This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Cannot Fix These Problems

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

hi

I am having serious problems with my PC at the moment. I have installed and purchased many spware,adware,trojan,bot and worm removal tools,scanners, etc and it finds problems every time, says it deletes them, but then another virus appears. Norton's advises me of the viruses..many of them being W32 sillywormP2p,W32 spybot (which i purchased a product by the name of scan spyware which guarenteed to clean the virus) and a big problem i have is when i scan the computer it tells me i have these RegKey's by grokster(?) located in HKEY local machine..i dont even know what this means. I have looked on symnatec for answers and i cannot find any!! Lastly i have this stupid mIRC screen that appears every time i start the computer. I attempted to delete the program and when i did it brought up system32 with this weird folder containing files I could not open. I attempted to delete it following instructions from a site and I got nowhere… I didnt even download mIRC, and have no clue of it's use and why its there. I get funny little messages every now and then about some shell port not running..Im not the best with computer talk so I hope whoever reads this can help me out here….


Logfile of HijackThis v1.99.1
Scan saved at 3:08:52 AM, on 3/5/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Vet\isafe.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\System32\msjvm.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\System32\msnplus.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Winferno\Secure IE\SIEPulse.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Vet\VetTray.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\NavNT\VPC32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SuperBar - {79EC5E6F-B2F3-4048-A4AE-87FB9F9908E4} - C:\Program Files\_SUPERBAR\_SUPERBAR.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\Run: [Microsoft Security] winService.exe
O4 - HKLM\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SIE2004] "C:\Program Files\Winferno\Secure IE\SIEPulse.exe"
O4 - HKLM\..\Run: [ser] C:\WINDOWS\System32\ocprt\targa5.exe
O4 - HKLM\..\Run: [windowsx] C:\WINDOWS\System32\iceep\vo.exe
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Hot_Tarts_Au] C:\Program Files\Video1\Dialers\Hot_Tarts_Au\Hot_Tarts_Au.exe /dontdial
O4 - HKLM\..\Run: [Virgins_au] C:\Program Files\Video1\Dialers\Virgins_au\Virgins_au.exe /dontdial
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [Msn Updater] msnplus.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\RunServices: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\RunServices: [Microsoft Security] winService.exe
O4 - HKLM\..\RunServices: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunServices: [Msn Updater] msnplus.exe
O4 - HKLM\..\RunOnce: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunOnce: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKCU\..\Run: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SpywareKilla] "C:\PROGRA~1\SPYWAR~2\SpywareKilla.exe" /s
O4 - HKCU\..\RunOnce: [Msn Updater] msnplus.exe
O4 - Global Startup: LimeWire 4.0.5 Pro.lnk = C:\Program Files\LimeWire\LimeWire 4.0.5 Pro\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.allgamesfree.com/gamefiles/rico…bGameLoader.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe

I notcied that theres even diallers for porn on this scan!! where the hell is it all coming from???????

HELP
Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O3 - Toolbar: SuperBar - {79EC5E6F-B2F3-4048-A4AE-87FB9F9908E4} - C:\Program Files\_SUPERBAR\_SUPERBAR.dll
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\Run: [Microsoft Security] winService.exe
O4 - HKLM\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\Run: [ser] C:\WINDOWS\System32\ocprt\targa5.exe
O4 - HKLM\..\Run: [windowsx] C:\WINDOWS\System32\iceep\vo.exe
O4 - HKLM\..\Run: [Hot_Tarts_Au] C:\Program Files\Video1\Dialers\Hot_Tarts_Au\Hot_Tarts_Au.exe /dontdial
O4 - HKLM\..\Run: [Virgins_au] C:\Program Files\Video1\Dialers\Virgins_au\Virgins_au.exe /dontdial
O4 - HKLM\..\Run: [Msn Updater] msnplus.exe
O4 - HKLM\..\RunServices: [WindowsRegKey upd4te2d4te] dmjdmziei.exe
O4 - HKLM\..\RunServices: [Microsoft Security] winService.exe
O4 - HKLM\..\RunServices: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunServices: [Msn Updater] msnplus.exe
O4 - HKLM\..\RunOnce: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKLM\..\RunOnce: [Msn Updater] msnplus.exe
O4 - HKCU\..\Run: [Microsoft Java Virtual Machine] msjvm.exe
O4 - HKCU\..\Run: [Msn Updater] msnplus.exe
O4 - HKCU\..\RunOnce: [Msn Updater] msnplus.exe
O4 - Global Startup: LimeWire 4.0.5 Pro.lnk = C:\Program Files\LimeWire\LimeWire 4.0.5 Pro\LimeWire.exe


Using Windows Explorer, find and delete the following:

C:\WINDOWS\System32\ocprt\ <– folder
C:\WINDOWS\System32\iceep\ <– folder
C:\Program Files\Video1\ <– folder
C:\Program Files\LimeWire\ <– folder

Reboot when done. Rescan with HijackThis and post a new log in your next reply.
hi. i followed all of your'e directions and to my delight finally got rid of that mIRC screen!! Thanks very much for your'e helpful advice…heres the new log:

Logfile of HijackThis v1.99.1
Scan saved at 3:10:45 PM, on 3/6/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Winferno\Secure IE\SIEPulse.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Vet\VetTray.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Vet\isafe.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Vet\VetMsg.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SIE2004] "C:\Program Files\Winferno\Secure IE\SIEPulse.exe"
O4 - HKLM\..\Run: [BigPondCable] "C:\Program Files\Telstra\Cable Login\bpcable.exe" /r
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [VetTray] C:\Vet\VetTray.exe
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [ErrorGuard] C:\Program Files\ErrorGuard\ErrorGuard.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn200…erInstaller.exe
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://jcs.chat.dcn.yahoo.com/v45/yacscom.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BigPond Broadband Cable Login (bpcService) - Unknown owner - C:\Program Files\Telstra\Cable Login\bpcService.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Vet\isafe.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Vet\VetMsg.exe

i appreciate the helpful advice

cheers.
computer running fine mIRC gone..all those virus alerts gone too….do you know what caused it all?? error guard uninstalled too. Thanks a whole heap. :)
You're welcome - glad to help :D You picked up viruses somehow - can't be specific, possibly stealth installed when you clicked on a website.

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI