[mexicangunslinger]

Hi there, I have had this virus for about a month that sends an error report and says Win32 has to be shutdown, after that another screen appears saying my computer needs to be restarted within 1minuts due to some remote procedure.

Before coming here I went to microsoft and identified my virus, they told me to run the malicous software removal tool, i did and it informed me that no malicous software was detected and my computer was still restarting.

Here is my log hope you can help



-


Logfile of HijackThis v1.99.1
Scan saved at 10:13:31 PM, on 21/12/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Brody Clark\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://store.presari...&c=3C01&lc=6809
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presari...&c=3C01&lc=6809
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presari...&c=3C01&lc=6809
O1 - Hosts: 69.50.190.26 www.halifax-online.co.uk
O1 - Hosts: 69.50.190.26 ibank.barclays.co.uk
O1 - Hosts: 69.50.190.26 online.lloydstsb.co.uk
O1 - Hosts: 69.50.190.26 online-business.lloydstsb.co.uk
O1 - Hosts: 69.50.190.26 www.ukpersonal.hsbc.co.uk
O1 - Hosts: 69.50.190.26 www.nwolb.com
O1 - Hosts: 69.50.190.26 banesnet.banesto.es
O1 - Hosts: 69.50.190.26 extranet.banesto.es
O1 - Hosts: 69.50.190.26 ebanking.bccbrescia.it
O1 - Hosts: 69.50.190.26 www.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 69.50.190.26 www.rbsdigital.com
O1 - Hosts: 69.50.190.26 oi.cajamadrid.es
O1 - Hosts: 69.50.190.26 bancae.caixapenedes.com
O1 - Hosts: 69.50.190.26 banking.postbank.de
O1 - Hosts: 69.50.190.26 meine.deutsche-bank.de
O1 - Hosts: 69.50.190.26 myonlineaccounts2.abbeynational.co.uk
O1 - Hosts: 69.50.190.26 ibank.cahoot.com
O1 - Hosts: 69.50.190.26 webbank.openplan.co.uk
O1 - Hosts: 69.50.190.26 bancopostaonline.poste.it
O1 - Hosts: 69.50.190.26 www.rasbank.it
O1 - Hosts: 69.50.190.26 www.credem.it
O1 - Hosts: 69.50.190.26 mybank.bybank.it
O1 - Hosts: 69.50.190.26 www.bancagenerali.it
O1 - Hosts: 69.50.190.26 www.bancaintesa.it
O1 - Hosts: 69.50.190.26 www.creval.it
O1 - Hosts: 69.50.190.26 ibank.internationalbanking.barclays.com
O1 - Hosts: 69.50.190.26 www.abbeyinternational.com
O1 - Hosts: 69.50.190.26 www.bbvanet.com
O1 - Hosts: 69.50.190.26 www.fineco.it
O1 - Hosts: 69.50.190.26 www.cajamar.es
O1 - Hosts: 69.50.190.26 welcome7.co-operativebank.co.uk
O1 - Hosts: 69.50.190.26 welcome11.co-operativebankonline.co.uk
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=iehomepage&c=3C01&lc=6809
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[Advertisements]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...&DisplayLang=en
Apply the update, reboot, and post a fresh Hijack This log.

[Michelle]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...&DisplayLang=en
Apply the update, reboot, and post a fresh Hijack This log.

[Michelle]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.