[Johnny Winters]

I will tell you all right now that i have Windows XP. Iv googled EVERY website to do with the Ping.exe process to figure out a way to remove it. I got about 5-6 anti virus scanners on my PC that iv done used and had no luck in even finding it on my PC. I even YouTubed it. I found some videos about how to remove it but they was only for Windows Vista and 7. There is another post about this virus here in this forum but it has been closed so i could not reply to it. I think there was only 2 posts. The one like mine asking how to get rid of the virus. And then another guy that told him all these programs to download. I downloaded ALL of them plus more that i heard about in other forums. The programs are all pro and payed for programs. DON'T ask lol. But if any of you know how to remove this virus from the Ping.exe file (process) then please let me know. I have a Dell Dimension E310 with Windows XP. PLEASE for the love of God please tell me how to get rid of this virus before my CPU burns up!!! I even Deleted the file from the system32 folder and it auto replaced its self and the virus is still there. Thanks!!

HijackThis Report!!!


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:11:58 PM, on 11/8/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17103)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IObit\Game Booster\gbtray.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?l=dis&o=15866
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: Switch to Gaming Mode.lnk = C:\Program Files\IObit\Game Booster\GameBooster.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Switch to Gaming Mode.lnk = C:\Program Files\IObit\Game Booster\GameBooster.exe (User 'Default user')
O4 - Startup: Switch to Gaming Mode.lnk = C:\Program Files\IObit\Game Booster\GameBooster.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {7417F730-7BAB-409E-8BB7-6936D361B869} (MLauncher Class) - http://csweb.netgame...n/MLauncher.cab
O16 - DPF: {99CAAA27-FA0C-4FA4-B88A-4AB1CC7A17FE} (MGLaunch_v1004 Class) - http://www.netgame.c...ch_USAv1005.cab
O20 - Winlogon Notify: mwusbw32 - mwusbw32.dll (file missing)
O20 - Winlogon Notify: vmwusb - mwusbw32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--
End of file - 4587 bytes


As you can see you dont see the Ping.exe file running. When i restart my PC it takes a little bit for it to start up. This is really the longest its taken. Maybe ill be lucky lol. I thought the same thing earlyer when i restarted it. It took only 5 minutes for it to start running. O and i dont use Internet Explorer. I use Firefox. Just incase if that matters some how.

Here are some of the websites iv looked at.

http://free.antiviru...clean-up-tools/

https://www.google.c...lient=firefox-a

http://www.bleepingc...nti-virus/rkill

http://www.geekstogo...virus-detected/

http://answers.yahoo...03203536AAOxulp

There is still alot i checked that i did not bookmark. I will keep editing this first post telling you all what i been doing to try and fix this thing.

Edited by Johnny Winters, 08 November 2011 - 02:18 PM.

[Advertisements]

Hi there no need to look elswhere, Hijackthis does not give sufficient data to work with so.........

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[Essexboy]

Hi there no need to look elswhere, Hijackthis does not give sufficient data to work with so.........

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[Johnny Winters]

I thought it was rkill that did it. It was this program I think that did it.

http://public.avast....erek/aswMBR.htm

These are the anti virus programs that i downloaded and used. Not really all are anti virus but i got some that finds problems with rootkits,malware removers,bot finders. Here is the names. I will put a <----- next to the ones that every one should try to get rid of the Ping.exe virus.

Microsoft Security Essentials
Advanced SystemCare 3
IObit Security 360 <----
RUBotted
HiJackThis <----
tdsskiller
cwshredder <----
TuneUp Utilities 2011
aswMBR <----
rkill <----
OTL <----
AVG Anti-Virus Professional 9.0
ESET NOD 32 Anti-Virus 4.0.468.0
Norton.Internet.Security.2012.and.Anti-Virus.2012
http://housecall.trendmicro.com/
Trend Micro RootkitBuster

I guess 16 programs lol. Some was missing from the Download folder lol. I went to about 15-20 websites following every ones advice.

[Essexboy]

Could you post the3 OTL log and I will confirm that it has gone

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.