What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Please!

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

Please go HERE and do a online scan.
Let me know what is found.

After scan, reboot and post a new HijackThis log

Also let me know how the computer is running now.
Post #17 last edited
I tried to scan with this the other day, but couldn't. I can't today either. I think my ie (ihave 5) needed to be updated and when I tried I couldn't. I was able to scan with panda and it found something (trojan) like AVG is finding, but it didn't clean it. There are now 25 trojans in the AVG virus vault from the past two days. I can't print and I can't install spybot (my old one wasn't working right so I downloaded a new one and I can't complete the installation.) among other problems.
Post #18 last edited
Hi Jenney -

Okay. Do the following and you will be able to run SDFix in Safe Mode. Read the instructions first so you have an idea of what you will be doing. Make sure that you have the instructions for running SDFix.zip handy.

Step 1
• While you are in Normal Mode, I want you to make a new folder on your C:\ drive.
- Double-click onto My Computer (or go to Start -> click My Computer if the icon is not on your Desktop)
- Double-click the C: drive icon
- Click File -> New -> Folder -> hit Enter
- You will have a new folder called "New Folder"

Step 2
• Now, you are going to move SDFix.zip to your newly-created folder.
- On your desktop, right-click onto the SDFix.zip file and select Cut
- Double-click onto My Computer (or go to Start > click My Computer if the icon is not on your Desktop)
- Double-click the C: drive icon
- Go to C:\New Folder and double-click onto New Folder.
- Inside of the folder and anywhere in the white space, right-click and select Paste.
- You have now moved the file to C:\New Folder

Write the following down because you will be in Safe Mode.

Step 3
• Reboot into Safe Mode and log onto the account named Administrator

Step 4
• Now, you are going to move SDFix.zip to your Desktop.
- Double-click onto My Computer (or go to Start -> click My Computer if the icon is not on your Desktop)
- Double-click the C: drive icon
- Go to C:\New Folder and double-click onto New Folder
- Inside of the folder, right-click onto SDFix.zip and select Cut
- Return to your Desktop
- Anywhere on a blank space on your Desktop, right-click and select Paste
- You have now moved SDFix.zip to your Desktop.

Step 5
• Follow the instructions for running SDFix.zip
Post #19
Here are the reports:

(I keep getting the following box popping up : " 16 bit MS-DOS Subsystem C:\ctps.exe The NTVDM CPU has encountered an illegal instruction. CS: 052c IP: 019b OP: 65 63 75 72 65 Chose close to terminate the application" I've been getting that for a couple of days, but now it keeps popping up.


SDFix: Version 1.21
————————-

Scan Time / Date: 17:52:28.56 / Sun 09/10/2006


Microsoft Windows XP [Version 5.1.2600]

Running from: C:\Documents and Settings\[removed]\Desktop\SDFix\SDFix


Stage One…


Checking Services…

Service Name:
——————

SpoolSvc224

File Path:
————

C:\WINDOWS\system32\cjnr4r4ixncsixn.exe "test2" /service

Removing Services:
————————

SpoolSvc224 … deleted


Repairing Registry…


Restoring Default Hosts File…

Stage One Complete

Rebooting!

Stage Two…

Registry Cleaning Finished…

Checking For Malware Files:
———————————-

C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\4QVVQKBO\DTEST1~1.EXE
C:\NTP.EXE
C:\WINDOWS\Prefetch\CJNR4R4IXNCSIXN.EXE-06386E02.pf
C:\WINDOWS\SYSTEM32\cjnr4r4ixncsixn.exe
C:\WINDOWS\SYSTEM32\cjnr4r4rgvlaqgw.exe
C:\WINDOWS\SYSTEM32\cjnr4r4vlbrh.exe
C:\WINDOWS\Temp\cjnr4r4D055A781.tmp
C:\WINDOWS\Prefetch\SKLRR7YGVLAQG.EXE-0EEF05B6.pf
C:\WINDOWS\Prefetch\SKLRR7YPEUJZPEUK.EXE-268510CE.pf
C:\WINDOWS\Prefetch\SKLRR7YVKAPFV.EXE-0393AD01.pf
C:\WINDOWS\Prefetch\SKLRR7YWKAPFVLB.EXE-2038E3C9.pf
C:\WINDOWS\Prefetch\SKLRR7YWKAQFVLBR.EXE-119580B6.pf
C:\WINDOWS\SYSTEM32\sklrr7ybqgxneul.exe
C:\WINDOWS\SYSTEM32\sklrr7ycqgw.exe
C:\WINDOWS\SYSTEM32\sklrr7ygvlaqg.exe
C:\WINDOWS\SYSTEM32\sklrr7ylapfvkaqgw.exe
C:\WINDOWS\SYSTEM32\sklrr7ypeujzpeuk.exe
C:\WINDOWS\SYSTEM32\sklrr7yvkapfv.exe
C:\WINDOWS\SYSTEM32\sklrr7ywkapfvlb.exe
C:\WINDOWS\SYSTEM32\sklrr7ywkaqfvlbr.exe
C:\WINDOWS\Prefetch\MLSDF8HNBRHWMCSIY.EXE-05F23721.pf
C:\WINDOWS\SYSTEM32\mlsdf8hnbrhwmcsiy.exe
C:\WINDOWS\SYSTEM32\mlsdf8hocshx.exe
C:\WINDOWS\SYSTEM32\mlsdf8hpetjyoe.exe
C:\WINDOWS\SYSTEM32\mlsdf8hzoetjz.exe
C:\WINDOWS\Prefetch\NLKFEV7304312.EXE-35C3DE6B.pf
C:\WINDOWS\Prefetch\NLKFEV7OCSIXNDT.EXE-3B2AD44E.pf
C:\WINDOWS\Prefetch\NLKFEV7TIYNDSI.EXE-2FA565CF.pf
C:\WINDOWS\SYSTEM32\nlkfev7mbqgwlbrh.exe
C:\WINDOWS\SYSTEM32\nlkfev7ocsixndt.exe
C:\WINDOWS\SYSTEM32\nlkfev7tiyndsi.exe
C:\WINDOWS\Temp\nlkfev7304312.exe
C:\WINDOWS\Temp\nlkfev7CD50B481.tmp
C:\WINDOWS\Temp\nlkfev7CD50B483.tmp
C:\WINDOWS\Prefetch\DIOR4F4FTJYOEUKA.EXE-102A2A6C.pf
C:\WINDOWS\Prefetch\DIOR4F4OEUKA.EXE-186FA7FF.pf
C:\WINDOWS\Prefetch\DIOR4F4VKZP.EXE-35EA94B5.pf
C:\WINDOWS\Prefetch\DIOR4F4WKAPFVLBRH.EXE-27093400.pf
C:\WINDOWS\SYSTEM32\dior4f4ftjyoeuka.exe
C:\WINDOWS\SYSTEM32\dior4f4oeuka.exe
C:\WINDOWS\SYSTEM32\dior4f4shwmcrhxnd.exe
C:\WINDOWS\SYSTEM32\dior4f4vkzp.exe
C:\WINDOWS\SYSTEM32\dior4f4wkapfvlbrh.exe
C:\WINDOWS\SYSTEM32\dior4f4xmbr.exe

Backing Up and Removing any Files Found…

Final Check:

Remaining Services:
————————


Remaining Files:
——————-

FINISHED






Logfile of HijackThis v1.99.1
Scan saved at 7:27:19 PM, on 9/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ntps.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\System32\InetCntrl\PopupKil\BsafeBHO.dll
O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\System32\InetCntrl\PopupKil\BsafeBHO.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: M-W Link to Collegiate® Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O10 - Broken Internet access because of LSP provider 'inetcntrl0002.dll' missing
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1135889238968
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154923086875
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F76DF680-EC17-4272-B1C7-CDB2641FA20B} (KB836528 Object) - http://microsoft.com/security/controls/DoomChk.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft Net API (NETAPI) - Unknown owner - C:\WINDOWS\system32\ntps.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
Post #20
Hi,

Well, things are starting to look better. Please do the following. You will have to print or copy these instructions because you again will be working in Safe Mode.

• Go to Start > Run and type or copy/paste: sc delete Microsoft Net API > click OK
- Again, go to Start > Run and type or copy/paste: sc delete NETAPI > click OK

• Please set your system to show all files.
- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab. Under the Hidden files and folders heading, select Show hidden files
and folders.
- Uncheck: Hide file extensions for known file types
- Uncheck the Hide protected operating system files (recommended) option.
- Click Yes to confirm.
- Click OK.

• Download and install Ewido Anti-Spyware v4.0
1. After download, double click on the file to launch the install process.
2. Choose a language, click "OK" and then click "Next".
3. Read the "License Agreement" and click "I Agree".
4. Accept default installation path: C:\Program Files\ewido anti-spyware 4.0, click "Next", then click "Install".
5. After setup completes, click "Finish" to start the program automatically or launch ewido by double-clicking its icon on your desktop or in the system tray.
6. The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.
7. Then right click on ewdio in the system tray and uncheck "Start with Windows".
8. Go to Start > Run and type: services.msc
  • Press "OK".
  • Click the "Extended tab" and scroll down the list to find ewido anti-spyware 4.0 guard.
  • When you find the guard service, double-click on it.
  • In the Properties Window > General Tab that opens, click the "Stop" button.
  • From the drop-down menu next to "Startup Type", click on "Manual".
  • Now click "Apply", then "OK" and close the Services window.
9. Select the "Update" button and click "Start update". If you are having problems with the updater, manually update with the Ewido Full database installer from here. Exit Ewido when done.
Do NOT perform a scan yet.

• Download LSPfix and save it to your Desktop.
1. Disconnect from the Internet. Go to the LSPFix file and extract/unzip LSPFix.zip into its own folder C:\Lspfix.
Read here how to unzip/extract properly:
http://metallica.geekstogo.com/xpcompressedexplanation.html
2. Open the Lspfix folder and double-click on LSPFix.exe to start the program.
3. Check the "I know what I am doing" checkbox.
4. Select (highlight) all instances of inetcntrl0002.dll in the left column under "Keep".
5. Click the arrows >> so that the file goes over to the right column under "Remove".
6. Click "Finish" and LSPFix will remove references to the file and restore the chain numbers.

• Reboot your computer into Safe Mode.

• Start HijackThis, click System Scan Only and place a checkmark next to the following items:
O23 - Service: Microsoft Net API (NETAPI) - Unknown owner - C:\WINDOWS\system32\ntps.exe

Close ALL browsers and open windows/programs except HijackThis and click 'Fix Checked'. Exit Hijackthis.

• Navigate to and delete the following files if present:
C:\ctps.exe
C:\WINDOWS\system32\ntps.exe

• Reboot into SAFE MODE.
To get into the Windows XP Safe Mode, restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.

• Clean out your Temporary Internet files. Proceed like this:
  • Close ALL browsers and open windows / programs.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin

Scan with Ewido as follows:
1. Launch Ewido, click on the "Scanner" button and choose the "Settings" tab.
  • Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
  • Under "How to Scan?" check all (default).
  • Under "Possibly unwanted software" check all (default).
  • Under "What to Scan?" make sure "Scan every file" is selected (default).
  • Under "Reports" select "Automatically generate report after every scan and UNcheck "Only if threats were found".
2. Click the "Scan" tab to return to scanning options.
3. Click "Complete System Scan" to start.
4. When the scan has finished you will be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

5. Click on "Save Report" to view all completed scans. Click on the most recent scan you just performed and select "Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\ewido anti-spyware 4.0\Reports\
6. Exit Ewido when done and submit the log report in your next response.

Note: Close all open windows, programs, and DO NOT USE the computer while Ewido is scanning. If Explorer or other programs are open during the scan that means certain files will also be in use. Some malware will insert itself and hide in areas that are "protected" by Windows when the files are being used. This can hamper Ewido's ability to clean properly and may result in reinfection.

Note: If Ewido "crashes" or "hangs" during the scan, try scanning again by doing this:
1. Scan one sector of the system at a time by using the "Custom Scan" feature. To do this select Scanner > Custom Scan and click on Add drive/directory/file. Browse to C:\Windows > System, add this folder to the list and click on "Start Scan". When the scan is complete, repeat the Custom Scan but this time, browse to and add the System32 folder. Then keep repeating this procedure until all your folders have been scanned. Make sure you include the Documents & Settings folder.
2. If this still does not help, then turn the ADS scanner off while making a Custom Scan. To do this select Scanner > Scan Settings and untick "Scan in NTFS Alternate Data Streams". Then repeat the steps above for performing a Custom Scan.

• Reboot into Normal Mode.

• Post back with the results of the ewido scan and a new HijackThis log.
Post #21 last edited
Hi, Is the lsp fix for the broken internet access(010)? because that is a legitimate entry used my my internet filter. Thanks again.
Post #22
Also per your instructions on Ewido - when I run the "services.msc" there's nothing in the "extended" tab, but there is a list on the "standard " tab. Do I use that one? Thanks
Post #23
Hi Jenney - To answer your questions: 1. LSPFix fixes broken chains in the layered service providers protocol. You can leave it alone for the time being. It is possible that this is a quirk of BSafe's filtering processs. I'll try and find out more about it. 2. When you run "services.msc" - yes, use the Standard tab.
Post #24 last edited
Hi

Here's a new HJT log. All ewido found was a tracking cookie. I tried to follow your instructions exactly as far as ewido (like "apply all actions before saving the file - I'm not sure what happened) Here's the report. I had a little trouble because in safe mode the page/type was bigger than the screen and I wasn't able to verify all the boxes were checked. I did the best I could. Also I couldn't remove those files from HJT in safe mode because they weren't there ( C:\ctps.exe
C:\WINDOWS\system32\ntps.exe)

Now Adaware and AVG are acting strange - they're indicating my definitiona are old and need updating, but they aren't and when I check for updates they say no updates available. This started after I downloaded Ewido.

Can you figure out why I can't print from the internet or outlook?

One last question- can I remove ewido from add/remove? and do I need to go back and re-do the things I undid for the scans - like show hidden files, etc?

One more thing I forgot to mention - ever since I did all that in safe mode, I can't update avg



Thanks.




Logfile of HijackThis v1.99.1
Scan saved at 11:32:53 AM, on 10/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\System32\InetCntrl\PopupKil\BsafeBHO.dll
O3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\System32\InetCntrl\PopupKil\BsafeBHO.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: M-W Link to Collegiate® Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O10 - Broken Internet access because of LSP provider 'inetcntrl0002.dll' missing
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1135889238968
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154923086875
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F76DF680-EC17-4272-B1C7-CDB2641FA20B} (KB836528 Object) - http://microsoft.com/security/controls/DoomChk.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)



ewido anti-spyware - Scan Report
———————————————————

+ Created at: 11:24:16 AM 10/11/2006

+ Scan result:



C:\Documents and Settings\MOMDAD\Cookies\momdad@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).


::Report end
Post #25 last edited
Nevermind about the adaware and AVG… I see today's date was changed. When I changed it back that was fine. Just thought I'd add that I'm doing an AVG scan right now and so far it's found 14 trojans (generic backdoor)
Post #26
Hi, You had a very nasty infection called HackerDefender which is why it was important to run SDFix which is the only tool that really cleans the infection. You can review the log from SDFix to see how many infected files were on your system. There were also bad registry keys created by HackerDefender which were deleted. You did fine in setting up ewido. You can uninstall the program through Add/Remove Programs in the Control Panel. It is a 30-day trial program which means that it will automatically update for 30 days, and the "guard" component will remain active for that time period. After 30 days has lapsed and you don't purchase it, you will have to manually update it. The guard component will also cease to be active. I suggest that you keep it, and manually update it after the 30 days and periodically perform a scan with it. The program has a very good reputation. Please post back and let me know how is your computer running now.
Post #27 last edited
I just can't thank you enough, waterfalls. It seems much better. The only problems are still that since I've had that problem, I can't print from a website or from outlook express anymore. Also, when I'm on a particular website and it has a link or button to click on, it doesn't "work" I just stay at that site. I don't know if that makes sense. Aside from those issues, that pop up box is gone and nothing "new" seems to be appearing. I appreciate all the time you've spent helping me. Oh, I forgot - should I re"hide" those hidden files?
Post #28
Hi Jenney -

You're quite welcome. Your log looks clean now.

Regarding the problems with your printer and links not working, I would suggest that you contact Hewlard-Packard's tech support concerning your printer, or you can post both of your problems in the Other Computer Problems section.

• Please set your system to hide system files.
- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab. Under the Hidden files and folders heading, uncheck Show hidden files and folders.
- Check: Hide file extensions for known file types
- Check the Hide protected operating system files (recommended) option.
- Click Yes to confirm.
- Click OK.

• It appears that you have no software Firewall program present on your system. This will greatly help in preventing your system from being infected by malware. Please install a Firewall program.
Agnitum Outpost Free -or- Kerio are good FREE software Firewall programs.
See, Understanding and Using Firewalls

• If you have not done so, please empty your Recycle Bin.

• Create a new Restore Point:
- Go to Start -> All Programs -> Accessories -> System Tools -> System Restore.
- When the utility opens, select "Create a new restore point" and click Next
- Name the restore point - something like "After infection cleaned" or "After cleaning"
- Click Create.

• Delete the old Restore Points:
- Go to Start -> All Programs -> Accessories -> System Tools -> Disk Cleanup. Click Ok.
- Click the "More Options" tab.
- Where it states "System Restore" - click Clean up.
- All of the old Restore Points will be deleted EXCEPT for the one you just created.

Reboot your computer.

• To keep this clean in the future, I would suggest the following things:

• Install Spywareblaster. SpywareBlaster doesn't scan and clean for so-called spyware but prevents it from being installed in the first place. It blocks the popular spyware ActiveX controls and also prevents the installation of any of them via a webpage. Update it periodically.

• Download ATF Cleaner by Atribune and save to your desktop.
This program is for XP and Windows 2000 only
This is a good program for periodically cleaning your system. Instructions are here

* Avoid illegal sites because that's where most malware is present.
* Don't click on links inside pop-ups. Use ALT + F4 to close them.
* Don't click on links in spam messages claiming to offer anti-spyware software because most of these so-called removers ARE spyware.
* Download free software only from sites you know and trust because a lot of free software can bundle other software, including spyware.

• Let your anti-spyware scanner(s) scan frequently and don't forget to update before scanning.

• I suggest you perform an online virus-scan once in a while (Housecall and/or Bitdefender) because what one virus-scanner can't find, another one maybe can.
Also, make sure that your virus-scanner, the one that is already installed on your system, is always up to date!

• Make sure your Windows has the latest updates by going here.

• Consider switching to Mozilla Firefox.
This browser is considered to be far more secure than Internet Explorer and offers improved pop-up blocking. If you do decide to install Firefox, please read Switching from IE to Firefox.

• More information on how to prevent malware can be found at So how did I get infected in the first place? by Tony Klein.

Happy surfing again! :)
Post #29
waterfalls, I was going through your checklist and I got to the creating a new restore point, etc. and when I went to accessories->system tools->when I get to system restore page it's completely white so I don't know what to do. (The only reason I mentioned the printer issue I was having is because I think it was a direct result of the infection I had) Thanks, Jenney
Post #30
Hi Jenney -

See if this set of instructions help:

1. Click Start > All Programs > Accessories > System Tools.
2. Click System Restore.
3. In the Restore point description box, type a name to identify this restore point as seen below. System Restore automatically adds the date and time that this Restore Point is created.
[external image: Posted Image]
4. To finish creating this restore point, click Create.

Then follow the instructions for deleting old Restore Points, if any.

If you still have problems and/or still have problems with printing, you can post in the Other Computer Problems forum (see link above). This section is dedicated to removing malware.

Good luck and safe surfing! :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI