What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

help please !

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Here is my hijack this log. I would be grateful for your help in dealing with it

Logfile of HijackThis v1.99.1
Scan saved at 09:39:38, on 25/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
E:\Program Files\AVPersonal\AVGNT.EXE
E:\WINDOWS\system32\ievn.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Program Files\22M WLAN Adapter\WLANMON.exe
E:\WINDOWS\system32\sysna32.exe
E:\Program Files\AVPersonal\AVGUARD.EXE
E:\WINDOWS\system32\atievxx.exe
E:\Program Files\AVPersonal\AVWUPSRV.EXE
E:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
E:\WINDOWS\system32\wdfmgr.exe
E:\Program Files\RealVNC\VNC4\WinVNC4.exe
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\System32\alg.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {714795AE-B851-C38C-644A-A0910EFC29CE} - E:\WINDOWS\system32\apirf32.dll (file missing)
O2 - BHO: Class - {BFBE0DA2-48E9-A396-3A21-50CC092AA4C1} - E:\WINDOWS\system32\d3vq.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpySweeper] "E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [AVGCtrl] "E:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [ievn.exe] E:\WINDOWS\system32\ievn.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: 22M WLAN Adapter.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - E:\WINDOWS\system32\sysna32.exe
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - E:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - E:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - E:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - E:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

Thanks
Post #2
Hello jonno, Welcome to the forum.

This is what I suggest you do.



Please do not delete anything unless instructed to.



Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #3
Thanks for the advice but …. I ran the eTrend scanner, switched off and tried to boot up. The computer will not get any further than the opening screen now - the one with the flag and the progress rectangle. I have switched off and tried starting in safe mode but that stops in the process of loading drivers, with a screenful of driver addresses. What next ? Jonno
Post #5
So far as I can see it was just from the scanner program. Trying last known good I get the same freezing of the screen - flag and rectangular box with no action Jonno
Post #6
This is the last resort. You'll need your windows XP CD top make this work.
You'll lose the "My Documents" folder and everything in it. There may be other Folders, etc., that will be over wriiten.


to fix the problem without losing your most important data:——–

you may repair windows xp by reinstalling main files. the way to do this is using your xp cd and when the chocies appear hit enter to install windows. "DO NOT TYPE R TO GO TO LOAD THE RECOVERY CONSOLE" you will then accept the agreement and then it will ask you
Select the XP installation you want to repair from the list and press R to start the repair.

windows will then erase and copy new files to the hard drive. the computer will later boot and when it asks you if you want to boot from the cd dont hit anything just let windows run and theN setup should keep working.
Post #7
Thanks for your help but I have had to reinstall windows on a new partition - just as well I have all my important data on a separate partition !
Post #8 last edited
Great job :thumbup:

You're more then welcome.
Glad we were able to help

Peace be with you :wavey:


If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #9
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI