[ram_hyd]

Hello,

I am getting windows installer message repeteadly. Please help me on this. I am posting my Hijack this log file:

Logfile of HijackThis v1.99.1
Scan saved at 12:03:02 PM, on 8/15/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchosta.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\sistray.EXE
C:\WINNT\System32\khooker.exe
C:\WINNT\System32\pctspk.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\WINNT\system32\msiexec.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\hjt\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINNT\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [autostart] svchosta.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\RunServices: [autostart] svchosta.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123912953894
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: autostart - Unknown owner - C:\WINNT\System32\svchosta.exe" -service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


Regards
Ram

[Advertisements]

Heya, ram, and welcome to Geeks to Go. My name is Guse and I'll be helping you today.

You've got yourself a nasty little virus called Troj/I-Sniffer. At first glance, I see that you have Norton Anti-virus. That's good.

First things first, make sure that your virus scanner definitions are up to date. That's the most important step in this process.

Next, I'd like you to reboot into safe mode. You can do this by restarting your computer and tapping F8 several times after you hear the first "beep" from your machine.

Once in Safe Mode, run HijackThis again and place checks next to the following entries:

O4 - HKLM\..\Run: [autostart] svchosta.exe
O4 - HKLM\..\RunServices: [autostart] svchosta.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O23 - Service: autostart - Unknown owner - C:\WINNT\System32\svchosta.exe" -service (file missing)

Next, using Windows Explorer, Find and delete the following file (if it still exists):

BE VERY CAREFUL HERE. THERE IS A REQUIRED SYSTEMS FILE CALLED SVCHOST.EXE. YOU'RE LOOKING FOR SVCHOSTA.EXE. THAT "A" ON THE END IS VITAL. IF YOU CAN'T FIND A FILE CALLED SVCHOSTA.EXE WITH THE A, DO NOTHING AND TELL ME.
C:\WINNT\System32\svchosta.exe

Now, run a full virus scan with Norton. Don't get impatient, just wait as long as it takes.

When it's all done, reboot into normal mode and run another HijackThis log and post it here by clicking "Add Reply"

[Guse]

Heya, ram, and welcome to Geeks to Go. My name is Guse and I'll be helping you today.

You've got yourself a nasty little virus called Troj/I-Sniffer. At first glance, I see that you have Norton Anti-virus. That's good.

First things first, make sure that your virus scanner definitions are up to date. That's the most important step in this process.

Next, I'd like you to reboot into safe mode. You can do this by restarting your computer and tapping F8 several times after you hear the first "beep" from your machine.

Once in Safe Mode, run HijackThis again and place checks next to the following entries:

O4 - HKLM\..\Run: [autostart] svchosta.exe
O4 - HKLM\..\RunServices: [autostart] svchosta.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O23 - Service: autostart - Unknown owner - C:\WINNT\System32\svchosta.exe" -service (file missing)

Next, using Windows Explorer, Find and delete the following file (if it still exists):

BE VERY CAREFUL HERE. THERE IS A REQUIRED SYSTEMS FILE CALLED SVCHOST.EXE. YOU'RE LOOKING FOR SVCHOSTA.EXE. THAT "A" ON THE END IS VITAL. IF YOU CAN'T FIND A FILE CALLED SVCHOSTA.EXE WITH THE A, DO NOTHING AND TELL ME.
C:\WINNT\System32\svchosta.exe

Now, run a full virus scan with Norton. Don't get impatient, just wait as long as it takes.

When it's all done, reboot into normal mode and run another HijackThis log and post it here by clicking "Add Reply"

[Guse]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.