What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Smitfraud C Attack!

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
thanks Markka…here we go….

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:04:01 AM 5/25/2007

+ Scan result:



Nothing found.


::Report end


Logfile of HijackThis v1.99.1
Scan saved at 10:13:27 AM, on 5/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\windows\SOUNDMAN.EXE
C:\windows\ALCWZRD.EXE
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\Curt\Desktop\HJT\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTSInstal…MetaStream3.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60096.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
Post #17 last edited
Hello :)

Kaspersky online scanner works only with Internet Explorer!

Please run an online scanner with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:

    o Scan using the following Anti-Virus database:

    + Extended (If available otherwise Standard)

    o Scan Options:

    + Scan Archives
    + Scan Mail Bases

  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post.


Post:
- A fresh HijackThis log
- Kaspersky's report
Post #18
here we go……


——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Saturday, May 26, 2007 3:09:08 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 26/05/2007
Kaspersky Anti-Virus database records: 330357
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
F:\

Scan Statistics:
Total number of scanned objects: 60649
Number of viruses found: 4
Number of infected objects: 32 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:57:24

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5077ea8c903207239a137b92deefca36_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\642e652c09cbd8e531541b38684d4468_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a39f64fb5bd10517922bd8cff4c33d7e_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa16c499cc7a5c1c8805c5807a3fadaa_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\Curt\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst Mail MS Mail: infected - 8 skipped
C:\Documents and Settings\Curt\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst Mail MS Mail: infected - 8 skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\Temp\~DFACB5.tmp Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Curt\ntuser.dat Object is locked skipped
C:\Documents and Settings\Curt\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\_restore{AF30CE1C-2B6E-4B7B-8165-1EE4DB4F66CF}\RP325\change.log Object is locked skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst Mail MS Mail: infected - 8 skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{AFC71819-68A0-44B2-B8A7-7A1129F5BFB0}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\ssqonn.dll Infected: Trojan.Win32.Agent.agv skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\edrive 224\latest\3dsoftscreen.part3.rar/3dsoftscreen/tower.exe/data0003 Infected: Trojan-PSW.Win32.LdPinch.bsj skipped
F:\edrive 224\latest\3dsoftscreen.part3.rar/3dsoftscreen/tower.exe Infected: Trojan-PSW.Win32.LdPinch.bsj skipped
F:\edrive 224\latest\3dsoftscreen.part3.rar RAR: infected - 2 skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 3:13:35 PM, on 5/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\windows\SOUNDMAN.EXE
C:\windows\ALCWZRD.EXE
C:\WINDOWS\system32\PuXpMan2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Curt\Desktop\HJT\scanner.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTSInstal…MetaStream3.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60096.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
Post #19
Hello :)


Delete these files:
C:\WINDOWS\ssqonn.dll
F:\edrive 224\latest\blue3dsoftscreen.part3.rar

********************************************************************

Disable system restore:
  • Right click on my computer icon
  • Choose properties
  • Click on system restore tab
  • Select Turn off System Restore
  • Click apply and click OK
  • Reboot!
Enable system restore:
  • Right click on my computer icon
  • Choose properties
  • Click on system restore tab
  • un-check Turn off System Restore
  • Click apply and click OK
  • Reboot!
********************************************************************
Please download ATF-cleaner and save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

    If you use Firefox browser:

  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser:

  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
********************************************************************

Re-run with the kaspersky online scanner!

Post:
- A fresh HijackThis log
- Kaspersky's report
Post #20
here they are….


KASPERSKY ONLINE SCANNER REPORT
Monday, May 28, 2007 9:44:27 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 28/05/2007
Kaspersky Anti-Virus database records: 333247
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
F:\

Scan Statistics:
Total number of scanned objects: 57912
Number of viruses found: 2
Number of infected objects: 28 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:55:33

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5077ea8c903207239a137b92deefca36_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\642e652c09cbd8e531541b38684d4468_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a39f64fb5bd10517922bd8cff4c33d7e_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa16c499cc7a5c1c8805c5807a3fadaa_f8ef4a5f-df28-470b-8fd6-ddbf4d52ecb4 Object is locked skipped
C:\Documents and Settings\Curt\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Desktop\archive.pst Mail MS Mail: infected - 8 skipped
C:\Documents and Settings\Curt\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst/Archive Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Outlook\archive.pst Mail MS Mail: infected - 8 skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\History\History.IE5\MSHist012007052820070529\index.dat Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\Temp\~DFABAB.tmp Object is locked skipped
C:\Documents and Settings\Curt\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Curt\ntuser.dat Object is locked skipped
C:\Documents and Settings\Curt\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Curt\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\_restore{AF30CE1C-2B6E-4B7B-8165-1EE4DB4F66CF}\RP1\change.log Object is locked skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:09 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002/data0003 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze/data0002 Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst/Personal Folders/Sent Items/24 Jan 2005 00:11 to [removed]:sed files/SE.eze Infected: not-a-virus:AdWare.Win32.WindowEnhancer skipped
C:\tempstuff\4105backup.pst.pst Mail MS Mail: infected - 8 skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 9:44:49 AM, on 5/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\windows\SOUNDMAN.EXE
C:\windows\ALCWZRD.EXE
C:\WINDOWS\system32\PuXpMan2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\windows\system32\nvsvc32.exe
C:\HJT\scanner.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\PuXpMan2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTSInstal…MetaStream3.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60096.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
Post #21
Hello :)

Your HijackThis log is clean! How is your computer running now?

Here are a couple of things how to stay clean:
  • Clean speech:
  • Use Mozilla firefox or Opera as your browser!
    Mozilla firefox or Opera are better than Internet Explorer.
    Download Mozilla firefox from here!
    Download Opera from here!
  • Install Hosts-file!
    Hosts-file blocks bad web addresses. Remember to update hosts-file regularly.
    Download Hosts-file from here!
  • Install Winpatrol!
    Winpatrol monitors your system and blocks hijacks.
    Download Winpatrol from here!
  • Install AVG Anti-Spyware!
    AVG anti-spyware detecs and removes malware and cleans your register too. Run a scan with Ad-aware regularly and update it before the scan.
    Download AVG anti-spyware from here!
  • Install Ccleaner!
    CCleaner cleans your temporary files and also cleans your register. Run CCleaner regularly.
    Download CCleaner from here!
  • Install Ad-Aware!
    Ad-aware detecs and removes malware and cleans your register too. Run a scan with Ad-aware regularly and update it before the scan.
    Download Ad-aware from here!
  • Install SpywareBlaster!
    Spywareblaster blocks bad activeX-components. Update it regularly.
    Download Spywareblaster from here!
  • System restore!
    Clean and create new system restore point regularly.
    How do I clean my system restore and create new system restore point?
    Here are instructions!
  • Keep all programs updated!
    Remember to keep all programs up-to-date, also Windows. So please visit here regularly and install all critical updates.
Post #23
Hello :)

when I try to run msconfig, nothing happens..

any ideas??


Check this link. If that link doesn't help, then run combofix.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


Post the contents of C:\ComboFix.txt
Post #24
markka….msconfig is present on my computer, I did download from the link you provided….still will not run

Here is the combofix log….

"Curt" - 2007-05-31 7:36:26 Service Pack 2
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\Curt\Desktop\"


((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-31 ))))))))))))))))))))))))))))))))))


2007-05-27 12:49 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-05-25 09:39 d——– C:\HJT
2007-05-23 21:00 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-05-23 12:11 2,526 –a—— C:\WINDOWS\system32\tmp.reg
2007-05-23 07:51 37,244 –a—— C:\WINDOWS\5x.exe
2007-05-20 12:57 d——– C:\Program Files\FlashGet
2007-05-15 21:11 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-05-09 09:11 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-02 14:35 d——– C:\Documents and Settings\Curt\.WindLGC4
2007-05-02 14:35 d——– C:\DOCUME~1\Curt\.WindLGC4
2007-05-02 14:34 d–h—– C:\Program Files\Zero G Registry
2007-04-23 13:14 d——– C:\Program Files\Idec
2007-04-23 13:14 d——– C:\Program Files\Common Files\InstallShield Shared
2007-04-23 13:14 d——– C:\DOCUME~1\Curt\APPLIC~1\Idec
2007-04-23 13:14 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
2007-04-22 11:44 16,896 –a—— C:\WINDOWS\system32\ODKOB32.DLL
2007-04-22 11:44 140,288 –a—— C:\WINDOWS\system32\AUTPRX32.DLL
2007-04-22 11:44 d——– C:\Program Files\Newport
2007-04-22 11:38 87,824 –a—— C:\WINDOWS\system32\GAPI32.DLL


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-31 12:30:13 ——– d—–w C:\Program Files\Mozilla Thunderbird
2007-05-29 19:30:41 ——– d—–w C:\Program Files\TweakNow PowerPack
2007-05-25 13:19:50 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-17 02:19:43 ——– d—–w C:\DOCUME~1\Curt\APPLIC~1\SolidWorks
2007-05-16 02:23:42 ——– d—–w C:\Program Files\Action Poker
2007-05-16 02:10:46 ——– d—–w C:\DOCUME~1\Curt\APPLIC~1\U3
2007-04-18 16:12:23 2,854,400 —-a-w C:\windows\system32\msi.dll
2007-04-17 03:47:36 33,624 —-a-w C:\windows\system32\wups.dll
2007-04-17 03:45:54 1,710,936 —-a-w C:\windows\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 —-a-w C:\windows\system32\wuapi.dll
2007-04-17 03:45:42 325,976 —-a-w C:\windows\system32\wucltui.dll
2007-04-17 03:45:36 203,096 —-a-w C:\windows\system32\wuweb.dll
2007-04-17 03:45:28 92,504 —-a-w C:\windows\system32\cdm.dll
2007-04-17 03:45:20 53,080 —-a-w C:\windows\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 —-a-w C:\windows\system32\wups2.dll
2007-04-17 03:44:20 271,224 —-a-w C:\windows\system32\mucltui.dll
2007-04-17 03:44:18 208,248 —-a-w C:\windows\system32\muweb.dll
2007-03-17 13:43:01 292,864 —-a-w C:\windows\system32\winsrv.dll
2007-03-08 15:36:28 577,536 —-a-w C:\windows\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\windows\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\windows\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 —-a-w C:\windows\system32\win32k.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 21:38]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2005-02-24 08:32 C:\WINDOWS\system32\nwiz.exe]
"IntelAudioStudio"="C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [2004-09-21 21:39]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-09-26 16:31]
"SoundMan"="SOUNDMAN.EXE" []
"AlcWzrd"="ALCWZRD.EXE" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-24 09:16]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-24 15:17]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSharedDocuments"=00000000

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
HDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wwSecSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*


********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-31 07:37:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-31 7:37:17
C:\ComboFix-quarantined-files.txt … 2007-05-24 08:02
C:\ComboFix2.txt … 2007-05-24 08:02
C:\ComboFix3.txt … 2007-05-23 21:00

— E O F —
Post #25
Hello :)

Ok, let's do this;

Open a command prompt window (start -> run -> cmd -> ok). Insert the XP CD into the drive and enter the following command:

EXPAND -R D:\I386\MSCONFIG.EX_ C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES (This will extract a new copy of the MSCONFIG.EXE from the CD).

Also run regedit and navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSConfig.exe

In the right hand pane, double click on default, and an Edit String window will open.

check that Value data is set to C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig.exe

If it isn't, change it so it is.
Post #26
registry is correct……expanded from CD…..msconfig.exe is located in c:\windows\pchealth\helpctr\binaries will not run…
Post #27
Hello :)

Open Notepad
-> copy the following lines into a new document:

regedit /e C:\look2.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSConfig.exe"
dir /a /s "C:\*msconfig.*" >> C:\look.txt
type C:\look2.txt >> C:\look.txt
del /q C:\look2.txt
notepad.exe C:\look.txt
del /q C:\look.txt

Save the document to your desktop as Fix.bat and filetype: All Files
Go to your desktop and run the file Fix.bat and answer yes to any questions.


Post the contents of the notepad window that comes up.
Post #28
here it is Markka… Volume in drive C is DISK3_VOL1 Volume Serial Number is 9C45-DCAD Directory of C:\Documents and Settings\Curt\Desktop\I386 08/04/2004 07:00 AM 9,591 MSCONFIG.CH_ 06/01/2007 08:14 AM 59,137 MSCONFIG.EX_ 2 File(s) 68,728 bytes Directory of C:\Documents and Settings\Curt\My Documents\I386 08/04/2004 07:00 AM 9,591 MSCONFIG.CH_ 08/04/2004 07:00 AM 59,137 MSCONFIG.EX_ 2 File(s) 68,728 bytes Directory of C:\Documents and Settings\Curt\Recent 05/31/2007 07:35 AM 529 msconfig.chm.lnk 1 File(s) 529 bytes Directory of C:\I386 08/04/2004 07:00 AM 9,591 MSCONFIG.CH_ 06/01/2007 08:14 AM 59,137 MSCONFIG.EX_ 2 File(s) 68,728 bytes Directory of C:\WINDOWS\$NtUninstallKB906569$ 08/04/2004 07:00 AM 158,208 msconfig.exe 1 File(s) 158,208 bytes Directory of C:\WINDOWS\Help 08/04/2004 07:00 AM 17,240 msconfig.chm 1 File(s) 17,240 bytes Directory of C:\WINDOWS\pchealth\helpctr\binaries 09/26/2005 07:34 PM 169,984 msconfig.exe 08/04/2004 12:56 AM 158,208 msconfig.ex_ 2 File(s) 328,192 bytes Directory of C:\WINDOWS\Prefetch 05/31/2007 07:35 AM 15,416 MSCONFIG.EXE-148105C1.pf 06/01/2007 10:37 AM 15,600 MSCONFIG.EXE-1EF1EA0F.pf 2 File(s) 31,016 bytes Directory of C:\WINDOWS\system32\dllcache 09/26/2005 07:34 PM 169,984 msconfig.exe 08/04/2004 12:56 AM 158,208 msconfig.ex_ 2 File(s) 328,192 bytes Total Files Listed: 15 File(s) 1,069,561 bytes 0 Dir(s) 65,120,030,720 bytes free Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSConfig.exe] @="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe"
Post #29
Hello :)


Go to here;

C:\WINDOWS\pchealth\helpctr\binaries

Rename msconfig.exe to msconfig.exe.old

After that rename msconfig.ex_ to msconfig.exe


Does the msconfig work now?
Post #30
hmmm….as soon as I rename msconfig.exe to something else…..msconfig.exe reappears :blink: it is like it is being reinstalled automatically……

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI