[Achilles5784]

Ok... A few weeks ago I got some really bad spyware that changed my desktop to a "you have been infected" message and started "Winhound Spyware Remover"

I immediatly did a sytem restore and everything seemed fine. But today I was starting an online game and my game minimized to the very same thing again. Changed wallpaper and winhound. This time I did a restore to an even earlier date. It went through the restore fine, then when I try to log on it says. "The application failed to initialize properly (0xc00000005)". It gives that error twice and then logs in. But nothing shows up accept my original wallpaper. What can I do?





Logfile of HijackThis v1.99.1
Scan saved at 2:46:24 PM, on 12/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\achilles\Desktop\Hijackthis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Microsoft Windows System] vvdypahf.exe
O4 - HKLM\..\Run: [links] links.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\system32\intell32.exe
O4 - HKLM\..\Run: [WinHound] C:\Program Files\WinHound\WinHound.exe
O4 - HKLM\..\RunServices: [Microsoft Windows System] vvdypahf.exe
O4 - HKLM\..\RunOnce: [*Restore] C:\WINDOWS\system32\restore\rstrui.exe -i
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [srshost.exe] C:\WINDOWS\system32\srshost.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

[Advertisements]

Hi and welcome to Geeks to Go. I suspect you have a malware problem. Work your way through the malware removal guide (link is at the top of this forum) or use this one http://www.geekstogo...?showtopic=2852. This enables folks to solve most problems on their own. If you still have trouble after that, post a hijack this log in the malware forum at
http://www.geekstogo...o-Here-f37.html

[austin_o]

Hi and welcome to Geeks to Go. I suspect you have a malware problem. Work your way through the malware removal guide (link is at the top of this forum) or use this one http://www.geekstogo...?showtopic=2852. This enables folks to solve most problems on their own. If you still have trouble after that, post a hijack this log in the malware forum at
http://www.geekstogo...o-Here-f37.html

[Achilles5784]

ok avg found i virus in the "wininet.dll" file in the C:\windows\system32. I deleted it and downloaded another. But, there was also an infected file called __delete_on_reboot__oleext.dll It is still infected. Can I delete this file or what should I do?

By the way thanks for the help. I went through the whole list and it found dif. things. The delete on reboot thing showed up several time but I havent got rid of it yet. My windows explorer works though Thanks guys

Edited by Achilles5784, 25 December 2005 - 10:38 AM.

[gerryf]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.