preferences ", click the Preferences... button.
General and Startup " tab, and under Start-up Options , make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
Scanning Control " tab, and under Scanner Options , make sure the following are checked (leave all others unchecked):
Close " button to leave the control center screen and exit the program.
Do not run a scan just yet. Safe Mode " using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".
ATF-Cleaner.exe to run the program.
Main "Select Files to Delete " choose: Select All.
Empty Selected button.
Firefox browser click Firefox at the top and choose: Select All
Empty Selected button.
No at the prompt.
Opera browser click Opera Select All
Empty Selected button.
No at the prompt.
Exit on the Main menu to close the program.
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".
Scan with SUPERAntiSpyware as follows:
Scan for Harmful Software " click Scan your computer.
C:\Fixed Drive.
Complete Scan ", choose Perform Complete Scan Next ".
OK ".
Next ".
Quarantine and Removal is Complete OK " and then click the "Finish " button to return to the main menu.
Yes " and reboot normally.
Click Preferences , then click the Statistics/Logs tab.
SUPERAntiSpyware Scan Log .
View log . A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Close to exit the program.
Reboot to Normal Mode
Make a HijackThis Log
If using Windows Vista, Right-click and Run As Administrator .
Do a system scan and save a log file button
Copy and then paste the entire contents of the log in your post.
Do not Make an uninstall list using HijackThis
HijackThis
Config button
Misc Tools button
Open Uninstall Manager button.
Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in your next reply.
Please post the HijackThis log, SUPERAntiSpyware Log and Uninstall list in your next reply.
This message has been edited since posting. Last time this message was edited on 14. July 2008 @ 23:11
Advertisement
WaltFairy
Newbie
14. July 2008 @ 22:58 Link to this message
Sorry if this is a ridiculous question, but you told me not to guess with things, so I certainly don't want to take any risks. I began following your instructions step by step and upon getting to the point where I rename HJT to "scanner.exe[b]Enter" I'm not sure if that was literally what you wanted, or if you just meant "scanner.exe" and there was just a typo in the post. Sorry for the confusion, but again, I already appreciate your help in this!
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > .tt1.tmp.vbs, .tt2.tmp.vbs, .tt3.tmp.vbs files not found ------what do i do?
