What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help with removal

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Some kind of spyware or something installed something called PS Guard on my computer. I also keep getting random popups and my start page keeps getting changed.

Logfile of HijackThis v1.99.1
Scan saved at 8:26:00 AM, on 7/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\System32\intel32.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Downloads\hijackthis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MarkF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MarkF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1F23DF9C-261D-4CAF-A37E-212D69AE06C2} - C:\WINDOWS\System32\eeao.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\MarkF\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O18 - Filter: text/html - {F99C945F-2D94-44AC-B8CC-BDFB84A9952D} - C:\WINDOWS\System32\eeao.dll
O18 - Filter: text/plain - {F99C945F-2D94-44AC-B8CC-BDFB84A9952D} - C:\WINDOWS\System32\eeao.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #2
Hello markac, welcome to the TC.



Download CW-Shredder at the link below: (don't run it yet)
http://cwshredder.net/bin/CWShredder.exe

Download 'SpSeHjfix'. into a folder. (don't run it yet)

Please download the trial version of ewido security suite. Install ewido security suite and start the program from the icon on your desktop, then check for and download updates.(Don't run it yet)


Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.



Disconnect from the net and Close ALL OPEN PROGRAMS.
Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the folder.

Now run the Shredder - Hit The FIX button!

Reboot and repeat the process above starting with:Disconnect from the net .


Now run the Shredder - Hit The FIX button!

Next:
Open Ewido Security Suite
  • Click on scanner
  • Make sure the following boxes are checked before scanning:
    • Binder
    • Crypter
    • Archives
  • Click on Start Scan
  • Let the program scan the machine
While the scan is in progress you will be prompted to clean files, click OK

Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop

In the Control Panel click Display > Desktop > Customize desktop > Website > Uncheck "Security Info" if present.

Delete any other files you see related to other malware, then empty recycle bin.


Reboot and post a fresh HJT log, the log from the Ewido scan and the log that was created by 'SpSeHjfix'.
Post #3
Logfile of HijackThis v1.99.1
Scan saved at 11:25:32 AM, on 7/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Downloads\TomCoyote\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe


////////////////////////////////////// Ewido \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 10:55:45 AM, 7/16/2005
+ Report-Checksum: 7E44ED23

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
C:\Documents and Settings\MarkF\Cookies\markf@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\MarkF\Cookies\markf@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\MarkF\Cookies\markf@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Program Files\AC Tool\ACTool.exe -> Heuristic.Win32.Backdoor.IrcBot : Cleaned with backup
C:\WINDOWS\uninstIU.exe -> Trojan.Agent.ff : Cleaned with backup


::Report End


////////////////////////////////////// SPSeHjFix \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\



(7/15/05 8:03:28 PM) SPSeHjFix started v1.1.2
(7/15/05 8:03:28 PM) OS: WinXP Service Pack 1 (5.1.2600)
(7/15/05 8:03:28 PM) Language: english
(7/15/05 8:03:28 PM) Win-Path: C:\WINDOWS
(7/15/05 8:03:28 PM) System-Path: C:\WINDOWS\System32
(7/15/05 8:03:28 PM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(7/15/05 8:03:46 PM) Disinfection started
(7/15/05 8:03:46 PM) Bad-Dll(IEP): c:\docume~1\markf\locals~1\temp\se.dll
(7/15/05 8:03:46 PM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\eeao.dll
(7/15/05 8:03:46 PM) Searchassistant Uninstaller - Keys Deleted
(7/15/05 8:03:46 PM) UBF: 6 - UBB: 1 - UBR: 8
(7/15/05 8:03:46 PM) FilterKey: HKCR\text/html (deleted)
(7/15/05 8:03:46 PM) FilterKey: HKCR\CLSID\{F99C945F-2D94-44AC-B8CC-BDFB84A9952D} (deleted)
(7/15/05 8:03:46 PM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(7/15/05 8:03:46 PM) FilterKey: HKCR\text/plain (deleted)
(7/15/05 8:03:46 PM) FilterKey: HKCR\CLSID\{F99C945F-2D94-44AC-B8CC-BDFB84A9952D} (error while deleting)
(7/15/05 8:03:46 PM) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(7/15/05 8:03:46 PM) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F23DF9C-261D-4CAF-A37E-212D69AE06C2} (deleted)
(7/15/05 8:03:46 PM) BHO-Key: HKCR\CLSID\{1F23DF9C-261D-4CAF-A37E-212D69AE06C2} (deleted)
(7/15/05 8:03:46 PM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\MarkF\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(7/15/05 8:03:46 PM) UBF: 4 - UBB: 0 - UBR: 7
(7/15/05 8:03:46 PM) Bad IE-pages:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\markf\locals~1\temp\se.dll/spage.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(7/15/05 8:03:46 PM) Stealth-String not found
(7/15/05 8:03:46 PM) File added to delete: c:\windows\system32\eeao.dll
(7/15/05 8:03:46 PM) File added to delete: c:\docume~1\markf\locals~1\temp\se.dll
(7/15/05 8:03:46 PM) Reboot


(7/15/05 8:05:12 PM) SPSeHjFix started v1.1.2
(7/15/05 8:05:12 PM) OS: WinXP Service Pack 1 (5.1.2600)
(7/15/05 8:05:12 PM) Language: english
(7/15/05 8:05:12 PM) Win-Path: C:\WINDOWS
(7/15/05 8:05:12 PM) System-Path: C:\WINDOWS\System32
(7/15/05 8:05:12 PM) Temp-Path: C:\DOCUME~1\MarkF\LOCALS~1\Temp\


(7/15/05 8:07:05 PM) SPSeHjFix started v1.1.2
(7/15/05 8:07:05 PM) OS: WinXP Service Pack 1 (5.1.2600)
(7/15/05 8:07:05 PM) Language: english
(7/15/05 8:07:05 PM) Win-Path: C:\WINDOWS
(7/15/05 8:07:05 PM) System-Path: C:\WINDOWS\System32
(7/15/05 8:07:05 PM) Temp-Path: C:\DOCUME~1\MarkF\LOCALS~1\Temp\
(7/15/05 8:07:06 PM) Disinfection started
(7/15/05 8:07:06 PM) Bad-Dll(IEP): c:\docume~1\markf\locals~1\temp\se.dll
(7/15/05 8:07:06 PM) UBF: 4 - UBB: 0 - UBR: 9
(7/15/05 8:07:06 PM) UBF: 4 - UBB: 0 - UBR: 9
(7/15/05 8:07:06 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\markf\locals~1\temp\se.dll/spage.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(7/15/05 8:07:06 PM) Stealth-String not found
(7/15/05 8:07:06 PM) No locked Files to delete. End without Reboot
(7/15/05 8:07:13 PM) Disinfection started
(7/15/05 8:07:13 PM) Bad-Dll(IEP): c:\docume~1\markf\locals~1\temp\se.dll
(7/15/05 8:07:13 PM) UBF: 4 - UBB: 0 - UBR: 9
(7/15/05 8:07:13 PM) UBF: 4 - UBB: 0 - UBR: 9
(7/15/05 8:07:13 PM) Bad IE-pages: (none)
(7/15/05 8:07:13 PM) Stealth-String not found
(7/15/05 8:07:13 PM) No locked Files to delete. End without Reboot


(7/15/05 8:07:21 PM) SPSeHjFix started v1.1.2
(7/15/05 8:07:21 PM) OS: WinXP Service Pack 1 (5.1.2600)
(7/15/05 8:07:21 PM) Language: english
(7/15/05 8:07:21 PM) Win-Path: C:\WINDOWS
(7/15/05 8:07:21 PM) System-Path: C:\WINDOWS\System32
(7/15/05 8:07:21 PM) Temp-Path: C:\DOCUME~1\MarkF\LOCALS~1\Temp\
(7/15/05 8:07:23 PM) Disinfection started
(7/15/05 8:07:23 PM) Bad-Dll(IEP): (not found)
(7/15/05 8:07:23 PM) Bad-Dll(IEP) in BHO: (not found)
(7/15/05 8:07:23 PM) UBF: 4 - UBB: 0 - UBR: 9
(7/15/05 8:07:23 PM) UBF: 4 - UBB: 0 - UBR: 9
(7/15/05 8:07:23 PM) Bad IE-pages: (none)
(7/15/05 8:07:23 PM) Stealth-String not found
(7/15/05 8:07:23 PM) Not infected->END
Post #4
Please use Alt/Ctrl/Del and end the process for TeaTimer


I suggest you do this:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe

Optional Resource hogs and not needed at startup:
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Close ALL windows and browsers except HijackThis and click "Fix checked"

use Add/Remove Programs and remove:
PSGuard


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #5
My computer seems to be acting fine now, as far as I can tell, but if I notice something, I'll post.

Logfile of HijackThis v1.99.1
Scan saved at 12:19:25 PM, on 7/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Downloads\TomCoyote\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #6
Good Job :thumbup:


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #7
Doh, I forgot, one more problem. My Desktop is still blue and displaying an error… It said in your first post to go to Display > Desktop > Customize Desktop, but when I go into Display, there are only 2 tabs: Screen Saver and Settings.
Post #8
Method 1: Delete the Desktop.ini File
1. Start Windows Explorer. (double click My Computer)
2. On the Tools menu, click Folder Options, and then click the View tab.
3. In the Advanced settings box, click to clear the Hide extensions for known file types check box and the Hide protected operating system files check box (if they are not already cleared), and then click OK.
4. Delete any occurrences of the Desktop.ini file that contains the lines described earlier in the "Symptoms" section of this article. To do so: a. Locate each of the following folders, right-click the Desktop.ini file (if the file exists in that folder), and then click Open: • drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu
where drive is the drive on which Windows is installed.
b. Verify that the file contains the following lines:[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell 32.dll,-21787
If the file contains these lines, right-click the file, click Delete, and then click Yes when you are prompted to confirm the deletion.

5. Restart your computer and verify that the issue is resolved.

If the above didn't work:

Method 2: Use the System Configuration Utility (Msconfig.exe) to Disable the Startup Item
1. Click Start, and then click Run.
2. In the Open box, type msconfig, and then click OK.
3. Click the Startup tab.
4. Click to clear the check box beside any desktop entries in the Startup Item column that are listed as Common Startup in the Location column, and are also located in any of the following locations (as indicated in the Command column): • drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

5. Click OK to quit the System Configuration Utility.
6. Restart your computer and verify that the issue is resolved.
Post #9 last edited
Was I supposed to do this in Safe Mode? Because I did the first part fine, restarted, still having the problem. Started the second part, but there were no startup entries from those locations. All I saw was adobe, and my motherboard utilities… I even did a search for desktop.ini, and all the ones it found were empty. It also found the ones in the recycling bin… maybe that's what's wrong? Gonna go empty it and restart. Thanks so much for your help so far, Mark
Post #11
——————————————————————————–

Security Warning

A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) +
00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c

* System can not function in normal mode.
Please check you security settings.
^Added note from me: this is not my typo.
* Scan your PC with any available antivirus / spyware remover
program to fix the problem.

——————————————————————————–

I would have written this out earlier, but I thought the spyware was doing it, and that it would be fixed when the spyware got fixed.
Post #12
Please read these instructions carefully and print them out! Be sure to follow ALL instructions!

Please right-click:HERE and go to Save As (in Internet Explorer it's "Save Target As") Save it to your desktop.
Right Click on any open area on the desktop, New> Folder, then name the folder Fix. Back on the desktop, Right Click on Smitfraud.zip and select Cut, open the Fix folder, Right Click and select Paste. Double Click Smitfraud.zip and extract to it there. There's more than 1 file in the zip and they need to stay together. You should see a new folder named Smitfraud. Don't run it yet.


Place a shortcut to Panda Activescan on your desktop.



Reboot to safe mode and open the smitfraud folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. When the tool completes,

Open Ewido Security Suite
  • Click on scanner
  • Make sure the following boxes are checked before scanning:
    • Binder
    • Crypter
    • Archives
  • Click on Start Scan
  • Let the program scan the machine
While the scan is in progress you will be prompted to clean files, click OK

Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop

In the Control Panel click Display > Desktop > Customize desktop > Website > Uncheck "Security Info" if present.



Reboot normal and click the Panda Activescan shortcut, then do a full system scan. Make sure the autoclean box is checked! Save the scan log and post it along with a new HijackThis log and the Ewido log. Let us know if any problems persist.
Post #13
////////////////////////////// Panda Active Scan \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


Incident Status Location

Virus:W32/Smitfraud.C Disinfected Operating system
Adware:adware/psguard No disinfected C:\DOCUMENTS AND SETTINGS\MARKF\APPLICATION DATA\PSGuard.com
Virus:W32/Smitfraud.C Disinfected C:\WINDOWS\system32\wininet.dll


////////////////////////////// HiJackThis \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


Logfile of HijackThis v1.99.1
Scan saved at 1:02:30 PM, on 7/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Downloads\TomCoyote\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\RunOnce: [Panda_cleaner_39194] C:\WINDOWS\System32\ActiveScan\pavdr.exe 39194
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe


////////////////////////////// Ewido Security Suite \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 12:39:36 PM, 7/17/2005
+ Report-Checksum: 1A39D4D9

+ Scan result:

C:\Documents and Settings\MarkF\Cookies\markf@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup


::Report End


Now, my computer seems to be acting normal, except Panda said there was one file not cleaned, should I just delete that file?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI