PDA

View Full Version : Please Help



ggbk11211
2006-11-09, 14:31
I had cmdservice.exe, and used ren-cmdservice to get rid of it, but my browser still has massive problems. Also, spybot is run many times and the same things keep coming up. Also, is spybot supposed to take more than an hour to run now? Here is the hijack this log:
Logfile of HijackThis v1.99.1
Scan saved at 8:20:39 AM, on 11/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\{D98BF0C0-0B28-1033-0818-040402060001}\Update.exe
C:\Documents and Settings\Graham\Application Data\??curity\?hkdsk.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Browser Hijack Recover\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\lgwox.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,wbdridm.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe



I also try to stop certain things from starting up in the msconfig screen, but they keep reappearing:

nerle.exe and c:\windows\system32\vwfkxw.exe reg_run

pskelley
2006-11-09, 23:26
Welcome to the forum. It appears you have removed items from the log with HJT whitelist, MSConfig, or another program. I can't help you clean what I can't see. I can see at least a Qoologic trojan and PurityScan adware, but I need to see the log with everything enabled.
You also have not supplied an antivirus scan as required in this link:
"BEFORE you POST" -Preliminary Steps and scanning with SPYBOT-S&D
http://forums.spybot.info/showthread.php?t=288
Use the "Post Reply" to post the information in the instructions.

Please read and follow the directions, post the required information. Describe what is happening in some detail and post any error messages your are receiving "word for word" and I will be glad to help you.

Thanks

tashi
2006-11-19, 03:14
:scratch:
This topic is closed due to lack of a response to helper, if you need it re-opened please send me a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.