[Nelis]

Hi GeeksToGo Staff!

First of all, i think its a great thing what ur doing here helping people for free!

I recently have got some serious infections on my computer and i tried anything so i googled and this website came up, i looked at some other post who had the same problem, i tried the things that where said there but i still got the probs..

Anyway, the weird things that are happening on my computer are a bit hard to explain but i'll try;
Sometimes a cmd window opens and it starts to make lines of text like: cant find file etc.
and then a window pops up, sometimes from microsoft and sometimes Symantec.
I dont thinks its really there ads not because the look of it but its just too weird.
And another problem my internet connection is very slow and after like 3 minutes it just stops working.
When i open my browser (firefox) it just sais "done" at the bottom and i cant do anything but reboot or disconnect and reconnect my USB modem..

I did evrything you said on the previous page with Spybot, adaware, ewido, cleanup etc.
But is still got the same probs..

Heres my Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 14:40:54, on 26-7-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\Edit.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\oreu\nsep.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Documents and Settings\Nelis\Bureaublad\Zooi\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {BC05181A-D5FE-DC28-D10E-8CADDCBE76C0} - C:\WINDOWS\System32\krc.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe" -run -n PersonalPro -v 5.0.0.0 -chkss
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [Wirs] C:\Program Files\oreu\nsep.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: hexadecimal (HexadecimaRepresentation) - Unknown owner - C:\WINDOWS\Edit.exe
O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)

And here's my Ewido scan log:

---------------------------------------------------------
ewido security suite - Scan rapport
---------------------------------------------------------

+ Gemaakt op:  13:47:34, 26-7-2005
+ Rapport samenvatting:  6B50D689

+ Scan resultaten:

:mozilla.8:C:\Documents and Settings\Nelis\Application Data\Mozilla\Firefox\Profiles\o3iuw9ga.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Schoongemaakt met een backup
:mozilla.33:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
:mozilla.34:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
:mozilla.35:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
:mozilla.37:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
:mozilla.38:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
:mozilla.46:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Burstnet : Schoongemaakt met een backup
:mozilla.47:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Burstnet : Schoongemaakt met een backup
:mozilla.73:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.74:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.75:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
  ->  : Fout gedurende het schoonmake
:mozilla.77:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.82:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Revenue : Schoongemaakt met een backup
:mozilla.101:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Sitestat : Schoongemaakt met een backup
:mozilla.105:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Googleadservices : Schoongemaakt met een backup
:mozilla.148:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
:mozilla.149:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
:mozilla.150:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
:mozilla.151:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
:mozilla.152:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
:mozilla.153:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
:mozilla.187:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.189:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.190:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.197:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Sitestat : Schoongemaakt met een backup
:mozilla.198:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.199:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.208:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.209:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.210:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.211:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.212:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Adengage : Schoongemaakt met een backup
  ->  : Fout gedurende het schoonmake
:mozilla.214:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Adengage : Schoongemaakt met een backup
:mozilla.219:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Statcounter : Schoongemaakt met een backup
:mozilla.220:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Statcounter : Schoongemaakt met een backup
:mozilla.275:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Clickhype : Schoongemaakt met een backup
:mozilla.284:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Sexcounter : Schoongemaakt met een backup
:mozilla.285:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Sexcounter : Schoongemaakt met een backup
:mozilla.309:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.310:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.311:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.312:C:\Documents and Settings\Niels van Dijk\Application Data\Mozilla\Firefox\Profiles\a0mwaqg4.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll -> Spyware.WinAD : Schoongemaakt met een backup
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8X2JOHY3\bridge-c7[1].cab/MediaGatewayX.dll -> Spyware.WinAD : Schoongemaakt met een backup
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OLQV0P6B\MediaTicketsInstaller[1].cab/MediaTicketsInstaller.ocx -> Spyware.MediaTickets : Schoongemaakt met een backup


::Einde rapport

I really hope you can help me..

Thanks, Niels van Dijk

[Advertisements]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[Buckeye_Sam]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[Nelis]

I understand your very busy. I resolved the mainproblem allready but it wouldt hurt to post a new log so that i know for sure i have no other crap
So here it is:

Logfile of HijackThis v1.99.1
Scan saved at 16:16:29, on 29-7-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Nelis\Bureaublad\Zooi\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zonnet.nl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [Microsoft Update] msconfg.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai...all/xscan53.cab
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)

[Buckeye_Sam]

Your log shows you have Windows Media Player running at the time you ran Hijackthis. Sometimes this can indicate an infection if you were not using WMP. Let me know.

There are a few bad entries in your log that we need to remove.

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R3 - Default URLSearchHook is missing
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [Microsoft Update] msconfg.exe


Reboot and post a new hijackthis log.

[Buckeye_Sam]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.