What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer Problem

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Thank you in advance for your help. I have read some of the solved Hijack files, and so have downloaded, updated, configured, and ran Spybot S&D, Ad-Aware and Hijack, rebooting after the first two.

My problem is that as soon as I turn on my computer, it opens my connection manager (AT&T) and puts me online. If I close the connection manager, it just starts again after a few seconds.

I had my hard drive crash last week, bought a new one, installed it, and loaded Windows XP. I loaded the drivers that came with the computer and then loaded the AT&T software (this I downloaded using a friend's computer and used a memory stick to load it onto my computer.) I went online and set up the connection manager with my account name and password. Everything seemed to be working fine. The next day, I was helping my daughter with prefixes and suffixes by doing some google searches. We found what we needed and disconnected. And, that's when the trouble started; the connection program opened up a few seconds later and dialed to connect…

I did take my computer to my friend's house to use his high-speed connection to download the Windows XP updates. I think something like 18 updates were downloaded and installed. When Service Pack 2 tried to download, things got really, really slow. It did not get past 34%, and the downloading updates system tray icon sometimes is there and sometimes not. Back at my house, the downloading updates icon still says 34% after four days (I have been reading in this forum to learn what to do).

Well, thanks for reading all that! Here is my Hijack file:


Logfile of HijackThis v1.98.2
Scan saved at 11:06:35 PM, on 11/12/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\lsess.exe
C:\WINDOWS\System32\winsnd32.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\winupdate.exe
C:\WINDOWS\System32\updates32.exe
C:\WINDOWS\System32\vpc32.exe
C:\WINDOWS\system32\tbctray.exe
C:\WINDOWS\System32\rasautou.exe
C:\PROGRA~1\AT&T\WnClient\Programs\WNConnect.exe
C:\PROGRA~1\AT&T\WnClient\Programs\WNCSMS~1.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.att.net/ie4/search/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Windows Updates] winupdate.exe
O4 - HKLM\..\Run: [Sysino] lsess.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] winsnd32.exe
O4 - HKLM\..\Run: [psYko] updates32.exe
O4 - HKLM\..\Run: [Microsoft Update] vpc32.exe
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKLM\..\RunServices: [Windows Updates] winupdate.exe
O4 - HKLM\..\RunServices: [Sysino] lsess.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] winsnd32.exe
O4 - HKLM\..\RunServices: [psYko] updates32.exe
O4 - HKLM\..\RunServices: [Microsoft Update] vpc32.exe
O4 - HKLM\..\RunOnce: [Sysino] lsess.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] winsnd32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Sysino] lsess.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] winsnd32.exe
O4 - HKCU\..\Run: [Microsoft Update] vpc32.exe
O4 - HKCU\..\RunOnce: [Sysino] lsess.exe
O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] winsnd32.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100042742388

Thank you for any help!

Rob (maytrex)
Post #2
You picked up a bunch of viruses. Lets try to remove them manually.

Make sure hidden files are showing tutorial here >>> http://www.microsoft.com/windowsxp/using/h…iddenfiles.mspx

Please boot to safe mode (tap f8 while bios loads) tehn scan with hijackthis and put a check beside these lines and choose FIX.

O4 - HKLM\..\Run: [Windows Updates] winupdate.exe
O4 - HKLM\..\Run: [Sysino] lsess.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] winsnd32.exe
O4 - HKLM\..\Run: [psYko] updates32.exe
O4 - HKLM\..\Run: [Microsoft Update] vpc32.exe
O4 - HKLM\..\RunServices: [Windows Updates] winupdate.exe
O4 - HKLM\..\RunServices: [Sysino] lsess.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] winsnd32.exe
O4 - HKLM\..\RunServices: [psYko] updates32.exe
O4 - HKLM\..\RunServices: [Microsoft Update] vpc32.exe
O4 - HKLM\..\RunOnce: [Sysino] lsess.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] winsnd32.exe
O4 - HKCU\..\Run: [Sysino] lsess.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] winsnd32.exe
O4 - HKCU\..\Run: [Microsoft Update] vpc32.exe
O4 - HKCU\..\RunOnce: [Sysino] lsess.exe
O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] winsnd32.exe


Then while still in safe mode delete these files. Please be careful and delete the exact file name as shown as they are closely named to legitimate files.

winupdate.exe<< lsess.exe<< winsnd32.exe<< updates32.exe<< vpc32.exe<<
Make sure that you delete all instances of those files.

Then reboot and post a new log please.
Post #3
Thank you Siggyx!

I followed the directions in your post. Here is the new log:

Logfile of HijackThis v1.98.2
Scan saved at 1:01:23 AM, on 11/13/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\tbctray.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.att.net/ie4/search/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1100042742388

Thank you again,

Rob (maytrex)
Post #4 last edited
Looks Good :D Better get all the updates for XP & Internet exploere now. After you have done that below are some ways to stay clean.

GET THE UPDATES FIRST ;)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.
Post #5
BTW: The computer did not try to connect automatically to the internet this time, and as I am online now, the downloading updates icon in the system tray has moved to 35%! Promising… Maytrex
Post #6
Two days and running clean. I have added Norton Anti-Virus and Norton Firewall. This has definately been a learning experience! Thank you again, Maytrex
Post #7
Glad we could help.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for e-mail)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI