What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

something nasty on computer and it wont go

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
please help. my daughter opened a file sent from someone while talking on messenger. now cannot open internet explorer and my server which is karoo have sent me a letter informing me of either mass mailing virus on computer or misconfigured mail server. have avast and avg and scanned thoroughly and neither pick up any problems. have ran hijack this and this is the log file.Logfile of HijackThis v1.99.1
Scan saved at 11:58:41, on 18/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM305_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sue\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = www.karoo.co.uk
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\mrwpnhdt.dll",setvm
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\TDK Systems\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168962278718
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145621555045
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C63E137-BBBB-428D-813A-866D18846D37}: NameServer = 212.50.160.100 213.249.130.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C63E137-BBBB-428D-813A-866D18846D37}: NameServer = 212.50.160.100 213.249.130.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
Post #4
right sorted what u meant and here is the new log. have done another spyware scan and cleaned up quite a bit but net stiLogfile of HijackThis v1.99.1
Scan saved at 11:59:50, on 19/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM305_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sue\Desktop\hjt.exe.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = www.karoo.co.uk
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\aljncalj.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {E3D5EC0A-F00A-492E-A892-8E0DC432FDBA} - C:\WINDOWS\ndsbd.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\mrwpnhdt.dll",setvm
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\TDK Systems\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168962278718
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145621555045
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C63E137-BBBB-428D-813A-866D18846D37}: NameServer = 212.50.160.100 213.249.130.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: ndsbd - C:\WINDOWS\ndsbd.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

ll crashing saying about generic host proces for win 32.
Post #5
Hi

Yes, you did it right :)

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.
Post #6
thanks for your quick reply by the way much appreciated :D have done what you said and below all details requested. have to be quick cos net keeps crashing.VundoFix V6.3.2

Checking Java version…

Java version is 1.5.0.4

Scan started at 18:53:38 19/01/2007

Listing files found while scanning….

C:\WINDOWS\dbsdn.bak2
C:\WINDOWS\dbsdn.ini
C:\WINDOWS\dbsdn.ini2
C:\WINDOWS\dbsdn.tmp
C:\WINDOWS\ndsbd.dll
C:\WINDOWS\system32\aljncalj.dll
C:\WINDOWS\system32\esmtrglh.dll
C:\WINDOWS\system32\fqajjmll.ini
C:\WINDOWS\system32\gxnmwxsv.dll
C:\WINDOWS\system32\imdmdcwv.exe
C:\WINDOWS\system32\jlxvmkgv.dll
C:\WINDOWS\system32\kstjdgcp.dll
C:\WINDOWS\system32\llmjjaqf.dll
C:\WINDOWS\system32\mrwpnhdt.dll
C:\WINDOWS\system32\occnyaiq.dll
C:\WINDOWS\system32\opnkhhi.dll
C:\WINDOWS\system32\ssqppnn.dll
C:\WINDOWS\system32\tdhnpwrm.ini
C:\WINDOWS\system32\terlcvvf.dll
C:\WINDOWS\system32\vgkmvxlj.ini
C:\WINDOWS\system32\vsxwmnxg.ini
C:\WINDOWS\system32\xxywxxy.dll

Beginning removal…

Attempting to delete C:\WINDOWS\dbsdn.bak2
C:\WINDOWS\dbsdn.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\dbsdn.ini
C:\WINDOWS\dbsdn.ini Has been deleted!

Attempting to delete C:\WINDOWS\dbsdn.ini2
C:\WINDOWS\dbsdn.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\dbsdn.tmp
C:\WINDOWS\dbsdn.tmp Has been deleted!

Attempting to delete C:\WINDOWS\ndsbd.dll
C:\WINDOWS\ndsbd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\aljncalj.dll
C:\WINDOWS\system32\aljncalj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\esmtrglh.dll
C:\WINDOWS\system32\esmtrglh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fqajjmll.ini
C:\WINDOWS\system32\fqajjmll.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gxnmwxsv.dll
C:\WINDOWS\system32\gxnmwxsv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\imdmdcwv.exe
C:\WINDOWS\system32\imdmdcwv.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\jlxvmkgv.dll
C:\WINDOWS\system32\jlxvmkgv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kstjdgcp.dll
C:\WINDOWS\system32\kstjdgcp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\llmjjaqf.dll
C:\WINDOWS\system32\llmjjaqf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mrwpnhdt.dll
C:\WINDOWS\system32\mrwpnhdt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\occnyaiq.dll
C:\WINDOWS\system32\occnyaiq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\opnkhhi.dll
C:\WINDOWS\system32\opnkhhi.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqppnn.dll
C:\WINDOWS\system32\ssqppnn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tdhnpwrm.ini
C:\WINDOWS\system32\tdhnpwrm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\terlcvvf.dll
C:\WINDOWS\system32\terlcvvf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vgkmvxlj.ini
C:\WINDOWS\system32\vgkmvxlj.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\vsxwmnxg.ini
C:\WINDOWS\system32\vsxwmnxg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxywxxy.dll
C:\WINDOWS\system32\xxywxxy.dll Has been deleted!

Performing Repairs to the registry.
Done!
Logfile of HijackThis v1.99.1
Scan saved at 19:22:32, on 19/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM305_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sue\Desktop\hjt.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = www.karoo.co.uk
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {7002EE4E-7D61-4DE0-B373-357329DFFFB4} - C:\WINDOWS\ndsbd.dll (file missing)
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\aljncalj.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168962278718
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145621555045
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C63E137-BBBB-428D-813A-866D18846D37}: NameServer = 212.50.160.100 213.249.130.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

think have done as you asked. am at wits end with machine ha ha
Post #7
Hi

Looking better :thumbup:

Open HijackThis, click do a system scan only and checkmark these:

O2 - BHO: (no name) - {7002EE4E-7D61-4DE0-B373-357329DFFFB4} - C:\WINDOWS\ndsbd.dll (file missing)
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\aljncalj.dll (file missing)

Close all windows including browser and press fix checked.

Reboot

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:

    o Scan using the following Anti-Virus database:

    + Extended (If available otherwise Standard)

    o Scan Options:

    + Scan Archives
    + Scan Mail Bases

  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Send:

- a fresh HijackThis log
- kaspersky report
Post #8
hi there. sorry been so long took ages to scan then wouldnt save any way here is what u asked for. once agLogfile of HijackThis v1.99.1
Scan saved at 18:22:30, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM305_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\PROGRA~1\MSNMES~1\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Sue\Desktop\hjt.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = www.karoo.co.uk
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168962278718
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145621555045
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C63E137-BBBB-428D-813A-866D18846D37}: NameServer = 212.50.160.100 213.249.130.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C63E137-BBBB-428D-813A-866D18846D37}: NameServer = 212.50.160.100 213.249.130.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
ain thank you for your help KASPERSKY ONLINE SCANNER REPORT
Saturday, January 20, 2007 6:21:36 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 20/01/2007
Kaspersky Anti-Virus database records: 260385
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 139629
Number of viruses found: 14
Number of infected objects: 70 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:42:12

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\call256.dbb Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\chat512.dbb Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\contactgroup256.dbb Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\index2.dat Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\profile16384.dbb Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\user1024.dbb Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\user16384.dbb Object is locked skipped
C:\Documents and Settings\Sue\Application Data\Skype\dippydora1\voicemail256.dbb Object is locked skipped
C:\Documents and Settings\Sue\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Logs\Dfsr.log Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_A0C8_5FAC_C85F_8008\dfsr.db Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_A0C8_5FAC_C85F_8008\fsr.log Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_A0C8_5FAC_C85F_8008\fsrtmp.log Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_A0C8_5FAC_C85F_8008\tmp.edb Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\real\members.stg Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\History\History.IE5\MSHist012007012020070121\index.dat Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Temp\msn2440.fdr Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Temp\Perflib_Perfdata_134.dat Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Temp\~DF3B56.tmp Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Temp\~DF3B93.tmp Object is locked skipped
C:\Documents and Settings\Sue\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe/WISE0023.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe/WISE0023.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe/WISE0023.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped
C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe/WISE0027.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe WiseSFX: infected - 4 skipped
C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe WiseSFX Dropper: infected - 4 skipped
C:\Documents and Settings\Sue\My Documents\prisms.exe/Stream/data0002 Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped
C:\Documents and Settings\Sue\My Documents\prisms.exe/Stream Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped
C:\Documents and Settings\Sue\My Documents\prisms.exe Inno: infected - 2 skipped
C:\Documents and Settings\Sue\ntuser.dat Object is locked skipped
C:\Documents and Settings\Sue\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Sue\UserData\index.dat Object is locked skipped
C:\neroV2.exe/aecxzr.as Infected: Backdoor.IRC.Zapchast skipped
C:\neroV2.exe/Nerov2.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 skipped
C:\neroV2.exe/secuey.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\neroV2.exe Instyler: infected - 3 skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\MSN\MSNCoreFiles\market.mar Object is locked skipped
C:\Program Files\MSN\MSNCoreFiles\market16.mar Object is locked skipped
C:\Program Files\MSN\MSNCoreFiles\themedef16.mar Object is locked skipped
C:\Program Files\MSN\MSNCoreFiles\ui.mar Object is locked skipped
C:\Rgell.exe/astecx.as Infected: Backdoor.IRC.Zapchast skipped
C:\Rgell.exe/securaq.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\Rgell.exe/tskgel.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 skipped
C:\Rgell.exe Instyler: infected - 3 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP10\A0015709.exe Infected: Trojan-Clicker.Win32.Costrat.ae skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP14\A0018662.exe Infected: Trojan-Clicker.Win32.Costrat.ae skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP16\A0025026.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP16\A0025026.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP16\A0025026.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP16\A0025031.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029095.dll Infected: Trojan.Win32.BHO.g skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029096.dll Infected: Trojan-Spy.Win32.VBStat.j skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029098.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029099.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029100.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029101.dll Infected: Trojan-Spy.Win32.VBStat.j skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029102.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029103.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029104.dll Infected: Trojan-Spy.Win32.VBStat.j skipped
C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\change.log Object is locked skipped
C:\Ver47.exe/aecxzr.as Infected: Backdoor.IRC.Zapchast skipped
C:\Ver47.exe/SeCuEy.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\Ver47.exe/WiNRaR.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 skipped
C:\Ver47.exe Instyler: infected - 3 skipped
C:\Ver7.exe/aecxzr.as Infected: Backdoor.IRC.Zapchast skipped
C:\Ver7.exe/SeCuEy.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\Ver7.exe/WiNRaR.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 skipped
C:\Ver7.exe Instyler: infected - 3 skipped
C:\VundoFix Backups\aljncalj.dll.bad Infected: Trojan.Win32.BHO.g skipped
C:\VundoFix Backups\esmtrglh.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped
C:\VundoFix Backups\gxnmwxsv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\VundoFix Backups\imdmdcwv.exe.bad Infected: not-a-virus:AdWare.Win32.Agent.at skipped
C:\VundoFix Backups\jlxvmkgv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\VundoFix Backups\kstjdgcp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped
C:\VundoFix Backups\llmjjaqf.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\VundoFix Backups\mrwpnhdt.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\VundoFix Backups\occnyaiq.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{A4F84B1C-792E-425A-BA25-0204EECBED82}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\aecxzr.as Infected: Backdoor.IRC.Zapchast skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1EV45UJ\gell[1].exe/astecx.as Infected: Backdoor.IRC.Zapchast skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1EV45UJ\gell[1].exe/securaq.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1EV45UJ\gell[1].exe/tskgel.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1EV45UJ\gell[1].exe Instyler: infected - 3 skipped
C:\WINDOWS\system32\eqvafbjl.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\fwbeehex.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\hjcjfrpw.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\lxxoppuu.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\WINDOWS\system32\mtjnwpaf.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\nerov2\aecxzr.as Infected: Backdoor.IRC.Zapchast skipped
C:\WINDOWS\system32\ptihntfs.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\tlsskinr.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\WINDOWS\system32\tskgell\astecx.as Infected: Backdoor.IRC.Zapchast skipped
C:\WINDOWS\system32\tskgell\tskgel.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 skipped
C:\WINDOWS\system32\tyvpxsmt.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\vlcghikh.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\xnxhwyev.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\system32\xtt.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.603 skipped
C:\WINDOWS\system32\ykeybmfi.dll Infected: Trojan.Win32.BHO.g skipped
C:\WINDOWS\Tasks\SCHEDLGU.TXT Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_5b8.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\xtgq.exe Infected: Trojan-Clicker.Win32.Costrat.ae skipped

Scan process completed.
Post #9
Hi

Empty these folders:

C:\VundoFix Backups
C:\WINDOWS\system32\tskgell
C:\WINDOWS\system32\nerov2

Empty Recycle Bin

Please download the Killbox.
Unzip it to the desktop.

Please run Killbox.

Select "Delete on Reboot" and "All files"

Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Documents and Settings\Sue\My Documents\BSINSTALL.exe
C:\Documents and Settings\Sue\My Documents\prisms.exe
C:\neroV2.exe
C:\Rgell.exe
C:\Ver47.exe
C:\Ver7.exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1EV45UJ\gell[1].exe
C:\WINDOWS\system32\eqvafbjl.dll
C:\WINDOWS\system32\fwbeehex.dll
C:\WINDOWS\system32\hjcjfrpw.dll
C:\WINDOWS\system32\lxxoppuu.dll
C:\WINDOWS\system32\mtjnwpaf.dll
C:\WINDOWS\system32\ptihntfs.dll
C:\WINDOWS\system32\tlsskinr.dll
C:\WINDOWS\system32\tyvpxsmt.dll
C:\WINDOWS\system32\vlcghikh.dll
C:\WINDOWS\system32\xnxhwyev.dll
C:\WINDOWS\system32\xtt.exe
C:\WINDOWS\system32\ykeybmfi.dll
C:\xtgq.exe

Go to the File menu, and choose "Paste from Clipboard".

Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

If your computer does not restart automatically, please restart it manually.

Empty this folder -> C:\!Killbox

Empty Recycle Bin

Re-scan with kaspersky

Send:

- a fresh HijackThis log
- kaspersky report
Post #10
hi sorry aint got back with reports but having trouble with kaspersky scan. get half way through then get error message saying error report. still keeps scaning which takes bout 2 hours then when try to save report it wont . bit frustrated. still saying i have 14 viruses . will keep trying unless u have any ideas. thanks for your help.
Post #11
Hi

You can then try eScan if no success with kaspersky online scan , it uses same virus definitions:

Please print these instructions out, or write them down, as you can't read them during the fix.

Please download MWav:
  • Unzip it to its predetermined directory (C:\Kaspersky)
  • Locate kavupd.exe in the new folder and double-click to Update.
  • If your firewall gives any messages about this program accessing to internet, allow it.
  • If it says the signatures are more than 30 days old, keep trying, until you get the actual definition updates.
  • When you see Updates Downloaded Successfully, hit Enter to continue.
  • Restart onto Safe Mode and locate the Kaspersky folder.
  • Locate mwavscan.com and double-click on it to launch the MWAV Scanner.
Now lets do the settings:
  • Leave the Default Settings checked.
  • Add a check to Drives
  • This will light up All Drives
  • Add a check to Scan all Files
  • Click Scan Clean to begin.
This scan might take around 3+ hours to finish when set to scan everything.
  • Please be sure it has finished before proceeding.
  • Once the Scan has finished, all entries identified as Infected, will be displayed in the lower panel.
  • Highlight everything that is inside the lower panel and hit Ctrl+C at the same time to copy.
  • Open an empty notepad file and paste the results (Ctrl+V) to it. Save the notepad to your desktop, name it as you want (e.g; MWav Results).
Reboot into normal Windows and post the results here along with a fresh HijackThis log.
Post #13
hi hope this is ok . think done it all right.


File C:\WINDOWS\system32\aecxzr.as infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP10\A0015709.exe infected by "Trojan-Clicker.Win32.Costrat.ae" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP14\A0018662.exe infected by "Trojan-Clicker.Win32.Costrat.ae" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP16\A0025026.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP16\A0025031.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029095.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029096.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029098.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ft. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029099.exe tagged as not-a-virus:AdWare.Win32.Agent.at. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029100.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ft. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029101.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029102.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ft. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029103.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ft. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP17\A0029104.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0035196.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.59. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0035197.as infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0035199.as infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036195.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036196.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036197.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036198.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036199.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036200.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036201.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036202.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036203.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036204.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036205.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036206.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036207.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036208.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036209.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.603. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036210.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036211.exe infected by "Trojan-Clicker.Win32.Costrat.ae" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036217.exe tagged as not-a-virus:Server-Proxy.Win32.MarketScore.h. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036218.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036219.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036220.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036221.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036222.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036223.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036224.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036225.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036226.exe infected by "Trojan-Clicker.Win32.Costrat.ae" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036227.exe tagged as not-a-virus:AdWare.Win32.SaveNow.z. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036228.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.603. No Action Taken.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036229.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036230.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036231.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036232.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036233.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036234.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036235.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP18\A0036236.exe infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{BAED66F9-D737-4AC8-95F6-22D3E98B0983}\RP22\A0055442.as infected by "Backdoor.IRC.Zapchast" Virus. Action Taken: File Renamed.


Logfile of HijackThis v1.99.1
Scan saved at 12:39:30, on 22/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\OOD2000.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sue\Desktop\hjt.exe.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = www.karoo.co.uk
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168962278718
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1145621555045
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

THANKS
Post #15
hi there. running fine when not on net but when connected get error message maybe after 10 mins or if lucky could be 30 mins saying error. after this happens nothing responds on computer and have to use restart button cos wont even shut down this main reason couldnt do online scan. have got spyware doctor and avg running do either of these act as a firewall or do i need another programme if so what do u recommend. when error message comes up again will send u full details of what it says on report. thanks for your help so far and will get back to you with error mess which means nothing to me but no doubt u may no what prob is. thanks again

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI