[TheDonkey]

Hello

I have recently had a few problems with spyware, constant popups, a new search bar and another big blue search bar at the bottom.

I have followed your read this first guide, which seems to have stopped it. Would it be ok if one of you lovely experts checks through this log to ensure i have properly cleaned my computer?

Logfile of HijackThis v1.99.1
Scan saved at 01:48:19, on 07/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver\RtlWake.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe
C:\Documents and Settings\Harry\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lazxnrhhp...L0QyYaF0vP.html
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: RtlWake.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

Thanks a lot in advance

Harry John

[Advertisements]

Hello and welcome to GTG!

Download
CleanUp

Run the CleanUp! installer and get the program ready to be used but don't run it yet.

I can still see signs of LOP on your log.

Let's get rid of it.

We will need to uninstall Messenger Plus sponser program.

1. Click on the "Start" button in the lower-left corner of your screen and choose "Control Panel".

2. Choose "Add or Remove Programs" in your Control Panel. A list of all your installed programs will pop up.

3. Select "Messenger Plus! 3" in the software list and click the "Change/Remove" button.

4. You will be asked what you want to remove when you have installed Messenger Plus! with the optional sponsor. Choose "Uninstall the sponsor program only".

5. When you uninstall Plus! you are asked if you want to keep your settings and/or Plus! plugins in case you want to re-install Plus!. Uncheck the boxes in front of the options to keep it.

6. Press "Uninstall" to remove Messenger Plus!

(Messenger will be shutdown if open.)

7. An additional window will pop up when you chose to uninstall the sponsor program. Type over the verification code in the empty box and press "UNINSTALL" to completely remove the sponsor program.

8. The uninstall procedure is complete, press "Close" when you're done.

Now run CleanUp! making sure to reboot when prompted.

Boot up into normal mode.

Run this online scan & post it's results here along with a fresh HiJackThis log;
Panda Activescan

- Rawe

[Rawe]

Hello and welcome to GTG!

Download
CleanUp

Run the CleanUp! installer and get the program ready to be used but don't run it yet.

I can still see signs of LOP on your log.

Let's get rid of it.

We will need to uninstall Messenger Plus sponser program.

1. Click on the "Start" button in the lower-left corner of your screen and choose "Control Panel".

2. Choose "Add or Remove Programs" in your Control Panel. A list of all your installed programs will pop up.

3. Select "Messenger Plus! 3" in the software list and click the "Change/Remove" button.

4. You will be asked what you want to remove when you have installed Messenger Plus! with the optional sponsor. Choose "Uninstall the sponsor program only".

5. When you uninstall Plus! you are asked if you want to keep your settings and/or Plus! plugins in case you want to re-install Plus!. Uncheck the boxes in front of the options to keep it.

6. Press "Uninstall" to remove Messenger Plus!

(Messenger will be shutdown if open.)

7. An additional window will pop up when you chose to uninstall the sponsor program. Type over the verification code in the empty box and press "UNINSTALL" to completely remove the sponsor program.

8. The uninstall procedure is complete, press "Close" when you're done.

Now run CleanUp! making sure to reboot when prompted.

Boot up into normal mode.

Run this online scan & post it's results here along with a fresh HiJackThis log;
Panda Activescan

- Rawe

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.