What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Please!

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
So sorry for posting again, but I didn't get a response from my one from the other day. I think I hurt my chances by adding to my own post. I think what ever I have is multiplying because usually my AVG scans are fine, but yesterday it picked up 5 backdoor trojans- generic 3 EKW. Today I had 11. I'm losing some use of things, like I can't print from the internet or outlook, etc… HEre's a new log: (010 is a legitimate entry)


Logfile of HijackThis v1.99.1
Scan saved at 12:16:42 PM, on 9/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ntps.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\mlsdf8hnbrhwmcsiy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\System32\InetCntrl\PopupKil\BsafeBHO.dll
O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\System32\InetCntrl\PopupKil\BsafeBHO.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: M-W Link to Collegiate® Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O10 - Broken Internet access because of LSP provider 'inetcntrl0002.dll' missing
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1135889238968
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154923086875
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F76DF680-EC17-4272-B1C7-CDB2641FA20B} (KB836528 Object) - http://microsoft.com/security/controls/DoomChk.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft Net API (NETAPI) - Unknown owner - C:\WINDOWS\system32\ntps.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Print Spooler Service (SpoolSvc224) - Unknown owner - C:\WINDOWS\system32\mlsdf8hnbrhwmcsiy.exe

Thanks!!!
Post #4
Hi,

Download SDFix and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
  • In Safe Mode, right click the SDFix.zip folder and choose Extract All,
  • Open the extracted folder and double click RunThis.bat to start the script.
  • Type Y to begin the script.
  • It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • Your system will take longer that normal to restart as the fixtool will be running and removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
  • Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt into your reply along with a new HijackThis log.
Post #5
Thanks so much for the help. I downloaded the sd fix, but I'm having problems in safe mode – only a few programs show on my desktop when I'm in safe mode and the sd fix is not there. When I click on all programs the type is so big that I can't see the entire list. So, unfortunately, that's as far as I've gotten.
Post #6
Hi, Let's say that your regular user account is named Jenney. Does the Jenney account have administrative privileges? If so, when you are in Safe Mode, select the Jenney account to log into. You will see the SDFix on your Desktop, and you can then follow the instructions above. By the way, the instructions inadvertently omitted advising you to print or copy them since you will be running SDFix in Safe Mode without an Internet connection.
Post #7
I am logging in as the administrator, but there ae only a handful of desktop icons that appear and sdfix isn't there. (it is showing in regular mode) Also, right now I'm unable to print anything, so I have to hand copy instructions Thanks!
Post #8
Double Click "My Computer" >Double Click Local Disk C:> Double Click Documents and Settings> Double Click (Your user name Jenny)> Double Click Desktop> see if sdfix is there.
Post #10
Hi Jenney - I understand how these things can be confusing. I'm very glad that you are askjng questions before proceeding. It is always the wise thing to do. LDTate's directions confirmed that SDFix is on the Desktop of your regular user account, the one that you regularly use and the one that you were on when you ran HijackThis and posted the log here. I am calling that user account "Jenney" in case you named your account with your real name. This way, calling it "Jenney" preserves your privacy. It sounds like you have Windows XP Home - is that correct? Also, when you log into Safe Mode, what accounts are listed on the screen for you to select?
Post #11
Yes, I use XP and sdfix is there on my regular user account. In safe mode can I access the sdfix using the way LDTate had mentioned? There are 2 accounts listed when I log into safe mode - Administrator (me) and one other (normally there are six) . How should I proceed, since it's getting worse?
Post #12

In safe mode can I access the sdfix using the way LDTate had mentioned? How should I proceed, since it's getting worse?


Yes, access the sdfix the way LDTate mentioned and run the fix. Make sure you've copied the instructions so you can follow them while in Safe Mode.
Post #14
Hi Jenney - Okay, take a deep breath. Write the following down for reference when you log into Safe Mode. You said that there are two accounts showing when you boot into Safe Mode. One of the two accounts should have SDFix on the Desktop. When you log into Safe Mode, start with the top account that is listed. If SDFix is on the desktop, run it following the instructions in the post above. If SDFix is not on the desktop in that account, try searching for it. Click Start > Search > All files and folders. On the top line, type SDFix.zip - if found, then run it following the instructions in the post above. If the file is not located, then click Start > click Log Off. That will bring you back to the screen with the names of the accounts. Select the second account. SDFix should be on the desktop and, if it is, run it following the instructions in the post above. If it is not, do a search for it as described in the above paragraph. If found, then run it following the instructions in the post above. If you do not see it or locate it on either account, let me know. I will post instructions so that we will be assured that it will be on the Desktop so you can run it.
Post #15 last edited
Thanks for your help and patience, waterfalls. I can't locate it on either account in safe mode. I couldn't search - there was nowhere to type the file name. but I did try to "run" it and it said it couldn't locate the file… but it definitely IS on my desktop in "regular" mode. Every time I reboot, it detects more trojans (or the same ones) Jenney Could I run the sdfix not in safe mode?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI