What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

about:blank

55 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I prefer to use Codestuff Starter instead of msconfig to stop programs from loading at startup.

You can remove any of the files that are 0kb. I would suggest moving these programs downloaded during the fix (CWShredder, About Buster, and hsfix.exe) to a seperate folder for now. Give the computer a few weeks and if everything is still working well than delete the folder. Registrar Lite can be uninstalled with Add/Remove Programs once the computer has been working well for a while.
Firefox for a browser is up to you.I personally use it most of the time. Now that the computer is clean and the suggestions below are followed, Internet Explorer should not cause any more trouble.

Your new log appears clean. :)

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
ZoneAlarm - Free firewall program if you currently are not using one.

Here are three very good and free malware scanners:

Spybot Search and Destroy 1.4
AdAware SE v1.06
Set-up Instructions for Spybot S&D; and Adaware SE
a² Free Trojan Remover

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #17
hi alan, i can't thank you enough. just a couple of questions: 1) i downloaded all these programs throughout the fix -cwshredder -hsremove -hijack this -spybot -aboutblaster -spywareblaster -reglite -ewido -cc cleaner -hs fix -and from trend….java2 2) which ones should i keep for awhile & which ones should i have running all the time 3) i've always had ad-aware & avast on my pc 4) when i right click on the ie icon on my desktop, i still see about:blank in the home page window…so i'm afraid to even think of opening the ie browser. thanks again mike
Post #18

1) i downloaded all these programs throughout the fix
-cwshredder << Keep for a while.
-hsremove << Remove now
-hijack this << Keep for a while.
-spybot << Keep and update
-aboutbuster << Keep for a while.
-spywareblaster << Keep and update
-reglite << Keep for a while.
-ewido << Keep until trial expires
-cc cleaner << Keep and update
-hs fix << Keep for a while.
-and from trend….java2 << Not sure what this program is.
2) which ones should i keep for awhile & which ones should i have running all the time

4) when i right click on the ie icon on my desktop, i still see about:blank in the home page window…so i'm afraid to even think of opening the ie browser.

Go to Start < Control Panel < Internet Options and change your home page to what it was before the infection. The infection may have removed your homepage and it is set to the default blank page which is not bad.

I would like you to use Internet Explorer for a little bit to be sure that the infection is indeed gone.
Post #20
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418
Post #21 last edited
Topic reopened at user's request.

hello alan (alsocom),
still have a couple of small problems that i hope you can help me with.

Post #22
hi,
"alsocom" helped me through a nightmare but i still have a couple of problems.
1) when i boot up i get this message
WINDOWS CANNOT FIND 'C:\WINDOWS\APISO32.EXE.
MAKE SURE YOU TYPED THE NAME CORRECTLY, AND THEN TRY AGAIN.
TO SEARCH FOR A FILE, CLICK THE START BUTTON AND THEN CLICK SEARCH.
apiso32.exe was in network security service which is now gone.
2) spybot says the registry wants to change apiso32.exe at startup
3) cc cleaner shows apiso32.exe in the starup but msconfig doesn't
4) i'm using firefox now but when i go to internet explorer options it shows hsremove.com as my homepage & i still see about:blank in my hijack log & every time i boot up a folder called "links" gets added to my favorites & there's "live365" in my cookies & i'm not even using IE.
that's all i can think of for now. here's my hijack log, thanks.

Logfile of HijackThis v1.99.1
Scan saved at 3:08:47 PM, on 7/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Compaq\EASYAC~1\EAUSBKBD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://hsremove.com/done.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: (no name) - {054F5E50-28A8-4816-3209-EFF9B61A1BEC} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10F009D2-02C1-DA9A-40FD-0C116521EA7F} - (no file)
O2 - BHO: (no name) - {1C5FE92B-D6A5-2B56-D796-580344D5766A} - (no file)
O2 - BHO: (no name) - {213FF3C4-933A-5728-4344-750F1EBB3DD5} - (no file)
O2 - BHO: (no name) - {26565460-D3FF-D0D6-C07D-1F260FA16CC8} - (no file)
O2 - BHO: (no name) - {32EDCCFD-DAC9-D83E-5DB1-6CB6E0DCD071} - (no file)
O2 - BHO: (no name) - {407E35F0-F5FF-7693-C8CB-9147DC9626D2} - (no file)
O2 - BHO: (no name) - {46E12037-4A39-43D9-3B76-14AD3F253732} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5AC2A38B-A149-E35C-3148-F22B4B257669} - (no file)
O2 - BHO: (no name) - {66BC6227-B851-2929-8008-EE055DC63DBF} - (no file)
O2 - BHO: (no name) - {89E6AA46-56B1-1685-3746-E57CB3CFC36B} - (no file)
O2 - BHO: (no name) - {8EC3A4C0-28A4-8A9B-0541-C660D3D07E09} - (no file)
O2 - BHO: (no name) - {967871F3-038A-F72E-C5FF-CE710FAFDEA8} - (no file)
O2 - BHO: (no name) - {9DCAC14C-5AED-ADB0-13C7-BC0FD19AC9B5} - (no file)
O2 - BHO: (no name) - {AA3DBC87-F177-8D58-138B-069152EFDEAC} - (no file)
O2 - BHO: (no name) - {B30A7120-DF83-F544-F99D-F86F68F50C2F} - (no file)
O2 - BHO: (no name) - {BE2B01AC-C74F-FE86-69B1-C961A25C369C} - (no file)
O2 - BHO: (no name) - {D006F3DF-6883-5152-C428-17EFD3009EF0} - (no file)
O2 - BHO: (no name) - {D7C2CB9D-F607-600B-91D0-599679F9A88F} - (no file)
O2 - BHO: (no name) - {DF704C87-46E7-AE73-9934-657FBE2E1426} - (no file)
O2 - BHO: (no name) - {FA1487A3-BE0B-8C8F-EE8B-A7306DC4EB4E} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button

Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button

Support\eaclean.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program

Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [apiso32.exe] C:\WINDOWS\apiso32.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP -

C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -

http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) -

http://216.249.24.140/code/PWActiveXImgCtl.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} -
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program

Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil

Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil

Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil

Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. -

C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program

Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program

Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\System32\nvsvc32.exe
Post #23 last edited
Hello again mat2056.

It appears that Spybot's TeaTimer has restored many of the bad registry entries that have been removed. We'll need to clean its' "memory" so it will not continue to do so.

I'll need you to turn off TeaTimer once again to remove these entries. Open Spybot S&D in advanced mode, click Tools > Resident, and remove the check from "Resident Tea-Timer". Reboot after unchecking the entry.

Download ResetTeaTimer.bat. Double click the file to remove all entries set by TeaTimer.

Fix these lines with HijackThis:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

O2 - BHO: (no name) - {054F5E50-28A8-4816-3209-EFF9B61A1BEC} - (no file)
O2 - BHO: (no name) - {10F009D2-02C1-DA9A-40FD-0C116521EA7F} - (no file)
O2 - BHO: (no name) - {1C5FE92B-D6A5-2B56-D796-580344D5766A} - (no file)
O2 - BHO: (no name) - {213FF3C4-933A-5728-4344-750F1EBB3DD5} - (no file)
O2 - BHO: (no name) - {26565460-D3FF-D0D6-C07D-1F260FA16CC8} - (no file)
O2 - BHO: (no name) - {32EDCCFD-DAC9-D83E-5DB1-6CB6E0DCD071} - (no file)
O2 - BHO: (no name) - {407E35F0-F5FF-7693-C8CB-9147DC9626D2} - (no file)
O2 - BHO: (no name) - {46E12037-4A39-43D9-3B76-14AD3F253732} - (no file)
O2 - BHO: (no name) - {5AC2A38B-A149-E35C-3148-F22B4B257669} - (no file)
O2 - BHO: (no name) - {66BC6227-B851-2929-8008-EE055DC63DBF} - (no file)
O2 - BHO: (no name) - {89E6AA46-56B1-1685-3746-E57CB3CFC36B} - (no file)
O2 - BHO: (no name) - {8EC3A4C0-28A4-8A9B-0541-C660D3D07E09} - (no file)
O2 - BHO: (no name) - {967871F3-038A-F72E-C5FF-CE710FAFDEA8} - (no file)
O2 - BHO: (no name) - {9DCAC14C-5AED-ADB0-13C7-BC0FD19AC9B5} - (no file)
O2 - BHO: (no name) - {AA3DBC87-F177-8D58-138B-069152EFDEAC} - (no file)
O2 - BHO: (no name) - {B30A7120-DF83-F544-F99D-F86F68F50C2F} - (no file)
O2 - BHO: (no name) - {BE2B01AC-C74F-FE86-69B1-C961A25C369C} - (no file)
O2 - BHO: (no name) - {D006F3DF-6883-5152-C428-17EFD3009EF0} - (no file)
O2 - BHO: (no name) - {D7C2CB9D-F607-600B-91D0-599679F9A88F} - (no file)
O2 - BHO: (no name) - {DF704C87-46E7-AE73-9934-657FBE2E1426} - (no file)
O2 - BHO: (no name) - {FA1487A3-BE0B-8C8F-EE8B-A7306DC4EB4E} - (no file)

O4 - HKLM\..\RunOnce: [apiso32.exe] C:\WINDOWS\apiso32.exe

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
016 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} -


Scan again with Ewido to see if it finds anything new. Save the log when done.


Reboot once again and scan with HijackThis. Post the new log and the Ewido log as a reply to this thread.
Post #24
hello alsocom,
i'm glad you're back with me. :)
all went smooth except after shutting down teatime & running the reset batch file the apiso32.exe line did not appear in hijack for me to check it & fix.

does windows automatically add the "links" folder to "favorites" because that's back.

windows did not ask for the apiso32.exe file when i rebooted.

did you mean that any file with 0kb can be deleted or just certain ones?

sorry about all the questions, here's my logs:

Logfile of HijackThis v1.99.1
Scan saved at 6:33:33 AM, on 7/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\Compaq\EASYAC~1\EAUSBKBD.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 6:29:22 AM, 7/23/2005
+ Report-Checksum: FDCFAFA

+ Scan result:

HKU\S-1-5-21-1960408961-746137067-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF704C87-46E7-AE73-9934-657FBE2E1426} -> Spyware.CoolWebSearch : Cleaned with backup


::Report End
Post #25
That log is clean again. :)

does windows automatically add the "links" folder to "favorites" because that's back.

Yes, it does add it back. As long as it is empty or contains only links you've added to it, it is safe.

did you mean that any file with 0kb can be deleted or just certain ones?

Right click these files and check the properties. If they are not from a program you recognise or from Microsoft, remove them. They are most likely leftovers from the infection.

How many user accounts are on your computer? If more than one, post a log from each of them and be sure to label them so we can tell them apart.
Post #26
hi, there is only the administrator account & "mike" account…i always run on the "mike" account. if that's what you mean by more than one account, how do i do that…switch users? i'm glad the logs look clean. should i startup the "teatime" again…it seems my problems (apiso32.exe) come back when i keep that running. :scratch: i'm to afraid to even start up the IE…i'll just stick with the firefox. i'll go thru all the 0kb files….it'll take awhile. thanks, mike
Post #27
The administrator account will only be available in Safe Mode but is not necessary. Turn TeaTimer back on now. If it has any warning messages now, let me know right away. I need you to use Internet Explorer to make sure your computer is clean. If the infection is still present at all, it will still cause your computer problems regardless of using IE or not. Let me know how it goes for you.
Post #28
hi alsocom,
once again i don't know what to say except that you are definately "the man". :)
all looks good. i even used my IE & imported my favorites back in. i think i'll still keep firefox as my default until "uncle bill" improves security on IE. :rant2:
i don't have anymore apiso32.exe issues.
i'm still a little leary of the teatimer but i will leave it running as you suggested. :unsure:
as far as my 0kb files, is this a problem if i just leave them alone or should i start getting rid of them…i rather not mess with them if you don't feel that it could be a problem in the making.
i thought i might post my last (hopefully) hijack log.

thanks alot & i owe you a beer. :thumbup:

Logfile of HijackThis v1.99.1
Scan saved at 5:00:39 AM, on 7/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\Compaq\EASYAC~1\EAUSBKBD.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nbc30.com/index.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Post #29
Log is still clean. :thumbup: The problem with TeaTimer should not occur now as we refreshed it to 'as new' status. I also use Firefox most of the time as it is 'safer' because most hackers/malware writers try to exploit Internet Explorer. The 0kb files will be fine if left alone. I'll leave this thread open a few more days in case any more questions/problems arise.
Post #30
hi alsocom, all is still good. :D just two quick questions: 1- was the "network security service" a bogus service that the virus created & stuck the "apiso32.exe" in it? i'm only asking because the service is gone completely from way back when we started the fix the first time. 2- occasionally i'll get the windows security red shield popup in my startup section of the task bar (right side) with a balloon saying that my computer is at risk because it's not firewalled….i never click on the balloon, i just "x" it closed or it will go away in 3 or 4 seconds. i went to my network places & i am firewalled. i hope this is not residue from the virus trying to get me to open the balloon & let something in……….am i getting too paranoid? :unsure: thanks again. mike

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI