i have the win32.parite virus.. okay ?.. and .. i used Panda Software Online Active Virus scanner to disinfect it.. tho.. it dosent seem to remove the virus core/origin .. it just disinfects the files its infected.. and so. . causes some of my programs to disfunction (the exe. are unable to be double clicked) // and such games like steam stuff up.. after updating .. steam dosent open.. error comes up .. so i used pqremove .. and that seemed to remove the virus ..( i used the process of turning off system restore.. then scanning with pqremove .. then restarting comp.. then everything works fine ) ... but i stil get that virus blah blah error wen unistalling / installing some apps ... so i later .. i used panda again .. and it stuffed my programs again .. and the win32.parite came back .. seems like panda wakens the virus again.. so i have to use pqremove.. AGAIN .. so yea... im pretty sure the virus inst gone..cuz it keeps coming back.. -___- ..but it says it gone. so im not sure ..

btw.. im waiting on norbies forum to send me the activation detials for my account..once thats done .. ill be using the thing u referred to me .. cheers

Logfile of HijackThis v1.99.1
Scan saved at 12:25:48 PM, on 1/5/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\MessengerPlus! 3\MsgPlus.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Steam\Steam.exe
F:\Program Files\Native Instruments\Traktor DJ Studio 2\TraktorDJStudio2.exe
F:\Program Files\MSN Messenger\msnmsgr.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\FlashGet\flashget.exe
F:\Documents and Settings\Guest `\Local Settings\Temp\HijackThis.exe
F:\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.hello.telpacific.com.au/activation/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

provided by TEL.PACIFIC Pty Ltd
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini:

UserInit=F:\WINDOWS\system32\userinit.exe,C:\WINDO WS\system32\userinit.exe,
O2 - BHO: (no name) - {6dd35e32-f361-4bb8-8f66-517559f165e5} -

F:\WINDOWS\System32\wo.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} -

F:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program

files\google\googletoolbar2.dll
O2 - BHO: (no name) - {d262e70a-7841-4a85-9aa1-8d66aa593c89} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} -

F:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program

files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

F:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "F:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L

ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "F:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "F:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SurfAccuracy] F:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\RunServices: [Microsoft Update] scvhost.exe
O4 - HKCU\..\Run: [STYLEXP] F:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://f:\program

files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://f:\program

files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://f:\program

files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://f:\program

files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - F:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Similar Pages - res://f:\program

files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://f:\program

files\google\GoogleToolbar2.dll/cmtrans.html
O14 - IERESET.INF: START_PAGE_URL=http://www.hello.telpacific.com.au/activation/
O16 - DPF: {0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} (NeffyClient Class) -

http://dist.cdnetworks.co.kr/cdndist/neffy/Neffy.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} -

http://www.tbcode.com/ist/softwares/...06_regular.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) -

http://static.zangocash.com/cab/Seek...bridge-c24.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -

http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -

http://217.73.66.1/minidialler/mddl/ME_AU3/910230__.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

(MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C7B05B62-C8D7-438C-840B-4994DAAA8EEE} -

http://webpdp.gator.com/v3/download/...tdmgainads.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

"F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: SysTray - {6dd35e32-f361-4bb8-8f66-517559f165e5} -

F:\WINDOWS\System32\wo.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - F:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - F:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GEARSecurity - GEAR Software - F:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common

Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner -

C:\WINDOWS\System32\mnmsrvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner -

C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - F:\Program

Files\TGTSoft\StyleXP\StyleXPService.exe

um.. my account on norbies isnt wokring..asin .. i never recived an activation link to my email... its beenover 24hours..can somone do it for me..someone with a norbie acocunt..

I sent Norbie a PM

__________________










A little common sense goes a long way

Later Grandpa

okya..thx

Hijack This is what this thread is about lol ... sorry we cant deciphor those logs...

Bu;t give us $2,000 US & I'll do anything for you. lol hehehhe

NorbiesWorld (click on link)

Whilst you're at it ask him if he has worked out how to solve my problem rather than ignoring it!

yea ..but i cant activate me account on norbie.. got some problems and stuff so yes... grandpa said he was PM'n norbie to get a reply.. so yea.. lols..you ask him yourself .. =P ..i cant even get in the forum

I got into the forum, posted & repeated my requests after he continually refused to answer my quest. In the end I realised I had posted showing my personal name so I asked him to either edit it out or delete the thread. He chose to delete the thread. I call that **** week not bothering to at least try. He flatly refused to try to help
!!!!!!!!!!!!!

haha..losl wells thens that is ****** up .. maybe he wasnt smart enoguht to answer your quest .. ohwells.. 2bad..he better fix my proble mtho .. !