What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HijackThis Log

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
This is present by the 010 entry in your HJT log. It may have been partially removed by some of the scans we have run.

Make sure that you download Winsockxpfix to your desktop in case you need it, do this first.

clean and quarantine Choose this option and then post a new HJT log.
Post #17
It's still there, drat.

Logfile of HijackThis v1.99.1
Scan saved at 9:46:40 AM, on 1/21/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://garney.livejournal.com/friends
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 147.46.29.86:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet7_22.dll' missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} -
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
Post #18
Garney,

Let me look into this, I know for a fact that removing that 010 entry with HJT could mess up your internet connection, but since the program appears gone, I don't know and will have to find out.

In the meantime , one of the infections you had was a rootkit, it is hidden and we cant see it. So run this


Please read this information before you proceed, if programs are running the results will be effected as described. I would make sure nothing is running except what you need to start the computer.
http://www.sophos.com/readmes/readsar.txt

http://www.sophos.com/products/free-tools/…ti-rootkit.html

Downloading
  • Surf to: Sophos free tools: Anti-Rootkit
  • Click the "Download" button
  • Read the conditions and fill out your Details.
  • Click the Download Sophos Anti-Rootkit link.
  • Save the sarsfx.exe to location on your harddrive where you can find it later on.
Installing
  • Close as many applications as possible and execute sarsfx.exe by doubleclicking it.
  • Accept the EULA and install the software to the loaction of your choice.(Default is C:\SOPHTEMP)
Running for analysis
  • In that folder find and double-click sargui.exe
  • Select the areas that you want to scan for hidden objects (Running processes, Windows registry, Local hard drives)
  • Click Start > Run and copy this command into the window %TEMP%\sarscan.log and click OK to execute.
  • A textfile will open. Post the content of that file.
Running for cleaning
  • Select the file(s) marked as Unknown hidden file(s) and doubleclick the "Clean up checked items" button.
  • Click Start scan and wait for the results. This may take a while especially if you selected to scan the Local hard drives.
  • At the prompt check if the one you selected were correct and click OK
  • Allow the computer to reboot
Checking
  • Click Start > Run and copy this command into the window %TEMP%\sarclean.log and click OK to execute.
  • A textfile will open. Post the content of that file.
Post #19
My apologies, but I stopped at the scanning step and I have not cleaned any files. I'm afraid some of these might be false positives, and I thought it better to stop and check with you what files are safe to clean. Sophos Anti-Rootkit Version 1.2 (data 1.01) © 2006 Sophos Plc Started logging on 1/21/2007 at 10:13:08 AM Warning: Failed to set privilege SeDebugPrivilege. You may not have sufficient access rights. Not all privileges referenced are assigned to the caller. Warning: Could not initialize Toolhelp. Please restart and try again. Access is denied. Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{1186654d-47b8-48b9-beb9-7df113ae3c67}\##?#IDE#CdRomMWapi-cd_SOmWrKWE-=6}sZ________________5>zy____#30323030302f2f33373120202020202020202020#{1186654d-47b8-48b9-beb9-7df113ae3c67} Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\##?#IDE#CdRomMWapi-cd_SOmWrKWE-=6}sZ________________5>zy____#30323030302f2f33373120202020202020202020#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#IDE#CdRomMWapi-cd_SOmWrKWE-=6}sZ________________5>zy____#30323030302f2f33373120202020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINCOM32 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pe386 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wincom32 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows Overlay Components\Security Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winmgmt\Parameters Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{1186654d-47b8-48b9-beb9-7df113ae3c67}\##?#IDE#CdRomMWapi-cd_SOmWrKWE-=6}sZ________________5>zy____#30323030302f2f33373120202020202020202020#{1186654d-47b8-48b9-beb9-7df113ae3c67} Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\##?#IDE#CdRomMWapi-cd_SOmWrKWE-=6}sZ________________5>zy____#30323030302f2f33373120202020202020202020#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#IDE#CdRomMWapi-cd_SOmWrKWE-=6}sZ________________5>zy____#30323030302f2f33373120202020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINCOM32 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINDOWS_OVERLAY_COMPONENTS\0000 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pe386 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wincom32 Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Windows Overlay Components\Security Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\winmgmt\Parameters Hidden: file C:\WINDOWS\system32:lzx32.sys Hidden: file C:\WINDOWS\system32\wincom32.sys Hidden: file C:\WINDOWS\system32\wincom32.ini Hidden: file C:\Program Files\Maxis\The Sims\GameData\Skins\chatterbox.exe Hidden: file C:\Program Files\Maxis\The Sims\GameData\Skins\gs_carriage.exe Stopped logging on 1/21/2007 at 10:23:53 AM
Post #20
Okay, I asked several people, phoned a friend and all that, and googled the files I wasn't sure about. Symantec.com gave me nice information on the files. I have seen game01.exe game02.exe etc in my task manager before as well, which apparently were products of the wincom32. The clean log SophosBootTasks initialising Processing tasks Reading information for task 0 Deleting file \Device\HarddiskVolume1\WINDOWS\system32:lzx32.sys Error resetting read only attribute (0xC0000034) Reading information for task 1 Deleting file \Device\HarddiskVolume1\WINDOWS\system32\wincom32.sys Reading information for task 2 Deleting file \Device\HarddiskVolume1\WINDOWS\system32\wincom32.ini Updating boot execute registry key SophosBootTasks completed Exiting
Post #21
You are doing good, you follow instructions very well :thumbup:


Lets do this .
  • Please download LSPFix
  • Disconnect from the internet.
  • Go to where you downloaded LSPFix and run the LSPFix.exe by double clicking on it.
  • Check the I know what I'm doing box.
  • In the Keep box you should see one or more instances of newdotnet7_22.dll.
  • Select every instance of newdotnet7_22.dlll and move each one to the Remove box by clicking the >> button.
  • When you are done click Finish.
LSP Tutorial <– If you need it.

Find and delete the file c:\windows\system\newdotnet7_22.dll


Post a new log please
Post #22
Hahaha, oh I like that, "I know what I'm doing… or I enjoy reinstalling" Best warning I've ever seen. No thank you, I don't enjoy reinstalling and I'd rather not ^^;

Logfile of HijackThis v1.99.1
Scan saved at 12:41:04 PM, on 1/21/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://garney.livejournal.com/friends
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 147.46.29.86:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} -
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
Post #23
Garney :D

Seoul National University <– Your log is showing this as a proxy server, do you know about it??

The rest of your log looks fine :thumbup:

We are on a roll , lets do a few things to make sure its all gone.

Your AVG report showed a ton of bad things in your System Restore program and if you ever used it to restore your system to an earlier date you will be right back to square one. This will flush out all previous restore points and I cant emphasize enough how important it is to create a new Restore Point.

Turn off System Restore.
  • Right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Reboot your System

Turn ON System Restore.
  • Right-click My Computer.
  • ClickProperties.
  • Click the System Restore tab.
  • UN-Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Create a new Restore Point <– Very Important
  • Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
    You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this


Then run this system cleaner.

If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < – After it scans your system, when you click on the Fix button and it asks you to backup the Registry..Say Yes
Tutorial for CCleaner



Panda online scanner won't fix much but is very good at showing us if something is still present.

Run Panda's ActiveScan from here and perform a full system scan.

1. Once you are on the Panda site click the "Scan your PC" button
2. A new window will open…click the big "Check Now" button
3. Enter your Country
4. Enter your State/Province
5. Enter your e-mail address and click send
6. Select either Home User or Company
7. Click the big Scan Now button
8. If it wants to install an ActiveX component allow it
9. It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
Since you are on a slow connection it will take about 15 minuites for the scanner to load.
10. Click on "Local Disks" to start the scan
11. Once scan is done, click "see report" then "save report"
Save the log someplace.
12. reboot
13. Post Panda scan results in your next reply
Post #24
I vaguely remember some years ago having to proxy through to Seoul in order to play on a private game server. Having since stopped that *cough* somewhat illegal *cough* practise, I no longer need that proxy. Are those McAfee lines in the log any concern? McAfee errored on me something fierce and I've tried to remove it completely from my system, so you'll understand my concern. Going to follow instructions now. I have love for a safe and clean restore point, that gives me some peace of mind.
Post #25
Go ahead and remove these with HJT, you can always restore them if needed .

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 147.46.29.86:80

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab

To restore the backups:
  • Open HiJackThis
  • Click on "View the list of Backups"
  • Place a check mark next to anything you want to restore
  • Click Restore
  • Click Yes
  • Reboot your computer
Post #26
AVG has been running into several game.exe files Panda scan log =========== Incident Status Location Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\User1\Cookies\user1@advertising[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\User1\Cookies\user1@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\User1\Cookies\user1@atwola[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\User1\Cookies\user1@doubleclick[2].txt Potentially unwanted tool:Application/Processor Not Disinfected C:\Documents and Settings\User1\Desktop\SmitfraudFix\Process.exe Spyware:Spyware/New.net Not disinfected C:\Documents and Settings\User1\Desktop\uninstall6_90.exe
Post #27
FYI, the reason we had to tip toe around New Net was because the LSP is part of the chain that gives you internet access and we did not want to break the chain, All Panda found where cookies along with files from some of the programs we ran. :thumbup: If there where still bad files and programs on your computer, Panda would have found them. You can run AVG again if you wish, let me see the report along with a New HJT log. How is your system running now??
Post #28
System is running much better. I get moments of lagspike, but I wonder if that's not just my internet - I'm in Missouri and we're getting ice again. We had a lovely three days without power, let alone internet.

AVG found game.exe again, it just keeps popping up.

AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 6:54:02 PM 1/21/2007

+ Scan result:

C:\WINDOWS\system32\game5.exe.exe -> Downloader.Agent.bet : Cleaned.
C:\Documents and Settings\User1\Cookies\user1@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\User1\Cookies\user1@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\User1\Cookies\user1@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.

::Report end


Logfile of HijackThis v1.99.1
Scan saved at 6:54:35 PM, on 1/21/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://garney.livejournal.com/friends
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 147.46.29.86:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} -
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
Post #29
Garney,

Your log looks fine :thumbup:

Are you going to try to remove the proxy server??

Remove both of these..

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 147.46.29.86:80
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)




Run this through Killbox, this time have it set for SINGLE FILE

C:\WINDOWS\system32\game5.exe





Garney Garney Garney Garney, What am I going to do with you :D You seem to know your way around fairly well, please use that good knowledge and try not to get infected again. It's been quite a ride and I am sure you have better things to do then this.

1. Dont click on any link in any website that offers a free this or that or is flashing. Most times they are safe but there is a slight chance they are not and you can get infected again.

2. Stay away from file sharing and music swapping sites… think about it, do you want to give someone half way around the world that you don't know access to your computer to download a song…. I don't.

3. Watch those email attachments. Most ISPs have web based mail that you can access and then delete the mail you don't want off the server…. then download the mail to your computer that you want.



Now, you have to upgrade to Service Pack 2 . There are critical windows updates beyond SP2 that you need to install also.
Open Internet Explorer and go to Tools> Windows Updates and go for it. You can also download SP2 from here. Just download all critical updates.. DO NOT DOWNLOAD ANY DRIVER FILES

http://www.microsoft.com/windowsxp/sp2/default.mspx



How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • Tom Coyote
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • Geeks To Go
  • Dslreports



Here are some free programs to install, don't leave home without them
  • Spybot Search and Destroy 1.4
    Check for Updates/ Immunize and run a Full System Scan on a regular basis.
  • Ad-Aware SE Personal 1.06
    Check for Updates and run a Full System Scan on a regular basis.
  • Spyware Blaster It will prevent most spyware from ever being installed.
  • Spyware Guard It offers realtime protection from spyware installation attempts.
  • Win Patrol This program will warn you when any changes are being made to your system and give you the option to deny the change.
  • IE-Spyad
    IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 2.0 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
  • Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.
Thanks for stopping by Tom Coyote , I'm glad I was able to help you. :D

I will keep this thread open for you for about a week in case you have any other questions
Post #30
You~ are going to watch me read and download every link you just gave me, because I'm sure you had better things to do as well. I know my commissions have been delayed and I've done nothing on my dissertation. Ooh firewall, I really needed that *cough* Annnd I run into this trying to download Service Pack 2 Could not install: Microsoft Windows Installer 3.1 Update for Windows XP (KB898461) Windows Genuine Advantage Validation Tool (KB892130) And I get sent around in a circle of checking, please install, failed install.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI