[Resolved]Hijackthis Log For Newbie

Hello to everyone,

This is my first post, so be gentle I recently had a coolwebsearch infection which was detected using the adaware program. I removed it and immediately run it again. Surprise surprise, it was back. I removed it again, and it was gone. I ran cwshredder, nothing. I then ran spybot search and destroy in safe mode etc, and there was still nothing. Problem was my Pc was running really s l o w. I didn't get and hijacking of home page nor did i experience any desktop icons that i didn't want, so thought that was the end of it.

I was using a steganos security package to manage passwords, internet traces, encryption etc. I found that (can't recall exactly how) coolwebsearch had attached (i think) to the steganos program. I deleted that and thought that it wasn't going to go away, so i reformatted my whole hard drive. Reason was because i had found there was (possibly) something in the registry that maybe shouldn't have been there. This was all on the strength of a tech support site. I didn't know what i was doing to the registry and din't want to ruin my Pc………. Anyways zzzzzzzzz sorry zzzzzzzzz A few days have passed and my Pc is still running slow. Tried running my Kaspersky, adaware, spybot and was going to download comodo malware cleaner. I still can't detect it. Can someone please look at my hijackthis log, and tell me if there is an obvious problem, and if so, how to fix it?

Cheers

Madserj


C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iolo\System Mechanic Professional 6\SysMech6.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Catalyst System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.pcservicecall.co.uk
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Hi Madserj

Welcome to the TomCoyote Forums
My name is mschroe919 and I am going to read your log.
I would like to help you So if you would….
Please be patient and I will be back as soon as possible.
In the mean while I need for you to go to your
C:\Program Files\Hijackthis\HijackThis.exe
Change the name HijackThis.exe
to scann.exe
and run the program again and post a new log. The log
you posted is not complete. And sometimes a virus or trojan
hide when they see hijackThis.
Again I need a complete log I will be waiting
for you new log to continue.
Thanks mschroe919

PS
Don't delete or change anything till asked to

Hey mschroe919, Cheers for the reply. I am real basic whenit comes to computers, and have had trouble finding what you asked for. If i goto C:/Programfiles/hijackthis and hover over the containing file, it shows i have the .exe file in there. When i open the folder, i have four options. 1. Hijackthis txt doc. 2. Unins000 Uninstall DAT file 3. Hijackthis (with dynamite and charger image) 4. unins000 setup/uninstall file (computer image with disc) As they are shown above, is how they are named. I have tried to rename each one to see what each is actually called (but not saved any new name!!!) I have looked at the properties of each, and none are called .exe on the end. Which one is it, and do i (literally) right-click, down to rename and then do as you instructed? Cheers Madserj

Hi Madserj
Welcome back

I am sorry I should have been a little more clear.
Here is what to do in steps:
1-left click on my computer to open
2-left click on local disk (C:)
3-left click on program files
4- left click on Hijackthis
5-RIGHT CLICK ON HijackThis.exe
5-After right clicking a window opens with some options
6-left click on RENAME
7- a box opens with shaded block, here type in Scann.exe
8-After typing in the name scann.exe please hit the enter button

This is now been changed. If you click on Scann.exe it does the same thing as Hijackthis done.
When you click on scann.exe do a system scann and save a log file.
Remember where you save it to. Then copy and paste that log here.
Good luck mschroe919

Hi mate, If you look at my last post, all of what is in the folder is listed there. I cannot see the .exe file. Is it the actual one i click on to open/run the actual program? Cheers Madserj

Hi, When you got to the folder where the program is listed, go to tools on the top menu. left click on it. Then left click on the folder options window. Then left click on the box that says View.There you scroll down and make sure there is no check in the line Hide extentions for known types. Be sure to apply when unchecked. Now when you go to the place where you have the HJT you will see the Dynomyte with the .exe. that is the one you roight click and rename scann.exe good luck mschroe919

Hi and welcome back, Yippie skippie we made it. Now my job is to check your log and get back to you. I will be back as soon as I can, it might be latter tonight. It is now 3:40 in the afternoon. I need to do something for my wife. I will be back. mschroe919

Hi Madserj
I am back.
we have some work here cause your log doesn't look real bad, so we have to search for hidden bugs.
First it appears as though you are running 2 Anti virus programs. Kaspersky Anti-Virus, and SiteAdvisor Service, this is not good they tend to buck one another. Please choose one only. It is okay to have two just don't have them running in the background, together.
You may want to print this out so you can follow it better.
While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

* Open Spybot Search & Destroy.
* In the Mode menu click "Advanced mode" if not already selected.
* Choose "Yes" at the Warning prompt.
* Expand the "Tools" menu.
* Click "Resident".
* Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
* In the File menu click "Exit" to exit Spybot Search & Destroy.
NEXT:
Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
There may be more to do after I see the 2 logs.
good luck mschroe919

Hey mate. I ran vundo, and nothing!! Didn't pick anything up, so no log to show. So….. what next? Madserj

Hi Madserj, Did you reboot after running vundo? Also you made no mention of the two anti virus programs. Did you disable tea timer? Also after reboot please send a new Scann.exe log. Even if it looks the same . mschroe919

Hi, I have just checked my running processes through system mech 6 and have found two things that are suspicious. 1. Kav.exe 2. Kavsvc.exe Right click to ask google and they both show on www.auditmypc.com to be 1. is a worm and 2. is a trojan Another site www.processlibrary.com show them to be components of kaspersky a/v. I have returned (after 2-3 hour break) to my Pc as i had to turn it off and disconnect my Netgear router due to the green light constantly blinking as though it was downloading something. It appears to have stopped for now!!!! Something odd mmmmmm……. Madserj

Hi Madserj
I am confident that these:

1. Kav.exe

2. Kavsvc.exe
are good if they were truly viruses they would show up in a
different location other than here:
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

Now lets do some local cleaning and checking.
There is going to be a lot to do so you might print this out to follow.
Please do these as I got them. don't try any other programs till we get done with these:
FIRST:

Lets show all files do this:
Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

NEXT:

Please download ATF Cleaner by Atribune.

Download Here:
http://www.atribune.org/ccount/click.php?id=1
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

NEXT:

I see you have spybot S&D so please run it and before you do make sure it is the latest 1.4 version. and when starting
click on check for updates.
and let me know if something can't be fixed.

NEXT:
Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run AVG Anti-Spyware and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select "Delete".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

NEXT:

[*]Reboot your computer into SafeMode. You can do this by restarting

your computer and continually tapping the F8 key until a menu appears.

Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while ewido is scanning, it may interfere with the scanning proccess:
[*]Lauch ewido(AVG)-anti-spyware by double-clicking the icon on your desktop.

[*]Select the "Scanner" icon at the top and then the "Scan" tab

then click on "Complete System Scan".
[*]ewido will now begin the scanning process, be patient this may take a little

time.
Once the scan is complete do the following:
[*]If you have any infections you will prompted, then select "Apply all

actions"
[*]Next select the "Reports" icon at the top.

[*]Select the "Save report as" button in the lower left hand of the

screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
NEXT:
[*]Close ewido and reboot your system back into Normal Mode and post the

results of the AVG Anti-Spyware scan. And a new hjt log.
good luck mschroe919

Hey man, Just did exactly what you suggested. AVG would NOT let me update, or visit the site, so i installed manual updates. Scanned in safe mode ticking and unticking evrything you told me to. Once finished it found 18 infections, all med risk cookies. Removed all, but the save scan button stayed grey. I could not select it. I have tried to look for the log, but it isn't there (or obvious) Didn't even give me the chance to save it??!?!?!? Madserj Update My system mech 6 has run in background (didn't realise) and it found 4 infections. 1. Small CQB-Desc. It coonects to the internet to d-load additional components to jepaordize security and masquerades as a legit tool to avoid removal. 2. Spyware Bomb-Desc. Rogue anti-malware that detects non-existent or exaggerated threats to force purchase of program. 3. eXactBullseyenetwork-Desc. Adware 4. Caishow-Desc. Adaware