[Spils]

Logfile of HijackThis v1.99.1
Scan saved at 17:02:53, on 12/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\xcdlwe.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\telcom.exe
C:\WINDOWS\etb\pokapoka63.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\D3D3DTwkAnim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\mmc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Lee\LOCALS~1\Temp\Rar$EX00.813\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sygate.co...t/spf50_reg.htm
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Microsoft Telecom Center] telcom.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [qnffsa] C:\WINDOWS\System32\xcdlwe.exe r
O4 - HKLM\..\RunServices: [Microsoft Telecom Center] telcom.exe
O4 - HKLM\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKCU\..\Run: [Microsoft Telecom Center] telcom.exe
O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123691352875
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

[Advertisements]

Hi Spils,

Please print out these instructions or copy them into a text file on your Desktop for easy access.

During the fix, u will be asked to fix some entries, delete some files or uninstall some programs. If in case, you do not see those entries / files / programs, please make a note of it. Continue with the fix and in your next post please inform me of all deviations from the fix prescribed.

1. Download Programs

Please download these programs and save them in a new folder on your desktop -

CleanUp
Ewido Security Suite

Install Ewido, and update the definitions to the newest files. Do NOT run a scan yet.

Nailfix.exe


2. Remove Infections

Restart the PC in Safe Mode (repeatedly tap the F8 key when the PC is starting up).

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.


Run CleanUp and delete all temp files including temporary internet files

Run Ewido full scan. Let it fix any items it finds.

3. Run Hijack This

Run Hijack This and click on scan. The following items need to be fixed -

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Microsoft Telecom Center] telcom.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKLM\..\Run: [qnffsa] C:\WINDOWS\System32\xcdlwe.exe r
O4 - HKLM\..\RunServices: [Microsoft Telecom Center] telcom.exe
O4 - HKLM\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKCU\..\Run: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKCU\..\Run: [Microsoft Telecom Center] telcom.exe
O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe


Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.

4. Delete Rogue files

Open Add or Remove Programs (click on Start ---> Settings ---> Control panel. This should be the 3rd item). Uninstall or remove the following items -


Open Windows Explorer (right click on Start and then click on explore). Locate and delete the following folders and files -

Folders
C:\WINDOWS\etb

Files
C:\WINDOWS\System32\xcdlwe.exe

telcom.exe
msconfig32.exe
(Search for these files using the Windows Search function)


Clear out the files in the Prefetch folder. Go to start> run> type into the box Prefetch. It will open the folder Prefetch. Delete all the files in that folder. Dont delete the folder, only the files in it !!!!!!!!


Reboot the PC in Normal Mode.


Run Hijack This and post a fresh HJT log along with Ewido scan report.

[tampabelle]

Hi Spils,

Please print out these instructions or copy them into a text file on your Desktop for easy access.

During the fix, u will be asked to fix some entries, delete some files or uninstall some programs. If in case, you do not see those entries / files / programs, please make a note of it. Continue with the fix and in your next post please inform me of all deviations from the fix prescribed.

1. Download Programs

Please download these programs and save them in a new folder on your desktop -

CleanUp
Ewido Security Suite

Install Ewido, and update the definitions to the newest files. Do NOT run a scan yet.

Nailfix.exe


2. Remove Infections

Restart the PC in Safe Mode (repeatedly tap the F8 key when the PC is starting up).

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.


Run CleanUp and delete all temp files including temporary internet files

Run Ewido full scan. Let it fix any items it finds.

3. Run Hijack This

Run Hijack This and click on scan. The following items need to be fixed -

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Microsoft Telecom Center] telcom.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKLM\..\Run: [qnffsa] C:\WINDOWS\System32\xcdlwe.exe r
O4 - HKLM\..\RunServices: [Microsoft Telecom Center] telcom.exe
O4 - HKLM\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKCU\..\Run: [Compaq32 Service Drivers] msconfig32.exe
O4 - HKCU\..\Run: [Microsoft Telecom Center] telcom.exe
O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] msconfig32.exe


Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.

4. Delete Rogue files

Open Add or Remove Programs (click on Start ---> Settings ---> Control panel. This should be the 3rd item). Uninstall or remove the following items -


Open Windows Explorer (right click on Start and then click on explore). Locate and delete the following folders and files -

Folders
C:\WINDOWS\etb

Files
C:\WINDOWS\System32\xcdlwe.exe

telcom.exe
msconfig32.exe
(Search for these files using the Windows Search function)


Clear out the files in the Prefetch folder. Go to start> run> type into the box Prefetch. It will open the folder Prefetch. Delete all the files in that folder. Dont delete the folder, only the files in it !!!!!!!!


Reboot the PC in Normal Mode.


Run Hijack This and post a fresh HJT log along with Ewido scan report.

[Spils]

Logfile of HijackThis v1.99.1
Scan saved at 18:12:05, on 12/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\gauquv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Lee\LOCALS~1\Temp\Rar$EX00.156\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sygate.co...t/spf50_reg.htm
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [bbmbeqv] C:\WINDOWS\System32\gauquv.exe r
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123691352875
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

[tampabelle]

Can you post the Ewido scan log also ???

[Spils]

somthings not right avast is still going mad


wido security suite - Scan report
---------------------------------------------------------

+ Created on: 18:33:27, 12/08/2005
+ Report-Checksum: 2678D800

+ Scan result:

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon -> Spyware.BetterInternet : Cleaned without backup
[688] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned without backup
[732] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[900] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1084] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1436] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1496] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1688] C:\WINDOWS\system32\DrPMon.dll -> Adware.BetterInternet : Cleaned without backup
[1776] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1784] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1792] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1824] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1864] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1872] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
[1924] C:\WINDOWS\System32\gauquv.exe -> Trojan.Agent.cp : Cleaned without backup
:mozilla.10:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned without backup
:mozilla.12:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned without backup
:mozilla.13:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned without backup
:mozilla.14:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned without backup
:mozilla.24:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned without backup
:mozilla.25:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned without backup
:mozilla.26:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned without backup
:mozilla.27:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned without backup
:mozilla.34:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned without backup
:mozilla.35:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned without backup
:mozilla.36:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned without backup
:mozilla.37:C:\Documents and Settings\Lee\Application Data\Mozilla\Firefox\Profiles\bfw9lr9l.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned without backup
C:\Documents and Settings\Lee\Cookies\lee@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Cleaned without backup
C:\Documents and Settings\Lee\Cookies\[email protected][1].txt -> Spyware.Cookie.Yieldmanager : Cleaned without backup
C:\Documents and Settings\Lee\Cookies\lee@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned without backup
C:\Documents and Settings\Lee\Cookies\lee@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned without backup
C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned without backup


::Report End

[tampabelle]

Did you have problems in downloading or running Nailfix ???? The associated infection is still there !!!!!

please let me know if there was any deviation from the fix !!! Please note that most of the fix was to be done in Safe Mode !!!!!

[Spils]

as far as i no yes it was fine

Ill redo it all again from start to finsh and repost my two logs for u later on tonight....

Edited by Spils, 11 August 2005 - 11:49 AM.

[tampabelle]

Susre, run the fix again and post back the logs.

[Spils]

Logfile of HijackThis v1.99.1
Scan saved at 22:06:39, on 12/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\uvqvuqk.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Lee\LOCALS~1\Temp\Rar$EX00.922\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sygate.co...t/spf50_reg.htm
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [gfbwmn] C:\WINDOWS\System32\uvqvuqk.exe r
O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123691352875
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 22:06:39, on 12/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\uvqvuqk.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Lee\LOCALS~1\Temp\Rar$EX00.922\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sygate.co...t/spf50_reg.htm
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [gfbwmn] C:\WINDOWS\System32\uvqvuqk.exe r
O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123691352875
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

[tampabelle]

Lets try another way of getting the infection out.


Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")
• Exit ewido. DO NOT scan yet.

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Download CleanUp
Install the program, dont run it yet, we will later.

Please download this file: Nailfix Utility
Save it to your desktop.
DO NOT run it yet.

Download dsrfix.zip
Save it to your desktop.

• Unzip dsrfix.zip and extract it to your desktop.
• This will create a new folder on your desktop named dsrfix.
• Do Not open that folder yet.

Please download APT and unzip the contents to a new folder on your desktop.

• Open the folder you just created and click on apt.exe and search in the window for C:\WINDOWS\System32\uvqvuqk.exe.
• Open your C:\Windows\system32 folder and search for uvqvuqk.exe.
  Don't delete it yet, just leave the system32 folder open so you can see the bad file.
• In APT again, Select C:\WINDOWS\System32\uvqvuqk.exe and Click Kill3
  
• Then immediately delete uvqvuqk.exe from your system32 folder.

Close APT.

To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, start tapping press F8 key.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now open ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Now scan with HJT and place a checkmark next to each of the following items:

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [gfbwmn] C:\WINDOWS\System32\uvqvuqk.exe r

Close all open windows except for HJT, then click the Fix Checked button. Close HJT.

Now open the folder dsrfix on your desktop.

• Double-Click on dsrfix.bat
• A window will pop up briefly then close, this is normal.

Enable show hidden files and folders:

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK

Now run the CleanUp program:

*IMPORTANT NOTE*
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Running CleanUp

• Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• When CleanUp starts go to the Options button (right side of CleanUp screen)
• Move the arrow down to "Custom CleanUp!"
• Now place a checkmark next to the following (Make sure nothing else is checked!):
  • Delete Cookies
    This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
  • Empty Recycle Bins
  • Delete Prefetch files
  • Cleanup! All Users
• Click OK
• Then click on the CleanUp button. This will take a short while, let it do its thing.
• When asked to reboot system select No
• Close CleanUp

Finally, restart your computer back into Normal Mode and please post a new HJT log, as well as the ewido report log from the Ewido scan by using Add Reply

[Spils]

Ive done all steps above but avast is still telling me there malware there

heres my logs

Logfile of HijackThis v1.99.1
Scan saved at 21:44:35, on 13/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Logfile of HijackThis v1.99.1
Scan saved at 22:04:54, on 13/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\D3D3DTwkAnim.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\System32\oyzsoqa.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Lee\Desktop\for malware fixes\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sygate.co...t/spf50_reg.htm
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [Hercules 3DTweaker 3.0] C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe -hide
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize314.exe"
O4 - HKLM\..\Run: [rpdmvkf] C:\WINDOWS\System32\oyzsoqa.exe r
O4 - HKCU\..\Run: [AtiTrayTools] C:\Program Files\Radeon Omega Drivers\v2.6.53\ATI Tray Tools\atitray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123691352875
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe



---------------------------------------------------------
ewido security suite - Process report
---------------------------------------------------------

+ Created on: 21:49:28, 13/08/2005
+ Report-Checksum: 67BEA89D

0: System Process
4: System Process
176: C:\Program Files\Messenger\MSMSGS.EXE
196: C:\Program Files\MSN Messenger\MsnMsgr.Exe
280: C:\WINDOWS\System32\byzgonz.exe
524: C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
552: C:\Program Files\Alwil Software\Avast4\ashServ.exe
604: \SystemRoot\System32\smss.exe
668: \??\C:\WINDOWS\system32\csrss.exe
692: \??\C:\WINDOWS\system32\winlogon.exe
736: C:\WINDOWS\system32\services.exe
748: C:\WINDOWS\system32\lsass.exe
752: C:\Program Files\ewido\security suite\ewidoctrl.exe
904: C:\WINDOWS\System32\Ati2evxx.exe
952: C:\WINDOWS\system32\svchost.exe
1052: C:\WINDOWS\System32\svchost.exe
1088: C:\Program Files\Sygate\SPF\smc.exe
1332: C:\WINDOWS\system32\Ati2evxx.exe
1412: C:\WINDOWS\Explorer.EXE
1420: C:\WINDOWS\System32\svchost.exe
1484: C:\WINDOWS\System32\svchost.exe
1716: C:\WINDOWS\system32\spoolsv.exe
1916: C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
1932: C:\Program Files\Hercules\Video\Hercules 3DTweaker 3.0 LE (Build 25)\H3dTweaker.exe
1940: C:\WINDOWS\System32\CTHELPER.EXE
1972: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
2216: C:\WINDOWS\System32\wdfmgr.exe
2412: C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
2644: C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
2680: C:\program files\internet explorer\iexplore.exe
2720: C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
2900: C:\WINDOWS\System32\wbem\wmiprvse.exe
3752: C:\Program Files\ewido\security suite\SecuritySuite.exe
4020: C:\WINDOWS\System32\taskmgr.exe

Edited by Spils, 12 August 2005 - 03:08 PM.

[Spils]

anyone help please ?? this is really doing me nut in just unsure were im going wrong...

[tampabelle]

Hi Spils,

Two things -


1. I am helping you. In order to minimise confusion, other staff members will not step in. In case I have any issues with the infection, I will seek their help myself.

2. I am a human being. Please do not expect me to keep my eyes glued to the PC monitor expecting a reply from you every instant. What do I do if you decide to take a nap ?? I check the logs that I am handling frequently but not continuously. I also have a life outside this forum. This requires me to leave my PC. I also need to sleep everyday !!!!!

Why is it OK for you to reply back today, when I posted the fix yesterday evening, when you expect me to post back within an hour of your reply !!!!!!!!!!!!!!!



In case there is a small delay in my reply, be patient. I will come back with a reply sooner or later. Also please do not start new topics as this would only create more confusion.

I know by looking at the logs that you have posted that your PC is not yet clean !!!!! Did Avast tell you which files are infected ?? or what infections are there on your PC ??


Now for the fix -




Run Hijack This and click on scan. The following items need to be fixed -

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize314.exe"

Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.


Please download APT and unzip the contents to a new folder on your desktop.

• Open the folder you just created and click on apt.exe and search in the window for C:\WINDOWS\System32\oyzsoqa.exe.
• Open your C:\Windows\system32 folder and search for oyzsoqa.exe.
  Don't delete it yet, just leave the system32 folder open so you can see the bad file.
• In APT again, Select C:\WINDOWS\System32\oyzsoqa.exe and Click Kill3
  
• Then immediately delete oyzsoqa.exe from your system32 folder.

Close APT.

Restart the PC in Safe Mode (repeatedly tap the F8 key when the PC is starting up).


Open Add or Remove Programs (click on Start ---> Settings ---> Control panel. This should be the 3rd item). Uninstall or remove the following items -

Internet Optimizer

Open Windows Explorer (right click on Start and then click on explore). Locate and delete the following folder -

C:\Program Files\Internet Optimizer\


Reboot the PC in Normal Mode.


Run Hijack This and post a fresh HJT log.

Please visit Panda and do an online scan. Save the scan report.

Run Hijack This and post a fresh HJT log along with Panda scan report.

Edited by tampabelle, 12 August 2005 - 04:06 PM.

[Spils]

Hi Spils,

Two things -
1. I am helping you. In order to minimise confusion, other staff members will not step in. In case I have any issues with the infection, I will seek their help myself.

2. I am a human being. Please do not expect me to keep my eyes glued to the PC monitor expecting a reply from you every instant. What do I do if you decide to take a nap ?? I check the logs that I am handling frequently but not continuously. I also have a life outside this forum. This requires me to leave my PC. I also need to sleep everyday !!!!!

sorry m8 just firday night im trying to use my pc and its doing me nut in.. Im new here i didnt no u had a system were only one person deals with each problem to stop confusion... makes sense but i didnt no again im sorry...

[tampabelle]

Please continue with the fix and post back the logs. Also let me know what Avast says about the infections it finds