Internet start up problem(RESOLVED)

Sir_Angus · #1 (**permalink**) 15-06-2006, 11:01 PM

Hi,
Please please please please help me, my brother-in-law is coming to stay, he needs to be connected and I have gotten in some crap in my PC. I have run ad-aware a 1000 times now, each time it finds stuff, deletes it and says my system is clean. But something is still wrong, it takes years to start explorer, the whole PC is slower than a dead tortoise…..can you heeeeeeeeeeeelp?….please….
Many thanks
Sir_angus
Brain_damage here is my update….
The problem is that it takes like years to start internet explorer, once I finally get it started it take another few years to surf to another page…
I have now installed spybot SD, updated Ad-aware with the latest version, changed the setting as your recommendations. After running Ad-aware I started on the PC, my start side is now correct but still having problems getting Internet to start up..Here is my hijackthis log…forgot to say, tried doing a system restore...xp restarts, I log in, it says re-setting or summit like that then all of a sudden I get a msg saying that windows could not be restored - no changes have been made...

Logfile of HijackThis v1.99.1
Scan saved at 23:57:10, on 2006-06-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\UMCSTUB.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program\CA\SharedComponents\DesktopCommonServic es\DMPrimer\dmprimer.exe
C:\Program\Compaq\COMPAQ~2\hibserv.exe
C:\Program\Network Associates\Common Framework\FrameworkService.exe
c:\Program\Network Associates\VirusScan\mcshield.exe
c:\Program\Network Associates\VirusScan\vstskmgr.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\Program\CA\Unicenter Remote Control\rcHost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Program\Compaq\COMPAQ~1\cpqdmi.exe
C:\SxpInst\sxplog32.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program\Compaq\EAB\EABSERVR.EXE
C:\Program\Compaq\Hotkey Software\hkss.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ltmsg.exe
C:\Program\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program\Real\RealPlayer\RealPlay.exe
C:\Program\Philips ToUcam Camera\VProperty.exe
C:\Program\QuickTime\qttask.exe
C:\Program\Network Associates\VirusScan\SHSTAT.EXE
C:\Program\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Skype\Phone\Skype.exe
C:\Program\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Microsoft Office\Office10\WINWORD.EXE
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\VirusBlast\VirusBlast.exe
C:\Program\VirusBlast\VirusBlast.exe
C:\Documents and Settings\rumewe01\Skrivbord\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aftonbladet.se/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: UserInit=userinit,C:\SxpInst\sxplog32.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program\VirusBlast\BlastIEmonitor.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\Program\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [hkss] C:\Program\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [RealTray] C:\Program\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [2FFBk5wc] C:\WINDOWS\wtihof.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "c:\Program\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe
O9 - Extra 'Tools' menuitem: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe
O9 - Extra button: @C:\Program\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://knuten
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab28578.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1150059672787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1150059656824
O16 - DPF: {83873F92-B99B-400A-9E36-52B5F4970FB7} - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.comp...io5_3_16_0.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab28578.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: RCEnumDD.dll
O23 - Service: McAfee Alert Manager (AlertManager) - McAfee Division of Network Associates, Inc. - c:\Program\Network Associates\Alert Manager\amgrsrvc.exe
O23 - Service: Asset Management Agent (AmoAgent) - Computer Associates International, Inc. - C:\WINDOWS\UMCSTUB.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\Program\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: DM Primer (DMPrimer) - Unknown owner - C:\Program\CA\SharedComponents\DesktopCommonServic es\DMPrimer\dmprimer.exe" -DMPRIMER_SERVICE_: (file missing)
O23 - Service: Hibernation - Unknown owner - C:\Program\Compaq\COMPAQ~2\hibserv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - c:\Program\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - c:\Program\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\System32\PGPsdkServ.exe
O23 - Service: Unicenter Remote Control Host (rcHost) - Computer Associates International, Inc. - C:\Program\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Accociates, Intl Inc. -
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

Again thanks for any help…

Neal · #2 (**permalink**) 16-06-2006, 12:47 AM

Welcome to DAL,

It looks like you have 2 or 3 anti-virus programs running on your machine and that is a major cause of slow downs. Please uninstall all of them except your favorite one and make sure virus blast gets removed.

To clean your temp folder, recycle bin, etc..please download this free tool:

CCleaner

Don't install any Toolbars, or other programs, should it ask you!Just uncheck the option of installing the Yahoo toolbar.
It will put a shortcut on your Desktop.
Click on CCleaner to start it. Then click "Run Cleaner", just use the windows tab up front by default.

Then Reboot (Exit)

Please download, install, and update the NEW free version of Ewido trojan scanner:

When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".

When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.

From the main ewido screen, click on update in the left menu, then click the Start update button.

After the update finishes (the status bar at the bottom will display "Update successful")

Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.

If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Post the log Ewido makes back here please and a new hijackthis log. Thanks.

Go here BitDefender and run an online scan with BitDefender (you will need to use Internet Explorer for this scan). When the ActiveX Control has loaded, click on "Click here to scan" and grab a coffee.

When BitDefender completes the scan, select the "Detected Problems" tab. Click on "Click here to export scan". Save the file as an HTML to your Desktop. Then click on the saved file and allow it to open with your browser. Go to Edit - Select All then copy/paste that log back here. Post back and let us know what it found (post the log).

And post a new HJT log also..

And...

Open Hijackthis.

Click the "Open the Misc Tools" section Button.

Click the "Open Uninstall Manager" Button.

Click the "Save list..." Button.

Save it to your desktop. Copy and paste the contents into your reply.

Thanks.

Sir_Angus · #3 (**permalink**) 16-06-2006, 09:30 PM

Hi Neal,

First will I say thanks for your help!

I have done as you have said - I have deleted Virusblast, found no uninstall file so I did it the hard way and deleted the folder. Internet seems to be starting a lot quicker.

Here are my two log files, the first on is ewido and the second is Hjackthis...

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 22

17, 2006-06-16
+ Report-Checksum: 2188CEB0

+ Scan result:

HKLM\SYSTEM\CurrentControlSet\Services\Sniffer\\Ta g -> Adware.BrowserAid : Ignored
C:\Program\Media-Codec -> Trojan.Small : Ignored
HKU\S-1-5-21-1663572197-1333480407-49557600-14936\Software\Microsoft\Windows\CurrentVersion\Ex t\Stats\{F79FD28E-36EE-4989-AA61-9DD8E30A82FA} -> Trojan.Small : Cleaned with backup
C:\Documents and Settings\Administratör\Cookies\banadmin@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\rumewe01\Cookies\rumewe01@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
C:\Documents and Settings\rumewe01\Cookies\rumewe01@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
C:\Documents and Settings\rumewe01\Cookies\rumewe01@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\rumewe01\Cookies\rumewe01@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\rumewe01\Cookies\rumewe01@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned with backup
C:\WINDOWS\system32\1024\ld536C.tmp -> Trojan.Small : Cleaned with backup
C:\WINDOWS\system32\1024\ldBF66.tmp -> Trojan.Small : Cleaned with backup
C:\WINDOWS\system32\1024\ldF1A3.tmp -> Trojan.Small : Cleaned with backup
C:\WINDOWS\system32\ld101.tmp -> Downloader.Zlob.pu : Cleaned with backup

::Report End

Hijackthis....

Logfile of HijackThis v1.99.1
Scan saved at 22:26:56, on 2006-06-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\UMCSTUB.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program\CA\SharedComponents\DesktopCommonServic es\DMPrimer\dmprimer.exe
C:\Program\Compaq\COMPAQ~2\hibserv.exe
C:\Program\Network Associates\Common Framework\FrameworkService.exe
c:\Program\Network Associates\VirusScan\mcshield.exe
c:\Program\Network Associates\VirusScan\vstskmgr.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\Program\CA\Unicenter Remote Control\rcHost.exe
C:\BVADMIN\SDO\BIN\SDSERV.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\BVADMIN\SDO\BIN\TRIGGAG.EXE
C:\Program\Compaq\COMPAQ~1\cpqdmi.exe
C:\SxpInst\sxplog32.exe
C:\WINDOWS\Explorer.EXE
C:\BVADMIN\SDO\BIN\triggusr.exe
C:\Program\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program\Compaq\EAB\EABSERVR.EXE
C:\Program\Compaq\Hotkey Software\hkss.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ltmsg.exe
C:\Program\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program\Real\RealPlayer\RealPlay.exe
C:\Program\Philips ToUcam Camera\VProperty.exe
C:\Program\QuickTime\qttask.exe
C:\Program\Network Associates\VirusScan\SHSTAT.EXE
C:\Program\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\Skype\Phone\Skype.exe
C:\Program\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program\ewido anti-malware\ewidoctrl.exe
C:\Program\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\rumewe01\Skrivbord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aftonbladet.se/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: UserInit=userinit,C:\SxpInst\sxplog32.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program\VirusBlast\BlastIEmonitor.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\Program\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [hkss] C:\Program\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [RealTray] C:\Program\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [2FFBk5wc] C:\WINDOWS\wtihof.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "c:\Program\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe
O9 - Extra 'Tools' menuitem: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe
O9 - Extra button: @C:\Program\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://knuten
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab28578.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1150059672787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1150059656824
O16 - DPF: {83873F92-B99B-400A-9E36-52B5F4970FB7} - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.comp...io5_3_16_0.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab28578.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: RCEnumDD.dll
O23 - Service: McAfee Alert Manager (AlertManager) - McAfee Division of Network Associates, Inc. - c:\Program\Network Associates\Alert Manager\amgrsrvc.exe
O23 - Service: Asset Management Agent (AmoAgent) - Computer Associates International, Inc. - C:\WINDOWS\UMCSTUB.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\Program\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: DM Primer (DMPrimer) - Unknown owner - C:\Program\CA\SharedComponents\DesktopCommonServic es\DMPrimer\dmprimer.exe" -DMPRIMER_SERVICE_: (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program\ewido anti-malware\ewidoctrl.exe
O23 - Service: Hibernation - Unknown owner - C:\Program\Compaq\COMPAQ~2\hibserv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - c:\Program\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - c:\Program\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\System32\PGPsdkServ.exe
O23 - Service: Unicenter Remote Control Host (rcHost) - Computer Associates International, Inc. - C:\Program\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Accociates, Intl Inc. - C:\BVADMIN\SDO\BIN\SDSERV.EXE
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

Uninstall_log...

Ad-Aware SE Personal
Adobe Reader 6.0 - Svenska
Agresso HKBRAD
America's Army
AmericasArmy
ArcSoft Camera Suite
ATI Display Driver
BV Meny
CA Unicenter Remote Control 6.0 ENU
Canon Camera Window for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon IXY 320, PowerShot S230, IXUS v3 WIA Driver
Canon PhotoRecord
Canon Utilities File Viewer Utility 1.2
Canon Utilities PhotoStitch 3.1
Canon Utilities RemoteCapture 2.7
Canon Utilities ZoomBrowser EX
CCleaner (remove only)
Cisco Systems VPN Client 4.0.2 (A)
Compaq Easy Access Buttons 3.00 D2
Compaq HotKey Support Software
Compaq Power Management
Compaq Security Management
Diagnostics for Windows
DivX
DivX Player
ewido anti-malware
Excursion
GameSpy Arcade
HijackThis 1.99.1
Hyena
Insight Management Agents
Intel(R) PRO Ethernet Adapter and Software
InterVideo WinDVD
Java 2 Runtime Environment Standard Edition v1.3.1
Java 2 Runtime Environment, SE v1.4.2_04
Lucent Win Modem
Macromedia Flash Player
Macromedia Flash Player 8
McAfee Alert Manager
McAfee VirusScan Enterprise
Microsoft .NET Framework (English)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Swedish Language Pack
Microsoft .NET Klientpolicy Knuten III
Microsoft Visio Professional
MSN Messenger 6.2
MSN Messenger 7.5
MSXML 4.0 SP2 Parser and SDK
MultiPoker
NETGEAR 108 Mbps Wireless PC Card WG511T
Network Stumbler 0.4.0 (remove only)
Nokia Connectivity Cable Driver
Nordsjö-Sadolin Vision 1.0
OFFICE XP
ORiNOCO OR Manager
PGP 8.0.2
Philips ToUcam Fun Camera
QuickTime
RealPlayer Basic
Remote Diagnostics Enabling Agent
SeeMePlayMe Client
SeeMePlayMe Client
Shockwave Player
Skype 2.0
Sniffer Basic 4.5
Spybot - Search & Destroy 1.4
Säkerhetsuppdatering för Windows XP (KB883939)
Säkerhetsuppdatering för Windows XP (KB896422)
Unicenter Service Desk
Unicenter Software Delivery
Windows Media Format Runtime
Windows Media Player 10
Windows Media-kodaren 9 Series
Windows Media-kodaren 9 Series
Windows Messenger 5.0
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB893066
WinRAR archiver
Winzip
Yahoo! Toolbar

Neal · #4 (**permalink**) 17-06-2006, 05:11 AM

HI,

Did you install this yourself?

Sniffer Basic 4.5

From add/remove program, uninstall:

GameSpy Arcade

Go here BitDefender and run an online scan with BitDefender (you will need to use Internet Explorer for this scan). When the ActiveX Control has loaded, click on "Click here to scan" and grab a coffee.

When BitDefender completes the scan, select the "Detected Problems" tab. Click on "Click here to export scan". Save the file as an HTML to your Desktop. Then click on the saved file and allow it to open with your browser. Go to Edit - Select All then copy/paste that log back here. Post back and let us know what it found (post the log).

And post a new HJT log also..

Sir_Angus · #5 (**permalink**) 20-06-2006, 11:02 PM

Hi,

I have deleted gamespy, sniffer basic was already in the pc when i bought it from work. Here is the log from bitfinder,

BitDefender Online Scanner

Scan report generated at: Tue, Jun 20, 2006 - 23:12:07

Scan path: C:\;D:\;

Statistics

Time
01

35

Files
261773

Folders
3026

Boot Sectors
2

Archives
4540

Packed Files
32825

Results

Identified Viruses
1

Infected Files
1

Suspect Files
2

Warnings
0

Disinfected
0

Deleted Files
3

Engines Info

Virus Definitions
388769

Engine build
AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

Scan plugins
13

Archive plugins
39

Unpack plugins
5

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP322\A0221492.exe
Infected with: BehavesLike:Win32.ExplorerHijack

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP322\A0221492.exe
Disinfection failed

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP322\A0221492.exe
Deleted

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP326\A0225267.msi=>(Embedded CAB)=>SZScnSvcDll
Suspected of: Generic.Malware.PV.C9539674

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP326\A0225267.msi=>(Embedded CAB)=>SZScnSvcDll
Disinfection failed

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP326\A0225267.msi=>(Embedded CAB)=>SZScnSvcDll
Deleted

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP326\A0225267.msi=>(Embedded CAB)
Update failed

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP328\A0226527.rbf
Suspected of: Generic.Malware.PV.C9539674

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP328\A0226527.rbf
Disinfection failed

C:\System Volume Information\_restore{54EC7185-8753-4DB3-B1AC-764EF12DEA60}\RP328\A0226527.rbf
Deleted

HJT log....

Logfile of HijackThis v1.99.1
Scan saved at 23:59:00, on 2006-06-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\UMCSTUB.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\Compaq\Compaq Management Agents\cpqalert.exe
C:\Program\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program\CA\SharedComponents\DesktopCommonServic es\DMPrimer\dmprimer.exe
C:\Program\ewido anti-malware\ewidoctrl.exe
C:\Program\Compaq\COMPAQ~2\hibserv.exe
C:\Program\Network Associates\Common Framework\FrameworkService.exe
c:\Program\Network Associates\VirusScan\mcshield.exe
c:\Program\Network Associates\VirusScan\vstskmgr.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\Program\CA\Unicenter Remote Control\rcHost.exe
C:\BVADMIN\SDO\BIN\SDSERV.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\BVADMIN\SDO\BIN\TRIGGAG.EXE
C:\Program\Compaq\COMPAQ~1\cpqdmi.exe
C:\SxpInst\sxplog32.exe
C:\WINDOWS\Explorer.EXE
C:\BVADMIN\SDO\BIN\triggusr.exe
C:\Program\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program\Compaq\EAB\EABSERVR.EXE
C:\Program\Compaq\Hotkey Software\hkss.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ltmsg.exe
C:\Program\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program\Real\RealPlayer\RealPlay.exe
C:\Program\Philips ToUcam Camera\VProperty.exe
C:\Program\QuickTime\qttask.exe
C:\Program\Network Associates\VirusScan\SHSTAT.EXE
C:\Program\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Documents and Settings\rumewe01\Skrivbord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aftonbladet.se/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
F2 - REG:system.ini: UserInit=userinit,C:\SxpInst\sxplog32.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program\VirusBlast\BlastIEmonitor.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\Program\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [hkss] C:\Program\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [RealTray] C:\Program\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ToUcamVProperty] C:\Program\Philips ToUcam Camera\VProperty.exe
O4 - HKLM\..\Run: [2FFBk5wc] C:\WINDOWS\wtihof.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "c:\Program\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe
O9 - Extra 'Tools' menuitem: MultiPoker - {641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - C:\Program\MultiPoker\MultiPoker.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @C:\Program\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://knuten
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab28578.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1150059672787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1150059656824
O16 - DPF: {83873F92-B99B-400A-9E36-52B5F4970FB7} - http://appdirectory.messenger.msn.co...haringctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.comp...io5_3_16_0.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab28578.cab
O20 - AppInit_DLLs: RCEnumDD.dll
O23 - Service: McAfee Alert Manager (AlertManager) - McAfee Division of Network Associates, Inc. - c:\Program\Network Associates\Alert Manager\amgrsrvc.exe
O23 - Service: Asset Management Agent (AmoAgent) - Computer Associates International, Inc. - C:\WINDOWS\UMCSTUB.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\Program\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Remote Diagnostics Enabling Agent (DfwWebAgent) - Hewlett-Packard - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: DM Primer (DMPrimer) - Unknown owner - C:\Program\CA\SharedComponents\DesktopCommonServic es\DMPrimer\dmprimer.exe" -DMPRIMER_SERVICE_: (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program\ewido anti-malware\ewidoctrl.exe
O23 - Service: Hibernation - Unknown owner - C:\Program\Compaq\COMPAQ~2\hibserv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - c:\Program\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - c:\Program\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\System32\PGPsdkServ.exe
O23 - Service: Unicenter Remote Control Host (rcHost) - Computer Associates International, Inc. - C:\Program\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Accociates, Intl Inc. - C:\BVADMIN\SDO\BIN\SDSERV.EXE
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

Thanks again...

Neal · #6 (**permalink**) 21-06-2006, 11:52 PM

Hi, glad it is quicker, let's do a little cleanup in hijackthis now.

Run HJT and click scan button and put checks next to these:

O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program\VirusBlast\BlastIEmonitor.dll (file missing)

You can fix these in blue below if you did not set these restrictions yourself or an administarter

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Nothing open but HJT and click fix checked

Now reboot into safe mode by tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter.

Navigate to these files or folders using Windows Explorer (OR Start -> Search) and delete (if present):

DELETE FOLDERS

If present

C:\Program\VirusBlast

Reboot normal mode and tell me how your computer is behaving now. Thanks.

Sir_Angus · #7 (**permalink**) 10-07-2006, 07:40 PM

Hi Neal, sorry it has taken a wee while to get back to you. Have now done the last of what you have written and the PC is working a treat. All I can now do is give a big thank you for all the help you have given me.

Thanks.

Neal · #8 (**permalink**) 10-07-2006, 07:53 PM

You are quite welcome,

If you are no longer having any more trouble here is some preventative measures for you.

Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.

Read This First - IMPORTANT Instructions

Flush your restore points in ME and XP, by turning System Restore off and then back on.
This will create a fresh restore point.

Explained Here:
Windows XP: http://vil.nai.com/vil/SystemHelpDoc...ysRestore.aspx

Explained Here
Microsoft ME:
http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

RegProtect

This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry.

You have the option of allowing(good) items or blocking(bad)items.

http://www.diamondcs.com.au/index.php?page=regprot

To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:

1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser.
http://v5.windowsupdate.microsoft.co....aspx?ln=en-us

http://www.microsoft.com/windows/ie/default.asp

2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!.
AVG: http://free.grisoft.com/doc/1

Avast: http://www.avast.com/eng/avast_4_home.html

3. In addtion to using Ad-aware consider using another free malware scanning/removal program:
Windows Defender

http://www.microsoft.com/athome/secu...e/default.mspx

4. Consider using a free firewall if you are not already using one. Some good free ones are:
Kerio
http://www.sunbelt-software.com/Kerio.cfm

OutPost Personal Firewall:
Outpost

5. Consider using an alternate free browser for general web surfing but you must use IE for windows update.
Mozilla Firefox: www.mozilla.org/products/firefox/

6. Consider increasing your browser security by using these programs:
SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:

http://www.javacoolsoftware.com/spywareblaster.html

If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/

IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here:
https://netfiles.uiuc.edu/ehowes/www/resource.htm

Block access to Untrustworthy Sites

You can prevent your computer from visiting a myriad of untrustworthy sites and ad-servers by installing a customised hosts file. One of the best available is the: MVPS Hosts File. Simply follow the instructions to install the file in the correct location. This will not only make surfing safer but will improve website load times and block popups from many of the large ad-servers.

*Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free