What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

help with new just starting problem

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello mac79,

I wish that I could see the results from the Silent Runners log. Is it because of losing connections on dial-up that you cannot post it or do you think it is another problem?

STEP 1.
======
Regscan

Please download RegScan.
Within RegScan.zip you will find the file regscan.vbs
You may have to allow this script to run or disable anti-spyware again in order for it to run.
A window will open titled RegFinder.vbs and you will see place to input search terms.
Please enter the search terms:
AD689BF6-A10B-4E80-AD7C-31A0C8B83692
After the search has completed a window titled Results.txt will open.
Please copy the results and post(reply) back.
Post #17 last edited
Windows Registry Editor Version 5.00 ; Regscan.vbs Version: 1.2 by rand1038 ; 8/2/2006 3:03:05 AM ; Search Term(s) Used: "ad689bf6-a10b-4e80-ad7c-31a0c8b83692" ; 9 matches were found. ; The search took 18 seconds. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters] "{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Dhcp\Parameters] "{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\Interfaces\Tcpip_{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters] "{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}] Susan —Great News we got something to work—Now for the bad news Iam on a vol fire dept and was up all last- night and most of today until around 6:00pm on a very bad Logging Yard and Saw-Mill fire with all that wood burning, it's still burning but we got it under control now.. est..way over 1 million dollar's of damage I own 1 third of that company 2 other friend's own the other part's and yes we had insurance..but i was running Trogan Hunter and other clean-up's and went to bed when I woke- up half a sleep Trogan hunter found If I remember right a trogan called Destany I think what it was called sorry I was half a sleep and didn't write it down and went back asleep. trogan hunter took it off Iam pretty sure i ran the program 2 more time's when I woke back up before I came back on-line…Sorry….I thought I wasted my money on Trogan Hunter but I was wrong it's coming in and paying for it's self in the last few week's
Post #18
Hello mac79, I know you have been busy. Sorry about the fire and I hope things are going as best as can be expected. I have not been able to be of much help because I have asked for scans and you are having difficulty posting them. Would you by any chance be able to use another computer to post the scans? I would really like to see the results from the mwav. It is one scan left which does not require you to be online during the scanning. Susan
Post #19
Logfile of HijackThis v1.99.1
Scan saved at 8:45:34 PM, on 8/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\zHotkey.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\KVINet\DiagTools.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Startup: Sparky's Toolbox.lnk = C:\Program Files\KVINet\DiagTools.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1151614890500
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}: NameServer = 146.82.208.3 146.82.208.2
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\IPSEC6.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32
Sorry I though I might slip through the crack's in your system It's been a long time from last contact…and I didn't want to start a new file or cause any trouble ..I saw this fixed problem on the finished page that looked like this was very near if not my same problem so i tryed this….It help for a while but still came's back to give me problem's …I think this guy helped with this other guy's problem was called Micha or close to his name ..He will leave you a prayer after he help's fix your system…Sorry I though I slip through the crack's or yourall forgot about me
Post #20
Your log shows no evidence of wareout. Please understand that it is difficult to help if you are unable to be on the internet long enough to download and run scans and post results. That is why I am asking if you may be able to use another computer to download tools, transfer it to your computer, use the tool, then transfer and post the results using another computer. Do you have access to another computer with a better internet connection?
Post #21 last edited
Sorry this is all i got for now…they say they going to put high speed broodband in this area but it be sometime late fall or winter before we can get it.. i be in heaven what take's youall 1 to 2 min's it take's me a half of a day to download,,,,,yes i completely understand the problem's you having trying to help me… iam down to the point we might have to give up for now until i can get better service i think if i do download anything it's get's corupt before i can complete long time downloading..
Post #24
Susan ,, Find a piece of wood and knock on it…After about 4 try's today I think that maybe fixed it….The speed of the computer has double …It's acting like it was when It was Brand New now….It will take I say a day or 2 to see if that old nasty thing show's up again……But so far so good Iam keeping my finger's crossed…..Thank's a lot for your time I know this had to be a nerve racking case….I try to post in a day or 2 and make sure we have got it…Thank you
Post #26
Logfile of HijackThis v1.99.1
Scan saved at 10:18:09 AM, on 8/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\zHotkey.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\KVINet\DiagTools.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Startup: Sparky's Toolbox.lnk = C:\Program Files\KVINet\DiagTools.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1151614890500
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD689BF6-A10B-4E80-AD7C-31A0C8B83692}: NameServer = 146.82.208.3 146.82.208.2
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

I must have no luck whatsoever….worked fine for maybe 1 to1 1/2 hour's then right back where we was to begin with…..I try to stay off it until I can hear from you or a blame ant will beat this computer's speed down to the telephone switching station….Iam to the point where Iam about ready to clean everything off this thing and completely reboot this computer by recovery disc and switch ISP to a other company and see if that help's…Susan I sure know you not to blame you been very helpfull to me But Iam to the point I can't use this computer hardly Iam paying monthly ISP bill, I got every safety product I can think of to protect it and still can't use it…Hey!!! This a idea I did have E-trust virus , spyware the whole package and it got where it was blocking so much I couldn't get on the internet hardly.. And my ISP made me take it off saying it was caused my problem not working with there system and told me to put on this free avast system on this computer and about 2 to 3 month's later I started having this problem.. Is it possiable this nasty little thing is working by there system and infection my system and maybe they too proud to tell us they have a problem that they can't fix????? I don't know anybody around here got this ISP server or i ask them..But I was thinking something had to cause that E-trust system to start blocking everything like it did because I didn't increase nothing on it then about in a period of 2 to 3 week's It just about locked my computer down to protect it from something???? a Idea of maybe the problem anyway..
Post #27
While I still got a little speed on this computer I tryed again to get you a MWAV download and scan but all i could get it on the download was 32kb out of 10MB and it just stoped in it's track's would not download no more..
Post #29
Test Results Summary Computer Name: YOUR-40EDBA5772 Date Tested: Wed Aug 16 17:02:06 EDT 2006 This system performs extremely well on our benchmarks and appears to be among the fastest systems available! See the information below for your system details and advice on how to tweak the hardware and software for best performance. This is your customized advice based on PC Pitstop's tests. Click on an item at left to find out what it means and what to do. Customized Tune-up Tips • Adjust IE browser cache size • Check disabled devices Configuration Summary: Our analysis was based on the data collected from this computer. A summary of the data collected is shown below. Click on any of the subsystem names or flags in the table below to see more information, or use the test details to see all the data on one page. For a list of programs running on your computer, including spyware, see the Windows details page. The test history page has a summary of previous tests for this configuration. See how your system compares to others we've tested. Subsystem Status Description System AMD Athlon 64 3200+, 2200 MHz Memory 895MB RAM Disk Drives C, D Video ATI RADEON Xpress 200 Series Internet MSIE 6.0; SV1; .NET CLR 1.1.4322 Windows Windows XP Home SP2 Security Compare Serious Problem Minor Problem A Winner! • Suggestion Your Score? Click Here View/change PC use and connection info Home | Our Legal Stuff | Privacy Policy | Press | Link to Us Testimonials | Support PC Pitstop | Printable Page WE got it to work ..There was a Yellow Flag up at my internet MSIE 6.0; SV1; .NET CLR 1.1.4322 site

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI