Spyware / Malware / Virus Removal

Massive Pop-ups, pls help!

9 min read

Looking for the outcome? Ask AI

funkyalic Topic Starter

Post #1July 13, 2005, 2:26 AM UTC last edited July 13, 2005, 2:30 AM UTC

I have massives pops ups, shortcuts on my desktop…

A program is installed called The ABI Network - A Divison of Direct Revenue

Pls help me remove it, and btw I don't remember how to pull out log from hijack so pls tell me how.

Thank you

I HATE pop-ups!

Found out how…

Here's the log

Logfile of HijackThis v1.99.1
Scan saved at 22:28:07, on 2005-07-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\windowsautomaticupdates.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LimeWire\LimeWire.exe
c:\windows\system32\ecsbxn.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe
C:\Program Files\CMAPP\Client\cmappclient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.765\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=9705
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nst5A.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dczaiyg] c:\windows\system32\ecsbxn.exe r
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\CMAPP\Client\cmappmf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Automatic Updates - Stanford University - C:\WINDOWS\system32\windowsautomaticupdates.exe

Siggyx

Post #2July 13, 2005, 2:39 AM UTC

Please download the trial version of Ewido Security Suite here:

http://www.softpedia.com/get/Antivirus/Ewi…ity-Suite.shtml

Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please go to the following website download Nailfix.exe
Unzip it to the desktop but please do NOT run it yet.

http://www.noidea.us/easyfile/file.php?dow…050515010747824

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and put a check mark beside:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

funkyalic

Post #3July 13, 2005, 3:06 AM UTC

The link for nailfix doent work….do u have another one?

Siggyx

Post #4July 13, 2005, 3:14 AM UTC

Try here

http://users.pandora.be/bluepatchy/nailfix.exe

funkyalic

Post #5July 13, 2005, 11:11 PM UTC

I don't know if it works….

Here a the logs

Logfile of HijackThis v1.99.1
Scan saved at 19:05:15, on 2005-07-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=9705
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nst5A.dll (file missing)
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [ysrnad] c:\windows\system32\ohntdps.exe r
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: E&xporter; vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\CMAPP\Client\cmappmf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Automatic Updates - Stanford University - C:\WINDOWS\system32\windowsautomaticupdates.exe

———————————————————
ewido security suite - Rapport de scan
———————————————————

+ Créé le: 19:04:22, 2005-07-13
+ Somme de contrôle: 8C190AF7

+ Résultats du scan:

HKLM\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97} -> Spyware.SaveNow : Ignoré
HKU\S-1-5-21-2944431075-1942694482-23179530-1007\Software\Microsoft\Internet Explorer\Explorer Bars\{BE8D0059-D24D-4919-B76F-99F4A2203647} -> Spyware.EliteBar : Ignoré
HKU\S-1-5-21-2944431075-1942694482-23179530-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{36A59337-6EEF-40AE-94B1-ED443A0C4740} -> Spyware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt -> Spyware.Cookie.2o7 : Ignoré
C:\Documents and Settings\Owner\Cookies\[removed][2].txt -> Spyware.Cookie.Addynamix : Ignoré
C:\Documents and Settings\Owner\Cookies\[removed]-sys[1].txt -> Spyware.Cookie.Serving-sys : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@centrport[1].txt -> Spyware.Cookie.Centrport : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@overture[1].txt -> Spyware.Cookie.Overture : Ignoré
C:\Documents and Settings\Owner\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@qksrv[2].txt -> Spyware.Cookie.Qksrv : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Ignoré
C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Ignoré
C:\Documents and Settings\Owner\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temp\uninstall.exe -> Spyware.EliteBar : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\7V91XD5E\Poller[1].exe -> Adware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HPHF6YZM\Nail[1].exe -> Adware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\RK441XJA\DrPMon[1].dll -> Adware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VZNFJKD1\svcproc[1].exe -> Adware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WD6JG5YN\abiuninst[1].exe -> Adware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WD6JG5YN\AuroraHandler[1].dll -> Adware.BetterInternet : Ignoré
C:\Documents and Settings\Owner\Mes documents\Ma musique\Sony Sound Forge 8.zip/Setup.exe -> Worm.VB.an : Ignoré
C:\RECYCLER\NPROTECT\00227631.TXT -> Spyware.Cookie.Qksrv : Ignoré
C:\RECYCLER\NPROTECT\00227632.TXT -> Spyware.Cookie.Overture : Ignoré
C:\RECYCLER\NPROTECT\00227633.TXT -> Spyware.Cookie.Overture : Ignoré
C:\RECYCLER\NPROTECT\00228322.TXT -> Spyware.Cookie.Tribalfusion : Ignoré
C:\RECYCLER\NPROTECT\00228326.TXT -> Spyware.Cookie.Tribalfusion : Ignoré
C:\RECYCLER\NPROTECT\00228328.TXT -> Spyware.Cookie.Trafficmp : Ignoré
C:\RECYCLER\NPROTECT\00228329.TXT -> Spyware.Cookie.Trafficmp : Ignoré
C:\RECYCLER\NPROTECT\00228330.TXT -> Spyware.Cookie.Trafficmp : Ignoré
C:\RECYCLER\NPROTECT\00228331.TXT -> Spyware.Cookie.Trafficmp : Ignoré
C:\RECYCLER\NPROTECT\00228332.TXT -> Spyware.Cookie.Trafficmp : Ignoré
C:\RECYCLER\NPROTECT\00228410.TXT -> Spyware.Cookie.Qksrv : Ignoré
C:\RECYCLER\NPROTECT\00228800.TXT -> Spyware.Cookie.Qksrv : Ignoré
C:\RECYCLER\NPROTECT\00229007.exe -> Adware.BetterInternet : Ignoré
C:\RECYCLER\NPROTECT\00229022.exe -> Adware.BetterInternet : Ignoré
C:\RECYCLER\NPROTECT\00229056.exe -> Adware.BetterInternet : Ignoré
C:\RECYCLER\NPROTECT\00229058.exe -> Adware.BetterInternet : Ignoré
C:\RECYCLER\NPROTECT\00229059.exe -> Adware.BetterInternet : Ignoré
C:\RECYCLER\NPROTECT\00229060.exe -> Adware.BetterInternet : Ignoré
C:\RECYCLER\NPROTECT\00229061.exe -> Adware.BetterInternet : Ignoré
C:\WINDOWS\NDNuninstall6_38.exe -> Spyware.NewDotNet : Ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G1GH8RSX\canada[1].exe -> Dialer.Generic : Ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G1GH8RSX\canada[2].exe -> Dialer.Generic : Ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GDIBOPIR\canada[1].exe -> Dialer.Generic : Ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YBQZU12R\canada[1].exe -> Dialer.Generic : Ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YBQZU12R\canada[2].exe -> Dialer.Generic : Ignoré
C:\WINDOWS\system32\hbvucf.exe -> Adware.BetterInternet : Ignoré
C:\WINDOWS\system32\nsf2B.dll -> Spyware.HotSearchBar : Ignoré
C:\WINDOWS\system32\nsg57.dll -> Spyware.HotSearchBar : Ignoré
C:\WINDOWS\system32\nss54.dll -> Spyware.HotSearchBar : Ignoré
C:\WINDOWS\system32\shawn_1.dll -> Spyware.EliteBar : Ignoré

Pls help me!!

funkyalic

Post #6July 14, 2005, 12:25 AM UTC

Hello?? Anybody help???

Siggyx

Post #7July 14, 2005, 12:30 AM UTC

Boot to safe mode and scan with ewido again this time allow it to fix whatever it finds. Then post the log and a new hijackthis log.

funkyalic

Post #8July 14, 2005, 12:41 AM UTC

ewido security suite - Rapport de scan
———————————————————

+ Créé le: 20:38:39, 2005-07-13
+ Somme de contrôle: 469C7C27

+ Résultats du scan:

C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt -> Spyware.Cookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\[removed][2].txt -> Spyware.Cookie.Addynamix : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\[removed]-sys[1].txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@centrport[1].txt -> Spyware.Cookie.Centrport : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@overture[1].txt -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@qksrv[2].txt -> Spyware.Cookie.Qksrv : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temp\uninstall.exe -> Spyware.EliteBar : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\7V91XD5E\Poller[1].exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HPHF6YZM\Nail[1].exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\RK441XJA\DrPMon[1].dll -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VZNFJKD1\svcproc[1].exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WD6JG5YN\abiuninst[1].exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WD6JG5YN\AuroraHandler[1].dll -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\Documents and Settings\Owner\Mes documents\Ma musique\Sony Sound Forge 8.zip/Setup.exe -> Worm.VB.an : Nettoyer et sauvegarder
C:\WINDOWS\NDNuninstall6_38.exe -> Spyware.NewDotNet : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G1GH8RSX\canada[1].exe -> Dialer.Generic : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G1GH8RSX\canada[2].exe -> Dialer.Generic : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GDIBOPIR\canada[1].exe -> Dialer.Generic : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YBQZU12R\canada[1].exe -> Dialer.Generic : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YBQZU12R\canada[2].exe -> Dialer.Generic : Nettoyer et sauvegarder
C:\WINDOWS\system32\hbvucf.exe -> Adware.BetterInternet : Nettoyer et sauvegarder
C:\WINDOWS\system32\nsf2B.dll -> Spyware.HotSearchBar : Nettoyer et sauvegarder
C:\WINDOWS\system32\nsg57.dll -> Spyware.HotSearchBar : Nettoyer et sauvegarder
C:\WINDOWS\system32\nss54.dll -> Spyware.HotSearchBar : Nettoyer et sauvegarder
C:\WINDOWS\system32\shawn_1.dll -> Spyware.EliteBar : Nettoyer et sauvegarder

Logfile of HijackThis v1.99.1
Scan saved at 20:39:23, on 2005-07-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe
C:\Program Files\CMAPP\Client\cmappclient.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\windowsautomaticupdates.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=9705
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nst5A.dll (file missing)
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [ysrnad] c:\windows\system32\ohntdps.exe r
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\CMAPP\Client\cmappmf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Automatic Updates - Stanford University - C:\WINDOWS\system32\windowsautomaticupdates.exe

Siggyx

Post #9July 14, 2005, 12:52 AM UTC

Download CCleaner from here >>>>> http://www.majorgeeks.com/download4191.html

Save it to your desktop. Open CCleaner and click on "run cleaner" at the bottom right.

Scan with hijackthis and put a heck beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=9705

O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - C:\WINDOWS\system32\nst5A.dll (file missing)
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll

O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [ysrnad] c:\windows\system32\ohntdps.exe r

Then make sure hifdden files are present tutorial here >>>> http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Boot to safe mode (tap f8 while bios loads) then look for and delete these if present

C:\WINDOWS\system32\richup.exe<< C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe<< c:\windows\system32\ohntdps.exe r<<
Then reboot to normal mode scan with hijackthis and post a new log please.

funkyalic

Post #10July 14, 2005, 1:50 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 21:45:58, on 2005-07-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\CMAPP\Client\cmappclient.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\windowsautomaticupdates.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - C:\Program Files\CMAPP\Client\cmappmf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Automatic Updates - Stanford University - C:\WINDOWS\system32\windowsautomaticupdates.exe

Could not find C:\WINDOWS\system32\richup.exe and c:\windows\system32\ohntdps.exe

Siggyx

Post #11July 14, 2005, 2:05 AM UTC

Looks good

How is it running?

funkyalic

Post #12July 14, 2005, 2:14 AM UTC

Ok the computer itself runs good…but the ABI thing (scroll up) is still there!

Siggyx

Post #13July 14, 2005, 2:15 AM UTC

Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.

funkyalic

Post #14July 14, 2005, 2:17 AM UTC

ok then can I come back with you tomorrow…gotta go to bed and dont have time for a long scan…

funkyalic

Post #15July 14, 2005, 11:39 PM UTC

ok I'm back and doing the scan…been running for over an hour as you said…have about 80 virus found and 40 errors…post the log as soon as its over.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Massive Pop-ups, pls help!

✨ Ask AI

Ask AI