| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 77921 | 2007-03-27 20:49:00 | HELP! im having trouble! | Ragnaro (12044) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 536339 | 2007-03-27 20:49:00 | Im trying to delete ActiveX (recently tryed to watch sumthing with the codec) ((or so it says it is)) and i found out that theres a file or sumthing called pmsnrr.exe and i cannot seem to delete it. Can somebody help? ive tried using hijackthis but nothing pops up as PMSNRR.exe |
Ragnaro (12044) | ||
| 536340 | 2007-03-27 21:16:00 | Its a Trojan. Post your Hijackthis log here. And download and run Spybot and Adaware SE Personal as well. |
pctek (84) | ||
| 536341 | 2007-03-27 22:43:00 | here's my log Logfile of HijackThis v1.99.1 Scan saved at 5:43:24 PM, on 27/03/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Video Access ActiveX Object\pmsnrr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\D-Tools\daemon.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Rogers\SelfHealing\rogersagent.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\winhlp32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onrpg.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ca.acer.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = www.aceradvantage.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [RogersAgent] c:\Program Files\Rogers\SelfHealing\rogersagent.exe O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?5ca4cb235e4c46f19dfe1796756d9103 O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?5ca4cb235e4c46f19dfe1796756d9103 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - www.gamengame.com O17 - HKLM\System\CCS\Services\Tcpip\..\{234541D1-F016-472C-B46D-74B2BB9378D5}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{41F8AE0F-9EF3-43AF-AFF9-020A2AC20E96}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{93D3A2DE-5D85-407B-8CAC-4B745110C8FE}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{B07E30B0-7C09-4066-918E-CB678056341A}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{C3D3E4B9-FCFB-44F5-B83A-C73E12AF246C}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe now what? |
Ragnaro (12044) | ||
| 536342 | 2007-03-27 22:51:00 | Run HJT again tick these entries and tck fix checked. Close browser/s. C:\Program Files\Video Access ActiveX Object\pmsnrr.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background - Run this manually. O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background And get Trojan remover in my sig below. Install it, run it then click on scan. Then select thne 3rd to 7th option under the utilities menu. And install a firewall. Where are you?? in NZ or other, if you're in NZ, tick these entries as well. O17 - HKLM\System\CCS\Services\Tcpip\..\{234541D1-F016-472C-B46D-74B2BB9378D5}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{41F8AE0F-9EF3-43AF-AFF9-020A2AC20E96}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{93D3A2DE-5D85-407B-8CAC-4B745110C8FE}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{B07E30B0-7C09-4066-918E-CB678056341A}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{C3D3E4B9-FCFB-44F5-B83A-C73E12AF246C}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 |
Speedy Gonzales (78) | ||
| 536343 | 2007-03-27 23:10:00 | ok you're helping alot, my comp is faster a bit, but right now the troja thing is updating | Ragnaro (12044) | ||
| 536344 | 2007-03-27 23:15:00 | Did u get trojan remover? | Speedy Gonzales (78) | ||
| 536345 | 2007-03-27 23:18:00 | yes, i got it | Ragnaro (12044) | ||
| 536346 | 2007-03-27 23:20:00 | YAY! everything is fixed, ty both but just to be safe, here's a HJT log Logfile of HijackThis v1.99.1 Scan saved at 6:22:47 PM, on 27/03/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\D-Tools\daemon.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Rogers\SelfHealing\rogersagent.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onrpg.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ca.acer.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = www.aceradvantage.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU\..\Run: [RogersAgent] c:\Program Files\Rogers\SelfHealing\rogersagent.exe O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?5ca4cb235e4c46f19dfe1796756d9103 O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?5ca4cb235e4c46f19dfe1796756d9103 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - www.gamengame.com O17 - HKLM\System\CCS\Services\Tcpip\..\{234541D1-F016-472C-B46D-74B2BB9378D5}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{41F8AE0F-9EF3-43AF-AFF9-020A2AC20E96}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{93D3A2DE-5D85-407B-8CAC-4B745110C8FE}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{B07E30B0-7C09-4066-918E-CB678056341A}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{C3D3E4B9-FCFB-44F5-B83A-C73E12AF246C}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe |
Ragnaro (12044) | ||
| 536347 | 2007-03-27 23:26:00 | That log looks better. Where are you?? What country?? If you're in NZ, tick these entries too O17 - HKLM\System\CCS\Services\Tcpip\..\{234541D1-F016-472C-B46D-74B2BB9378D5}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{41F8AE0F-9EF3-43AF-AFF9-020A2AC20E96}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{93D3A2DE-5D85-407B-8CAC-4B745110C8FE}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{B07E30B0-7C09-4066-918E-CB678056341A}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\..\{C3D3E4B9-FCFB-44F5-B83A-C73E12AF246C}: NameServer = 85.255.115.18,85.255.112.61 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.18 85.255.112.61 And install a firewall. |
Speedy Gonzales (78) | ||
| 1 | |||||