[Excal]

Hi shipley.c,

Seems we have a stubborn one. Lets do this:

I need you to copy all of the Killbox instructions below and paste them into Notepad and save it.

* Please download the Killbox by Option^Explicit.

* Save it to your desktop.

* Run Killbox.exe.

* Select "Delete on Reboot".

* Open the Notepad file where you saved these instructions earlier, and copy the file names below to the clipboard by highlighting ALL of them then press CTRL + C

C:\windows\system32\eliteyrv32.exe

* Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

* Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt. If your computer does not restart automatically, please restart it manually

Please post a fresh HiJacklog

[Advertisements]

Hey Excal,

Sorry for not posting sooner, but I've run into a situation with that process and I wanted to make sure I made reasonable efforts to make it happen. the file C:\windows\system32\eliteyrv32.exe doesn't exist on the computer. I've shown hidden files, including system files in XP. I followed procedure. I also did a cmd prompt dir of the directory after showing files for elite*.exe, nothing showed up. I also typed in the filename in the Killbox input field. Everytime I finished a directory, Killbox identified it as a directory, but it did not identify eliteyrv32.exe as a file (as it does with files that do exist on the computer).

Here's my thought... there is still a .dll out on the PC somewhere that is loading that registry setting independent of the file being there. Just a gut feeling.

Do you think that if I ran TeaTimer to monitor changes like that, I could find out which one is doing it? Remove the entry with HiJackThis and allow the change... however, I figure its probably a change that occurs before TeaTimer would even be loaded, so I'm not entirely sure that would even work.

Any thoughts? Kerio Firewall is telling me that the Generic Host Process and the NT Logon Init is trying to communicate to some external IP addresses via port 80, so I blocked all outgoing and incoming IP traffic to non-trusted networks for those processes.... after doing that, the remaining popups stopped.

Edited by shipley.c, 22 May 2005 - 08:19 AM.

[shipley.c]

Hey Excal,

Sorry for not posting sooner, but I've run into a situation with that process and I wanted to make sure I made reasonable efforts to make it happen. the file C:\windows\system32\eliteyrv32.exe doesn't exist on the computer. I've shown hidden files, including system files in XP. I followed procedure. I also did a cmd prompt dir of the directory after showing files for elite*.exe, nothing showed up. I also typed in the filename in the Killbox input field. Everytime I finished a directory, Killbox identified it as a directory, but it did not identify eliteyrv32.exe as a file (as it does with files that do exist on the computer).

Here's my thought... there is still a .dll out on the PC somewhere that is loading that registry setting independent of the file being there. Just a gut feeling.

Do you think that if I ran TeaTimer to monitor changes like that, I could find out which one is doing it? Remove the entry with HiJackThis and allow the change... however, I figure its probably a change that occurs before TeaTimer would even be loaded, so I'm not entirely sure that would even work.

Any thoughts? Kerio Firewall is telling me that the Generic Host Process and the NT Logon Init is trying to communicate to some external IP addresses via port 80, so I blocked all outgoing and incoming IP traffic to non-trusted networks for those processes.... after doing that, the remaining popups stopped.

Edited by shipley.c, 22 May 2005 - 08:19 AM.

[Excal]

Hi Shipley.c,

Can you please give me one more fresh HiJackThis log, so I can see whats left on there.

Thanks,
Excal

[shipley.c]

here is the latest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 9:21:54 PM, on 5/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Gaim\gaim.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\chris fix files\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliteyrv32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Startup: Gaim.lnk = C:\Program Files\Gaim\gaim.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst4_x.cab
O16 - DPF: Yahoo! Spades - http://download.game...nts/y/st2_x.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

[Excal]

Hi Shipley.C! One more thing to get and we should be done

Download LQfix Here
save it to your desktop

Please print out a copy of these instructions to have them handy

1. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

2. double click on LQFix program you downloaded.
A doswindow will open and close again, this is normal.

3. Please reboot in normal mode and post a fresh HiJackThis log.

[shipley.c]

Can I just use msconfig and change the BOOT.INI to add the /SAFEBOOT option? This is Windows XP.

[Excal]

Can I just use msconfig and change the BOOT.INI to add the /SAFEBOOT option? This is Windows XP.

How ever you want to get to safe mode is fine

As long as you run the program in safe mode

thanks,
Excal