What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijack this log file

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hi to all ,just join today ,need help with sisters computer picked up something nasty , task manager and regedit close after opening , have done a scan with ad-ware which found 9 nastys deleted them and rebooted but same 9 nastys back
gain, i have full access in safe mode ,here is a logfile of her system ,can anybody helpme .



Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\winaz32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\serbw.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\iepm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eircom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.eircom.net/
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {C5F31786-C937-4D9B-74F9-F764B2B32EF3} - C:\WINDOWS\sysbr.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iepm.exe] C:\WINDOWS\iepm.exe
O4 - HKLM\..\Run: [avnort] C:\WINDOWS\msmbw.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\system32\formatsys.exe
O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\msmbw.exe
O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\system32\formatsys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: ChatSpace Full Java Client 3.1.0.235N - http://205.177.13.50/Java/cfsn31235.cab
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\winaz32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
Post #2
Thanks for sending your information. We are sorry for the delay in responding. The volunteers here are swamped, and unfortunately, not all logs get answered as quickly as we'd like. If you still need help with your problem, please reply to this message with a new HijackThis log. I will be notified automatically when you reply. Thanks daveai
Post #3
hello , thanks for replying , my friend reckoned i had a w32serflog.A worm which i removed , i have done sevaral scans with AVG 7.0 and with Ad Ware v 1.06 ,all of which came up clear .i am not sure if everything is ok so here is my latest hjt log ,any help would be appreciated and many thanks wireman .
Post #4
very sorry forgot to add hjt log , here my latest hjt log


Logfile of HijackThis v1.99.1
Scan saved at 09:55:46, on 27/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eircom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.eircom.net/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {BA94C7FC-6F23-61AD-837C-91262653369E} - C:\WINDOWS\netna32.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [addmg.exe] C:\WINDOWS\addmg.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
Post #5
Thanks.

Your earlier HJT log showed a serious infection called About:Blank. which appears to have been partially removed. There are still remnanats of it in your logfile.

This pest is very persistant, and any remnants are capable of re-infectinghtesystem.

So…let's start with some standard automated tools for AB. If the infection still shows up, then we have somemore manual techniques that will knowck this pest out.

Thanks.

You have an infection called About:Blank. It may take several tries to fully remove.

First, we'll try the standard automated tools. If that doesn't work, we have a more complicated manual process that will take care of it.


1 – Please download Intermute's CWShredder from here:
http://cwshredder.net/bin/CWShredder.exe
Save it to the desktop and run it, and click "Fix" to remove the CWS infection.

2 – Then please download About:Buster from here:
http://www.malwarebytes.biz/AboutBuster5.zip
Unzip the files to a convenient location such as C:\AboutBuster, and run AboutBuster.exe. Read the instructions then click OK to proceed.

Click "Check for Updates", and then "Download Updates" to update About:Buster to the newest version.

Then click Start to begin the scan. If prompted to end the Explorer.exe process, click Yes. Your desktop may disappear — this is normal. Allow the program to scan twice, and when complete click "Save Log". This will create a text file called "AB Logfile.txt" in the folder where About:Buster is saved.

Please post the entire contents of that logfile here in your reply to this message.

3 – And, please restart your computer and post a new HijackThis log.

Thanks
daveai
Post #6
hello again , i have done what you asked and here are both log files

AboutBuster 5.0 reference file 30
Scan started on [28/06/2005] at [09:11:44]
————————————————
Removed Stream! C:\WINDOWS\A5W.INI:curufk
Removed Stream! C:\WINDOWS\BOGOUT.INI:mcswie
Removed Stream! C:\WINDOWS\CDSEUNST.INI:lowziz
Removed Stream! C:\WINDOWS\CDSEUNST.INI:qpgxyr
Removed Stream! C:\WINDOWS\DirectX.log:qvtsrt
Removed Stream! C:\WINDOWS\DirectX.log:xxjtjn
Removed Stream! C:\WINDOWS\entpack.ini:awdytv
Removed Stream! C:\WINDOWS\izyrp.txt:nngeus
Removed Stream! C:\WINDOWS\jqqca.dat:ydvtfe
Removed Stream! C:\WINDOWS\KB810217.log:yoyrod
Removed Stream! C:\WINDOWS\KB823182.log:pvlmut
Removed Stream! C:\WINDOWS\KB823980.log:refyih
Removed Stream! C:\WINDOWS\KB824141.log:hvdzoe
Removed Stream! C:\WINDOWS\KB841873.log:qgbwkg
Removed Stream! C:\WINDOWS\KB886185.log:jrbwtg
Removed Stream! C:\WINDOWS\medctroc.Log:ljkkly
Removed Stream! C:\WINDOWS\OEWABLog.txt:rjahcc
Removed Stream! C:\WINDOWS\OOBEACT.LOG:lmwbmf
Removed Stream! C:\WINDOWS\orun32.isu:jcsmxn
Removed Stream! C:\WINDOWS\PegSolitaire.ini:dnoghp
Removed Stream! C:\WINDOWS\Q328213.log:rxzrji
Removed Stream! C:\WINDOWS\q812415.log:hhdbq
Removed Stream! C:\WINDOWS\Q816981.log:hopoks
Removed Stream! C:\WINDOWS\Santa Fe Stucco.bmp:gfhpqx
Removed Stream! C:\WINDOWS\smscfg.ini:jemacn
Removed Stream! C:\WINDOWS\spupdsvc.log:pyqmjl
Removed Stream! C:\WINDOWS\swwln.log:iybsmn
Removed Stream! C:\WINDOWS\TSOC.LOG:dbeag
Removed Stream! C:\WINDOWS\VB.INI:vrtjxu
Removed Stream! C:\WINDOWS\Windows Update.log:ajtdlr
Removed Stream! C:\WINDOWS\XLMSoft.ini:vzzpsd
Removed Stream! C:\WINDOWS\{77AA7E5A-E969-45B2-909C-AFC35F23DE5D}.dat:dwfecf
Removed Stream! C:\WINDOWS\{77AA7E5A-E969-45B2-909C-AFC35F23DE5D}.dat:ermevx
————————————————
No Files Found!
————————————————
Scan was COMPLETED SUCCESSFULLY at 09:12:06




Logfile of HijackThis v1.99.1
Scan saved at 09:15:09, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eircom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.eircom.net/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {BA94C7FC-6F23-61AD-837C-91262653369E} - C:\WINDOWS\netna32.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [addmg.exe] C:\WINDOWS\addmg.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

once again thank you for the help , how does it look now ?? have i got the all clear ??
Post #7
sorry i made a mistake again i forgot to run about buster 2nd time , i ran it 2nd and a 3rd time it still found a problem , here are the new logs

AboutBuster 5.0 reference file 30
Scan started on [28/06/2005] at [09:11:44]
————————————————
Removed Stream! C:\WINDOWS\A5W.INI:curufk
Removed Stream! C:\WINDOWS\BOGOUT.INI:mcswie
Removed Stream! C:\WINDOWS\CDSEUNST.INI:lowziz
Removed Stream! C:\WINDOWS\CDSEUNST.INI:qpgxyr
Removed Stream! C:\WINDOWS\DirectX.log:qvtsrt
Removed Stream! C:\WINDOWS\DirectX.log:xxjtjn
Removed Stream! C:\WINDOWS\entpack.ini:awdytv
Removed Stream! C:\WINDOWS\izyrp.txt:nngeus
Removed Stream! C:\WINDOWS\jqqca.dat:ydvtfe
Removed Stream! C:\WINDOWS\KB810217.log:yoyrod
Removed Stream! C:\WINDOWS\KB823182.log:pvlmut
Removed Stream! C:\WINDOWS\KB823980.log:refyih
Removed Stream! C:\WINDOWS\KB824141.log:hvdzoe
Removed Stream! C:\WINDOWS\KB841873.log:qgbwkg
Removed Stream! C:\WINDOWS\KB886185.log:jrbwtg
Removed Stream! C:\WINDOWS\medctroc.Log:ljkkly
Removed Stream! C:\WINDOWS\OEWABLog.txt:rjahcc
Removed Stream! C:\WINDOWS\OOBEACT.LOG:lmwbmf
Removed Stream! C:\WINDOWS\orun32.isu:jcsmxn
Removed Stream! C:\WINDOWS\PegSolitaire.ini:dnoghp
Removed Stream! C:\WINDOWS\Q328213.log:rxzrji
Removed Stream! C:\WINDOWS\q812415.log:hhdbq
Removed Stream! C:\WINDOWS\Q816981.log:hopoks
Removed Stream! C:\WINDOWS\Santa Fe Stucco.bmp:gfhpqx
Removed Stream! C:\WINDOWS\smscfg.ini:jemacn
Removed Stream! C:\WINDOWS\spupdsvc.log:pyqmjl
Removed Stream! C:\WINDOWS\swwln.log:iybsmn
Removed Stream! C:\WINDOWS\TSOC.LOG:dbeag
Removed Stream! C:\WINDOWS\VB.INI:vrtjxu
Removed Stream! C:\WINDOWS\Windows Update.log:ajtdlr
Removed Stream! C:\WINDOWS\XLMSoft.ini:vzzpsd
Removed Stream! C:\WINDOWS\{77AA7E5A-E969-45B2-909C-AFC35F23DE5D}.dat:dwfecf
Removed Stream! C:\WINDOWS\{77AA7E5A-E969-45B2-909C-AFC35F23DE5D}.dat:ermevx
————————————————
No Files Found!
————————————————
Scan was COMPLETED SUCCESSFULLY at 09:12:06


AboutBuster 5.0 reference file 30
Scan started on [28/06/2005] at [09:49:56]
————————————————
Removed Stream! C:\WINDOWS\{77AA7E5A-E969-45B2-909C-AFC35F23DE5D}.dat:fxuxe
————————————————
No Files Found!
————————————————
Scan was COMPLETED SUCCESSFULLY at 09:50:17


AboutBuster 5.0 reference file 30
Scan started on [28/06/2005] at [09:53:15]
————————————————
Removed Stream! C:\WINDOWS\{77AA7E5A-E969-45B2-909C-AFC35F23DE5D}.dat:liqgjq
————————————————
No Files Found!
————————————————
Scan was COMPLETED SUCCESSFULLY at 09:53:37


Logfile of HijackThis v1.99.1
Scan saved at 10:17:40, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eircom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.eircom.net/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {BA94C7FC-6F23-61AD-837C-91262653369E} - C:\WINDOWS\netna32.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [addmg.exe] C:\WINDOWS\addmg.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

sorry about the mistakes and once again thank you very much for your help
Post #8
Thanks.

The automated tools appear to have knocked the About:Blank infections down. The following steps are to repair any dleted files nad to finish up. There will be one more step after this one.



Step#1:Restore Deleted System Files

Now we need to see if we need to restore some deleted files:Please check for the following files using the Windows Search Engine:
  • control.exe
  • rundll32.exe
  • wmplayer.exe
  • msconfig.exe
  • notepad.exe
  • shell.dll
  • SDHelper.dll
If any are missing or not working properly then you can download new copies from
Merijn's Files and following the instructions at that site to have them where they belong for your OS.


[*]If you are having any difficulty with Notepad, please go to Merijn's Files and choose 'Windows Files' from the menu on the left hand side of the page. Then choose 'Notepad' from the list and download it to C:\Windows and C:\Windows\System32


[*]Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.


[*]This infection often deletes some system files that need to be replaced. The most frequent one it deletes is shell.dll in Win2K or XP. In XP there are two copies of this file, one in Windows (WINNT) and one in Windows\System32. It does not delete the one in Windows\System so it does not affect Win9x/ME. If you find it missing, please copy the shell.dll from c:\windows\system32\dllcache into both \Windows (WINNT) and Windows\System32 .


[*]The other system file which is most frequently deleted is control.exe. Please check to make sure that you have this file and it is the correct size. If not Please check for the existence of this file by going to to Merijn's Files (sdhelper) and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to the information at this website. The control.exe is more often deleted in Win9x/ME.


[*]If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button





Step#2:Complete An Online AntiVirus Scan

Run an online antivirus scan at:

Trend Micro Online AV

Reboot



Step#3:Scan And Post a New HijackThis Log
  • Navigate to C:\Windows
  • look for files that were created at the approximate time and date as the infection occurred.
  • look for those that end in exe, DAT and DLL and if found, right click on the file and check properties. Legitimate files should be copyrighted by Microsoft
  • if you determine they are bad files, right click on them and choose delete
  • Navigate to C:\Windows\System or C:\Windows\System32 (depending on the OS) and repeat each of the above steps to check for those ending in exe, DAT and/or DLL
  • if the above files will not delete, then make a new folder on your desktop by right clicking on the desktop and choosing New > Folder. Name the folder CWS Files.
  • Move the files from C:\Windows or C:\Windows\System or C:\Windows\system32
    to the new folder CWS Files.



Step#4:Using your WIndows CD to replace System Files

** In cases where many system files are missing you have no alternative but to have them insert their Windows OS disk and run sfc /scannow from the Run box if able or from Recovery Console if not able to get into windows




Step#5:Scan And Post a New HijackThis Log

1. Scan again with HijackThis

2. POST your log file using Add Reply to see what is left to fix.


Thanks
daveai
Post #9
hello again ,i done a search for the files you mentioned in last post ,they all seem to be there in fact ther are multiple copys of some here is list of ther locations CONTROL.EXE 1 found c:\WINDOWS\SYSTEM32 8KB Application 29/08/05 rundll32.exe 6 copys found rundll32.exe c:\WINDOWS\SYSTEM32 33KB Application 04/08/2004 rundll32.exe c:\WINDOWS\ServicePackFiles\i386 33KB Application 04/08/2004 RUNDLL32.exe c:\WINDOWS\Prefetch 16kb 23/6/2005 RUNDLL32.exe c:\WINDOWS\Prefetch 18kb 24/6/2005 RUNDLL32.exe c:\WINDOWS \Prefetch 13kb 24/6/2005 RUNDLL32.exe c:\WINDOWS\Prefetch 13kb 24/6/2005 wmplayer.exe 5 copys found " C:\programfiles\WindowsMedia Player 72Kb App 11/08/2004 " C:\Windows\RegisteredPackages\ 508kb App 11/04/2003 " C:\WINDOWS\RegisteredPackages\ 72kb app 1/08/2004 " C:\WINDOWS\ServicePackFiles\i386 72kb App 04/08/2004 " C:\WINDOWS\RegisteredPackages\ 72kb App 04/08/2004 msconfig.exe 2 copys found C:\WINDOWS\ServicePackFiles\i386 155kb App 04/08/2004 " C:\WINDOWS\PCHealth\HelpCtr\Binaries 155kb App 04/08/2004 notepad.exe 4 copys found notepad.exe C:\WINDOWS 68kb APP 04/08/2004 NOTEPAD.EXE-2.. C:\WINDOWS\Prefetch 16Kb PF File 24/06/2005 notepad.exe C:\WINDOWS\SYSTEM\32 68kb App 04/08/2004 notepad.exe C:\WINDOWS\ServicePackFIles\i386 68kb App 04/08/2004 shell.dll 2 copys found SHELL.DLL C:\WINDOWS\SYSTEM 5kb APP 29/08/2002 SHELL.DLL C:\WINDOWS\SYSTEM32 5kb APP 29/08/2002 SDHelper.dll none found the problem i had at the beginig was stopping me from installing programs like spybot it would start setup then an error would pop up saying it could not complete and it would exit setup , i dont think i finished installing spybot s&d . do i need to do anything with the extra copys of some of these files ??? should i continue and do online scan ?? many thanks
Post #11
hello again , tried the online scan with trend micro got as far as 99% complete when it found an infection it completed scan 100%and message popped up waiting for summary. waited for summary for 1hr 45 min still nothing . closed it down ,restarted computer and here is hjt log .
what do i do next ???? any ideas ??

Logfile of HijackThis v1.99.1
Scan saved at 22:45:20, on 01/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eircom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.eircom.net/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {BA94C7FC-6F23-61AD-837C-91262653369E} - C:\WINDOWS\netna32.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [addmg.exe] C:\WINDOWS\addmg.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
Post #12
Thanks.

Okay…let's proceed to final cleanup.

1 – Run HijackThis, and press Scan, and put a check against the following entries, if they still show up. Make sure all browsers and program windows are closed except for HijackThis.

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {BA94C7FC-6F23-61AD-837C-91262653369E} - C:\WINDOWS\netna32.dll (file missing)

O4 - HKLM\..\Run: [addmg.exe] C:\WINDOWS\addmg.exe

Once you have selected all the items for HJT to fix, and remember to make sure all browsers and program windows are closed except for HijackThis, then click fix checked.



2 – Then use Windows Explorer to delete the following lists of program files and folders, if they still exist.

C:\WINDOWS\netna32.dll <– this file

C:\WINDOWS\addmg.exe <– this file

Please let me know about any problems with the file/folder deletes.

3 – After checking yourself against the following instructions, run AdAware and Spybot Search and Destroy:

Please see How to use Ad-Aware to remove Spyware for instructions on how to download, install and then use this software.

Please see How to use Spybot to remove Spyware for instructions on how to download, install and then use this software, which may catch things that Ad-Aware misses.

If the above finds things to clean, please re-run them to be sure the infections are gone. If not, please tell me what could not be cleared out.

4 – Now, reboot normally and run at least two of these online virus scans (Or more if you wish.), reboot after each scan:

Bitdefender<<
RAV<<
eTrust<<<'Cure' whatever is found, then delete if unsuccessful

Housecall<<
Panda ActiveScan<<
If the above find things to clean, please re-run them to be sure the infections are gone. If not, please tell me what could not be cleared out.

5 – Then, when you reply to tell me how all that went…please include another HijackThis log.

Thanks
daveai
Post #13
hello again ,followed your instructions up to deleting these files

C:\WINDOWS\netna32.dll <– this file

C:\WINDOWS\addmg.exe <– this file

they were not on system i even checked with a search .

ran a scan with with ad ware .1st scan found 12 files tracking cookies ,2nd scan all clear.
ran a scan with spy bot 13 found 5 files DSO exploit deleted files ran scan again same 5 files found again i updated spy bot13 to spy bot 14 ran scan all clear , but funny thing happened when i updated to spy bot 14 during update AVG located viruses and quarantined them .i have deleted the quarantine list in AVG. i restarted computer and started the online scan with Bitedefender ,it found 5 files and deleted them ,see log

BitDefender Online Scanner - Real Time Virus ReportBitDefender Online
Scanner - Real Time Virus Report
Generated at: Sat, Jul 02, 2005 - 17:41:08


Scan Info
Scanned Files173748
Infected Files5


Virus Detected
Trojan.Downloader.Agent.PE5




This summary of the scan process will be used by the BitDefender Antivirus
Lab to create agregate statistics about virus activity around the world.



i restarted and scanned again all clear .then i ran a scan with panda activescan
found 3 infections see log

Incident Status Location

Adware:Adware/Trymedia No disinfected C:\Documents and Settings\Jason Dowling\Desktop\Civ3GoldSetup-dm.exe
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\unstall.exe
Virus:Trj/Downloader.XP Disinfected C:\WINDOWS\wsaupd.exehttp

going to do another scan but heres is my hjt file
Logfile of HijackThis v1.99.1
Scan saved at 20:03:50, on 02/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\lexpps.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.eircom.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.eircom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/ie/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.eircom.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe


what do you think is it ok ?????
Post #14
Thanks

The HijackThis log is clean…no obvious malware. Nice work :)


Now, please allow me to suggest some general prevention steps to keep one's computer clean and secure. You have already taken a few of the steps, but it never hurts to take a quick look :)

1 – Be sure you update your anti-virus software at least once a week.

2 – To reduce re-infection potential for malware in the future, I strongly recommend installing three free programs: SpywareBlaster, SpywareGuard (or TeaTimer, which does the same thing), and IE/Spyad.

3 – Use AdAware SE and Spybot S&D; to regularly to scan your system.

4 – Continue to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

5 – I strongly recommend that you consider using a Firewall. Just by using a Firewall in its default configuration can lower your risk greatly. Check out what Lawrence Abrams has to say at Understanding and Using Firewalls

An excellent overview is: So how did I get infected in the first place?. Be sure to visit the browser test link at the end of the article to really see how secure your system is!!

Thanks
daveai
Post #15
hello again, :D thank you for all your help and the additional information , just one last question the last hjt log i posted has 2 lines in it see below O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) what is the "file missing" is it anything to be worried about ?? once again thank you for all the help :D

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI