What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Possible virus

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hey guys, I'm pretty confident I might have a virus encrypted into my computer infrastructure, and I was wondering if you guys might be able to help me. Here is my HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:09:48 PM, on 11/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE – End of file - 1770 bytes Thanks again. Sincerely, eharri2
Post #2
Have you been fixing things using HJT? Your log is far smaller than I would expect.

Run HJT and click on Open the Misc Tools section.
  • Click Open Uninstall Manager…
  • Click Save list… and save it to your Desktop.
  • Copy and paste the file uninstall_list.txt into your next reply.
Post #3
I recently deleted a BHO file in my Documents and Settings folder using HijackThis. Besides that, I haven't fixed anything else using HijackThis. The only other program I use for repairing and cleaning my system is CCleaner, which I run on a daily basis. I'm on my work computer right now, and I will post my HijackThis log with the uninstall log when I return home from work. Sincerely, eharri2
Post #4
Alright here are the requested logs: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:26:50 PM, on 11/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\CCleaner\CCleaner.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE – End of file - 1797 bytes Adobe Flash Player 10 Plugin ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver CCleaner (remove only) Conexant HDA D110 MDC V.92 Modem Dell ResourceCD Dell Wireless WLAN Card HijackThis 2.0.2 Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.0.3) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB957097) SigmaTel Audio Synaptics Pointing Device Driver Ventrilo Client Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04) World of Warcraft
Post #6
The major concern I have is with the total lack of any security programs on the PC. No computer should ever go online without either an anti-virus program or a firewall. The only sensible suggestion I have with this machine is to back up any important data and then reformat and reinstall. I have no way of knowing what has been installed on the machine that may be malicious and what might have been done by the same and that makes it a problem that doesn't have a clear solution. I can let you have some links to free security programs if you wish, but that's about all I can do here i'm afraid.
Post #7
Well to be honest, I just recently reformatted this computer about two weeks ago. The only thing that has been installed besides HijackThis and Ccleaner is my World of Warcraft game. I haven't even downloaded any addons for the game in fear that it might corrupt my recently reformatted computer. However, I did run into some problems while downloading my ATI drivers for my video display. The Catalyst Control program my ATI video card isn't working properly, and I'm not sure how to resolve this. However, in light of this new information, if you still want me to reformat my computer, I will begin to do so.
Post #8
You shouldn't put a PC online without adequate security for any amount of time as there's just no accounting for the drive and determination of slime peddlers out there to drop a heap of crud on your computer. I'm afraid that the best option is to reformat and reinstall and that is what I would do if it was my PC. Whether you are going with free or paid-for security, I suggest you download the installation files before you reformat. Even connecting to the internet to download them poses a risk to your PC, so you want to have them up and running before going online.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI