What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help Bad

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I'm having a little trouble with my computer, it's infected and I can't seem to be able to clean it out. I have installed and run Ad-Aware SE, SpyBot Search & Destroy. I also have CWShredder, HijackThis, but they do not run, also I can't access regedit, msconfig, process manager. I can't even go into the HijackThis open topic on this forum. IS it too late will I have to reload the OS (something I really don't want to do), or can it be saved?? Any help or comments will be appreciated. Thanks
Post #2
try renaming hijackthis.exe to something else - anything will do - say NOTHJT.exe Try running that and post the log as a reply here in this board.
Post #4
Merijn (The author of Hijackthis) has posted this:-

Small update: I've been seeing more and more cases of infections by trojans that kill any antivirus or antispyware programs you try to use and remove them. For such cases, I created a standalone version of the 'Itty Bitty Process Manager' inside HijackThis. It should be a bit harder for trojans to detect, since it has no window caption. If they do start targeting it by filename, rename the executable before running it and you should be good to go.

Download Itty Bitty Process Manager (IBProcMan.zip)(direct download) http://www.merijn.org/files/ibprocman.zip


Try running that - it will provide a 'taskmanager' like process in which you can stop running processes. Don't stop any yet, just list all that it has so I can check them and give advice.
Post #5
Here is the list of processes… Process list saved on 7:01:51 AM, on 1/7/2005 Platform: WinNT 5.01.2600 SP2 [full path to filename] [file version] [company name] C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation C:\WINDOWS\System32\wininit.exe C:\WINDOWS\System32\igfxtray.exe 3.0.0.1757 Intel Corporation C:\Program Files\Apoint\Apoint.exe 5.5.5.109 Alps Electric Co., Ltd. C:\Program Files\Sony\HotKey Utility\HKserv.exe 2.1.0.8210 Sony Corporation C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe 9.0.0.159 Musicmatch, Inc. D:\Program Files\AVWINNT\AVWUPSRV.EXE 6.29.0.0 H+BEDV Datentechnik GmbH, Germany C:\WINDOWS\System32\hkcmd.exe 3.0.0.1757 Intel Corporation C:\Program Files\Yahoo!\browser\ybrwicon.exe 2003.7.11.1 Yahoo!, Inc. C:\WINDOWS\system32\svcxnw32.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe 5.0.0.0 Hewlett-Packard Company C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe 1.0.0.1 Hewlett-Packard C:\WINDOWS\system32\msnmsgs.exe 4.7.0.3000 Microsoft Corporation C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe 1.0.0.1 Musicmatch Inc. C:\WINDOWS\System32\dllcachev2.exe C:\WINDOWS\System32\mnmsrvc.exe 5.1.2600.2180 Microsoft Corporation C:\PROGRA~1\YAHOO!\browser\ycommon.exe 2003.9.3.1 Yahoo!, Inc. C:\Program Files\PowerPanel\Program\PcfMgr.exe 4.1.0.4 Phoenix Technologies Ltd. C:\Program Files\Sony\VAIO Action Setup\VAServ.exe 1.4.0.8230 Sony Corporation C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe 8.0.0.0 Lucent Technologies, VitalSoft division D:\Program Files\Timex\Data Link USB\DataLinkLauncher.exe 1.0.0.13 Timex Corporation C:\Program Files\Apoint\Apntex.exe 5.0.1.13 Alps Electric Co., Ltd. D:\Program Files\Aluria Software\ASE\ASE Scheduler.exe 3.0.0.29 Aluria Software, LLC c:\progra~1\Support.com\client\bin\tgcmd.exe 5.0.307.0 Support.com, Inc. C:\WINDOWS\system32\rundll32.exe 5.1.2600.2180 Microsoft Corporation C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation D:\Program Files\AVWINNT\AVGUARD.EXE 6.29.0.3 H+BEDV Datentechnik GmbH D:\Program Files\AVWINNT\AVGNT.EXE 6.28.0.2 H+BEDV Datentechnik GmbH C:\Program Files\Yahoo!\browser\ybrowser.exe 2003.10.22.2 Yahoo!, Inc. C:\Program Files\Yahoo!\Messenger\YPAGER.EXE 6.0.0.1750 Yahoo! Inc. C:\WINDOWS\notepad.exe 5.1.2600.2180 Microsoft Corporation D:\Larry\Itty Bitty\ibprocman\IBProcMan.exe 1.1.0.0 Soeperman Enterprises Ltd.
Post #6
OK

This file I DON'T have on my winXP system and it looks odd too.
C:\WINDOWS\system32\svcxnw32.exe

Can you zip(compress) a copy and email to me at Click here

Then stop that process with that new Merijns program, then try hijackthis to see if you can get a log for me. Post as a reply here please.
Post #8
Here is the HijackThis Log…..


Logfile of HijackThis v1.99.0
Scan saved at 2:12:21 PM, on 1/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
D:\Program Files\AVWINNT\AVWUPSRV.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\msnmsgs.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe
D:\Program Files\Timex\Data Link USB\DataLinkLauncher.exe
C:\Program Files\Apoint\Apntex.exe
D:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\AVWINNT\AVGUARD.EXE
D:\Program Files\AVWINNT\AVGNT.EXE
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\Program Files\Yahoo!\Messenger\YPAGER.EXE
C:\Program Files\goodsol2k\goodsol2k.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Larry\Merijn\24\anything\anything.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe,wininit.exe -shell
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O1 - Hosts: 127.121.72.48 www.symantec.com
O1 - Hosts: 127.28.71.104 securityresponse.symantec.com
O1 - Hosts: 127.133.34.113 www.mcafee.com
O1 - Hosts: 127.172.62.42 mcafee.com
O1 - Hosts: 127.225.186.83 us.mcafee.com
O1 - Hosts: 127.173.169.9 www.sophos.com
O1 - Hosts: 127.125.173.99 sophos.com
O1 - Hosts: 127.125.254.54 www.viruslist.com
O1 - Hosts: 127.220.139.107 viruslist.com
O1 - Hosts: 127.60.160.135 f-secure.com
O1 - Hosts: 127.246.240.34 www.f-secure.com
O1 - Hosts: 127.45.45.195 kaspersky.com
O1 - Hosts: 127.27.92.96 www.avp.com
O1 - Hosts: 127.23.137.118 www.kaspersky.com
O1 - Hosts: 127.184.120.142 avp.com
O1 - Hosts: 127.75.172.43 www.networkassociates.com
O1 - Hosts: 127.107.141.247 networkassociates.com
O1 - Hosts: 127.193.116.163 www.ca.com
O1 - Hosts: 127.39.74.11 ca.com
O1 - Hosts: 127.206.228.241 my-etrust.com
O1 - Hosts: 127.97.60.181 www.my-etrust.com
O1 - Hosts: 127.80.149.119 secure.nai.com
O1 - Hosts: 127.113.123.77 nai.com
O1 - Hosts: 127.117.77.59 www.nai.com
O1 - Hosts: 127.174.126.207 trendmicro.com
O1 - Hosts: 127.99.240.20 www.trendmicro.com
O1 - Hosts: 127.248.16.97 housecall.trendmicro.com
O1 - Hosts: 127.99.68.145 www.pandasoftware.com
O1 - Hosts: 127.164.222.80 www.bitdefender.com
O1 - Hosts: 127.100.73.181 www.ravantivirus.com
O1 - Hosts: 127.2.24.255 www3.ca.com
O1 - Hosts: 127.245.14.215 v4.windowsupdate.microsoft.com
O1 - Hosts: 127.2.22.139 v5.windowsupdate.microsoft.com
O1 - Hosts: 127.255.74.70 v5windowsupdate.microsoft.nsatc.net
O1 - Hosts: 127.158.6.15 windowsupdate.microsoft.com
O1 - Hosts: 127.230.39.136 www.windowsupdate.com
O1 - Hosts: 127.8.11.195 windowsupdate.com
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\2.bin\S4BAR.DLL (file missing)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [IPConfig] svcxnw32.exe
O4 - HKLM\..\Run: [Microsoft Winsock Wrapper] C:\WINDOWS\system32\ws2_32s.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Msn Messenger] msnmsgs.exe
O4 - HKLM\..\Run: [llsass] llsass
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [mswnvmx32] explorer
O4 - HKLM\..\Run: [DllCacherv2] C:\WINDOWS\System32\dllcachev2.exe
O4 - HKLM\..\Run: [CheckDisk16] wininit.exe -services
O4 - HKLM\..\Run: [AVGCtrl] D:\Program Files\AVWINNT\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [llsass] llsass
O4 - HKLM\..\RunServices: [CheckDisk16] wininit.exe -services
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe" msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [uoltray] D:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [IPConfig] svcxnw32.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [CheckDisk16] wininit.exe -drivers
O4 - HKCU\..\Run: [Trpw] C:\WINDOWS\System32\?hkntfs.exe
O4 - Startup: ASE Scheduler.lnk = D:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Almanac.lnk = C:\ALMANAC\ALMANC32.EXE
O4 - Global Startup: MyVitalAgent.lnk = C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe
O4 - Global Startup: Timex Data Link USB Launcher.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - http://esupport.sony.com/support/pops/mdldetect/VaioInfo.CAB
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {FF054BED-D972-4215-897E-726C3488DDBB} (sonyctl.sonycm) - http://supportcentral4.sel.sony.com/sdccom…oad/sonyctl.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{75CD9E83-D683-448B-807B-91D54B23F621}: NameServer = 24.2.68.33,24.2.68.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{C87FD5EF-AFCB-45AD-AD80-E8C61B021B47}: NameServer = 24.2.68.33,24.2.68.34
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - D:\Program Files\AVWINNT\AVGUARD.EXE
O23 - Service: Aluria Spyware Eliminator Service - Unknown - D:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVWINNT\AVWUPSRV.EXE
O23 - Service: Sony SPTI Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #9
Hi there,

I am recommending the removal of aluria software as they are now in league with an advertising company and I believe that because of that thier software will no longer target that known brand of advertising junk.

Please set your system to show all files; see here for how to do this if you're unsure.

The following are mandatory fixes:
Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes:

C:\WINDOWS\system32\msnmsgs.exe

The following is a recommended fixe:
D:\Program Files\Aluria Software\ASE\ASE Scheduler.exe

Exit the Task Manager when finished

Close all programs down, leaving only HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - URLSearchHook: (no name) - _{37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe,wininit.exe -shell
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O1 - Hosts: 127.121.72.48 www.symantec.com
O1 - Hosts: 127.28.71.104 securityresponse.symantec.com
O1 - Hosts: 127.133.34.113 www.mcafee.com
O1 - Hosts: 127.172.62.42 mcafee.com
O1 - Hosts: 127.225.186.83 us.mcafee.com
O1 - Hosts: 127.173.169.9 www.sophos.com
O1 - Hosts: 127.125.173.99 sophos.com
O1 - Hosts: 127.125.254.54 www.viruslist.com
O1 - Hosts: 127.220.139.107 viruslist.com
O1 - Hosts: 127.60.160.135 f-secure.com
O1 - Hosts: 127.246.240.34 www.f-secure.com
O1 - Hosts: 127.45.45.195 kaspersky.com
O1 - Hosts: 127.27.92.96 www.avp.com
O1 - Hosts: 127.23.137.118 www.kaspersky.com
O1 - Hosts: 127.184.120.142 avp.com
O1 - Hosts: 127.75.172.43 www.networkassociates.com
O1 - Hosts: 127.107.141.247 networkassociates.com
O1 - Hosts: 127.193.116.163 www.ca.com
O1 - Hosts: 127.39.74.11 ca.com
O1 - Hosts: 127.206.228.241 my-etrust.com
O1 - Hosts: 127.97.60.181 www.my-etrust.com
O1 - Hosts: 127.80.149.119 secure.nai.com
O1 - Hosts: 127.113.123.77 nai.com
O1 - Hosts: 127.117.77.59 www.nai.com
O1 - Hosts: 127.174.126.207 trendmicro.com
O1 - Hosts: 127.99.240.20 www.trendmicro.com
O1 - Hosts: 127.248.16.97 housecall.trendmicro.com
O1 - Hosts: 127.99.68.145 www.pandasoftware.com
O1 - Hosts: 127.164.222.80 www.bitdefender.com
O1 - Hosts: 127.100.73.181 www.ravantivirus.com
O1 - Hosts: 127.2.24.255 www3.ca.com
O1 - Hosts: 127.245.14.215 v4.windowsupdate.microsoft.com
O1 - Hosts: 127.2.22.139 v5.windowsupdate.microsoft.com
O1 - Hosts: 127.255.74.70 v5windowsupdate.microsoft.nsatc.net
O1 - Hosts: 127.158.6.15 windowsupdate.microsoft.com
O1 - Hosts: 127.230.39.136 www.windowsupdate.com
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\2.bin\S4BAR.DLL (file missing)
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [IPConfig] svcxnw32.exe
O4 - HKLM\..\Run: [Microsoft Winsock Wrapper] C:\WINDOWS\system32\ws2_32s.exe
O4 - HKLM\..\Run: [Msn Messenger] msnmsgs.exe
O4 - HKLM\..\Run: [llsass] llsass
O4 - HKLM\..\Run: [mswnvmx32] explorer
O4 - HKLM\..\Run: [DllCacherv2] C:\WINDOWS\System32\dllcachev2.exe
O4 - HKLM\..\Run: [CheckDisk16] wininit.exe -services
O4 - HKLM\..\RunServices: [llsass] llsass
O4 - HKLM\..\RunServices: [CheckDisk16] wininit.exe -services
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe" msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [IPConfig] svcxnw32.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [CheckDisk16] wininit.exe -drivers
O4 - HKCU\..\Run: [Trpw] C:\WINDOWS\System32\?hkntfs.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?

Recommended fixes :-
O4 - Startup: ASE Scheduler.lnk = D:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
O23 - Service: Aluria Spyware Eliminator Service - Unknown - D:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe

Click on Fix Checked and exit HijackThis.

Reboot into Safe Mode: see here if you don't know how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:

C:\WINDOWS\system32\svcxnw32.exe
C:\WINDOWS\system32\ws2_32s.exe
C:\WINDOWS\system32\msnmsgs.exe
llsass (don't delete this one yet - but post back with all the folders that you can find a file of this name in.)
C:\WINDOWS\System32\dllcachev2.exe
C:\WINDOWS\System32\wininit.exe
C:\Program Files\AWS\WeatherBug\Weather.exe 1
C:\WINDOWS\System32\?hkntfs.exe

Recommeded (use add/remove programs):-
O4 - Startup: ASE Scheduler.lnk = D:\Program Files\Aluria Software\ASE\ASE Scheduler.exe

Exit Explorer, and reboot as normal afterwards.

Post back a fresh HijackThis log and we'll take another look.
Post #10
Hi,
Well.. I recieved three errors in Hijack this saying that the administrator disabled editing in regedit. Could not locate c:\Program Files\AWS\WeatherBug\weather.exe 1, but I removed WeatherBug from the computer. Also removed Aluria Software.

I could not locate c:\WINDOWS\System32\?hkntfs.exe. And While in safe mode did a search for llsass it said file not found..

Here is a new HijackThis log…

Logfile of HijackThis v1.99.0
Scan saved at 4:42:08 PM, on 1/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
D:\Program Files\AVWINNT\AVGNT.EXE
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe
D:\Program Files\Timex\Data Link USB\DataLinkLauncher.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
D:\Program Files\AVWINNT\AVGUARD.EXE
C:\Program Files\Apoint\Apntex.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
D:\Program Files\AVWINNT\AVWUPSRV.EXE
C:\WINDOWS\System32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
D:\Larry\Merijn\24\anything\anything.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 127.8.11.195 windowsupdate.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AVGCtrl] D:\Program Files\AVWINNT\AVGNT.EXE /min
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe" msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [uoltray] D:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Almanac.lnk = C:\ALMANAC\ALMANC32.EXE
O4 - Global Startup: MyVitalAgent.lnk = C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe
O4 - Global Startup: Timex Data Link USB Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - http://esupport.sony.com/support/pops/mdldetect/VaioInfo.CAB
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {FF054BED-D972-4215-897E-726C3488DDBB} (sonyctl.sonycm) - http://supportcentral4.sel.sony.com/sdccom…oad/sonyctl.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{75CD9E83-D683-448B-807B-91D54B23F621}: NameServer = 24.2.68.33,24.2.68.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{C87FD5EF-AFCB-45AD-AD80-E8C61B021B47}: NameServer = 24.2.68.33,24.2.68.34
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - D:\Program Files\AVWINNT\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVWINNT\AVWUPSRV.EXE
O23 - Service: Sony SPTI Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #11
The only bad line now

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

fix that in hijackthis - as you did last time - ensure that all other windows are closed - including this one.

How is everything - I need some feed back as to how it 'feels' from your end.

You might like to visit one of two online Anti-virus scanners and install some 'safety' programs too now. Follow the link below in my signature and visit my article 'computer safety online' which gives some recommendations for you. It will also contain links to online AV scanners for you to choose from.
Post #12
Hi Chris,
Sorry it took so long..
Everything seems to be working fine (Thank You, Thank You, Thank You). :lol: I did another search for Ilsass(*sass*) and it came up with 5 directories all under Windows, I saved a screen shot of the search results if you need to see it.
Again I thank you for all your help….

Here is the lastest HijackThis log:

Logfile of HijackThis v1.99.0
Scan saved at 7:21:31 PM, on 1/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
D:\Program Files\AVWINNT\AVGNT.EXE
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe
D:\Program Files\Timex\Data Link USB\DataLinkLauncher.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
D:\Program Files\AVWINNT\AVGUARD.EXE
D:\Program Files\AVWINNT\AVWUPSRV.EXE
C:\WINDOWS\System32\mnmsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Messenger\YPAGER.EXE
D:\Larry\Merijn\HijackThis\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 127.8.11.195 windowsupdate.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0

\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-

us\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0

\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AVGCtrl] D:\Program Files\AVWINNT\AVGNT.EXE /min
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe"

msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [uoltray] D:\Program Files\NetZero\exec.exe regrun
O4 - Global Startup: PowerPanel.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O4 - Global Startup: Almanac.lnk = C:\ALMANAC\ALMANC32.EXE
O4 - Global Startup: MyVitalAgent.lnk = C:\Program Files\INS\VitalAgent\Program\VtlAgent.exe
O4 - Global Startup: Timex Data Link USB Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!

\common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!

\Messenger\yhexbmes.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) -

http://esupport.sony.com/support/pops/mdldetect/VaioInfo.CAB
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {FF054BED-D972-4215-897E-726C3488DDBB} (sonyctl.sonycm) -

http://supportcentral4.sel.sony.com/sdccom…oad/sonyctl.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{75CD9E83-D683-448B-807B-91D54B23F621}: NameServer = 24.2.68.33,24.2.68.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{C87FD5EF-AFCB-45AD-AD80-E8C61B021B47}: NameServer = 24.2.68.33,24.2.68.34
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - D:\Program Files\AVWINNT\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVWINNT\AVWUPSRV.EXE
O23 - Service: Sony SPTI Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #13
Looks like I missed a line last time. Needs fixing or you will not be able to get your windows updates.

O1 - Hosts: 127.8.11.195 windowsupdate.com

Unless the file name is exactly the same as llsass it would not be safe to remove. This is a known malware so your AV (or an online AV scan) would find and remove if still in your system. I would not worry about it - it is not active now.

======================

This is my normal post for when you are clear - which you now are - or seem to be. Please advise of any problems you still have :-

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
    You can find instructions on how to enable and re enable system restore here:
    Managing Windows Millennium System Restore
    or
    Windows XP System Restore Guide
    re-enable system restore with instructions from tutorial above
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialise and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
    Computer Safety On line - Anti-Virus
  • Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
    Computer Safety On line - Software Firewalls
  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
    This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
    Instructions for - Spybot S & D and Ad-aware
  • Install Ad-Aware - Install and download Ad-Aware. You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot. A tutorial on installing & using this product can be found here:
    Instructions for - Spybot S & D and Ad-aware
  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
    Computer Safety on line - Anti-Malware
  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

May your God go with you..
Post #14
I hope you don't mind this. This is the first case of a HJT not being able to run that I have come accross. I need to have a topic of this for our students to study. So will be copying the posts in this topic to a hidden area for them to study. It might help them in the future with a similar problem.
Post #15
Hi Chris, I don't mind a bit… If it can help someone else by all means use it…. And once again I thank you for all your time and assistance.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI