Ok i got a bunch of viruses where my pc slowed down a lot and a bunch of new processes are appearing in me task manager,processes such as systs.exe and other ones that a tried ending the process wich worked but still appear on start up and are irritating… also i got this txt file in my C:drive that can not be deleted with antivirus (kapersky) trough safe mode or the normal mode. Ive read trough the forum that i need to post a log file trough hijackthis well here it is.
Can someone please help me as i really do not want to format my pc as i have a ton of information saved on it that i do not want to loose, Thank you for reading Jake.
Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.
Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:
1. Start HijackThis 2. Click on the Config button 3. Click on the Misc Tools button 4. Click on the Open Uninstall Manager button. 5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.
Rename HijackThis
There is a possibility an infection which is hiding part of the HijackThis log because it's called hijackthis.exe.
Please rename hijackthis.exe to iseeu.exe by right-clicking on the Desktop icon and selecting Rename.
32Red Casino
Acoustica Effects Pack
Acoustica Mixcraft 3
Acoustica Mixcraft 3.1
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge 1.0
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Common File Installer
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Dreamweaver CS3
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Flash Player 9 ActiveX
Adobe Fonts All
Adobe Help Center 1.0
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS2
Adobe Photoshop CS3
Adobe Photoshop CS3
Adobe Reader 8.1.0
Adobe Setup
Adobe Setup
Adobe Stock Photos 1.0
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Age of Mythology
Apache HTTP Server 2.2.4
Apple Software Update
AppServ 2.5.9 (remove only)
Ares 2.0.9
AV Voice Changer Software DIAMOND 4.0
BitZip (remove only)
Casino-On-Net
C-Media 3D Audio
CoffeeCup Web Form Builder - Registered
Dev-C++ 5 beta 9 release (4.9.9.2)
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
EnginSite Editor for PHP 3.6.4.237
Entropia Universe
Fastream IQ Web/FTP Server Engine
Fastream IQ Web/FTP Server GUI
FL Studio v7.0
Free Roulette Premium Powered by AdVantage
GameSpy Arcade
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Guild Wars
HijackThis 1.99.1
Hot Keyboard Pro 3.1
Hotfix for Windows XP (KB915800)
Hotfix for Windows XP (KB915865)
Icecast v2.3.1
IIS6 Manager
Interstitial Ad Delivery by 180 Search Assistant
Java(TM) 6 Update 2
Lemonade Tycoon
Lemonade Tycoon 2 (remove only)
LiveUpdate BVRP Software
Microsoft .NET Framework 2.0
Microsoft Age of Empires II
Microsoft SQL Server 2005 Compact Edition [ENU]
mobile PhoneTools
Mozilla Firefox (2.0.0.2)
Mozilla Firefox (2.0.0.7)
MSXML4 Parser
MTA: Race for San Andreas 1.1.1
MySQL Server 4.1
Native Instruments Traktor DJ Studio 3
Nero 7 Lite [removed]
No-IP.com DUC (remove only)
NVIDIA Drivers
Outerinfo
PAD Lookups by 180 Search Assistant
PDF Settings
PHP 5.2.1
PHP 5.2.3
PMPro PSP Video Converter 2.0
Power Audio Editor v11.0.1
PowerSNMP for .NET (Trial)
Purplenova
QuickTime
RealPlayer
Rhapsody Player Engine
Sami HTTP Server 2.0.1
Screen Shot Maker 2.5
Sigma Player 1.0
Sound Effect Maker version 1.2
Spin Palace Casino
Stronghold Crusader
Turbo Pascal 7.0
Turf Battles
ubroadcast Station Manager 1.12
Windows Desktop Search 3.01
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live installer
Windows Live Messenger
Windows Live Photo Gallery Beta
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 2
Xerox User Guide
Xerox WorkCentre 390 Printer Driver
and here is the new hijackthis list i have changed the name of the exe as you said.
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
When i double clicked combo fix it gave me a pop up saying i need administrative privileges to run it, and the only way i can log in as administrator is trough safe mode will that still work ?
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
I have tried that method allready had no luck, i obtained a copy of the vundofix.exe and im scanning as we speak will post the log when it is done.Jake.
It has finished scanning but no files where found… But im sure there is still a virus infected because now im getting a bunch of pop ups, and this file (check_LSA7.txt) on my c drive has appeared since the problems started maybe its the source of the virus?
