not sure what to do

high jack log

Logfile of HijackThis v1.99.1
Scan saved at 1:37:21 PM, on 6/11/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
c:\temp\svchost.exe
c:\temps\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\dnservice.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159897217328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159897265265
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.0/installer.exe
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Messager - Unknown owner - c:\temp\svchost.exe
O23 - Service: Messenger - Unknown owner - c:\temps\svchost.exe
O23 - Service: Remote DnsClien Service (WinDnser) - Unknown owner - C:\WINNT\system32\dnservice.exe
O23 - Service: Windows Cron Service - Unknown owner - C:\WINNT\System32\crons.exe
O23 - Service: Windows_Server - Unknown owner - C:\WINNT\system32\ddos.exe (file missing)
O23 - Service: www.yg52.com - Unknown owner - C:\WINNT\www.yg52.com
 
Hi mightyuselessone

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please click this link-->Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

c:\temp\svchost.exe

Please post back the results of the scan in your next post.

Repeat step for:

C:\WINNT\system32\dnservice.exe

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/flash/index_en.html
 
Virustotal scan results

STATUS: QUEUEDYour file "svchost.exe" is queued in position: 30. Estimated start time is between 5 and 7 minutes.

Antivirus Version Update Result
STATUS: QUEUEDYour file "dnservice.exe" is queued in position: 27. Estimated start time is between 4 and 6 minutes.

Antivirus Version Update Result
 
Hi

Well those doesn't help at all.

STATUS: QUEUEDYour file "svchost.exe" is queued in position: 30. Estimated start time is between 5 and 7 minutes.

STATUS: QUEUEDYour file "dnservice.exe" is queued in position: 27. Estimated start time is between 4 and 6 minutes.

So you will need to wait for results.
 
scan results from virus total

I hope this is a little better LOL ty for your patience with me



Antivirus Version Update Result
AhnLab-V3 2007.5.9.0 05.09.2007 no virus found
AntiVir 7.4.0.32 06.12.2007 no virus found
Authentium 4.93.8 06.12.2007 no virus found
Avast 4.7.997.0 06.12.2007 Win32:Delf-ESY
AVG 7.5.0.467 05.08.2007 no virus found
BitDefender 7.2 06.12.2007 BehavesLike:Win32.Malware
CAT-QuickHeal 9.00 06.12.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.09.2007 no virus found
DrWeb 4.33 06.12.2007 no virus found
eSafe 7.0.15.0 05.08.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3713 06.12.2007 no virus found
FileAdvisor 1 06.12.2007 no virus found
Fortinet 2.85.0.0 06.12.2007 no virus found
F-Prot 4.3.2.48 05.08.2007 no virus found
F-Secure 6.70.13030.0 05.09.2007 no virus found
Ikarus T3.1.1.7 05.09.2007 no virus found
Kaspersky 4.0.2.24 06.12.2007 no virus found
McAfee 5051 06.12.2007 no virus found
Microsoft 1.2503 06.12.2007 no virus found
NOD32v2 2325 06.12.2007 no virus found
Norman 5.80.02 06.12.2007 no virus found
Panda 9.0.0.4 06.12.2007 Suspicious file
Prevx1 V2 06.12.2007 Trojan.DownZero
Sophos 4.18.0 06.12.2007 no virus found



Antivirus Version Update Result
AhnLab-V3 2007.6.12.2 06.12.2007 no virus found
AntiVir 7.4.0.32 06.12.2007 TR/Crypt.NSPM.Gen
Authentium 4.93.8 06.12.2007 Possibly a new variant of W32/Threat-HLLIN-based!Maximus
Avast 4.7.997.0 06.12.2007 no virus found
AVG 7.5.0.467 06.12.2007 no virus found
BitDefender 7.2 06.12.2007 no virus found
CAT-QuickHeal 9.00 06.12.2007 no virus found
ClamAV devel-20070416 06.12.2007 no virus found
DrWeb 4.33 06.12.2007 no virus found
eSafe 7.0.15.0 06.12.2007 suspicious Trojan/Worm
eTrust-Vet 30.7.3713 06.12.2007 no virus found
Ewido 4.0 06.12.2007 no virus found
FileAdvisor 1 06.12.2007 no virus found
Fortinet 2.85.0.0 06.12.2007 no virus found
F-Prot 4.3.2.48 06.12.2007 W32/Threat-HLLIN-based!Maximus
F-Secure 6.70.13030.0 06.12.2007 Hupigon.gen12
Ikarus T3.1.1.8 06.12.2007 Backdoor.Win32.PcClient.GV
Kaspersky 4.0.2.24 06.12.2007 no virus found
McAfee 5051 06.12.2007 New Malware.em
Microsoft 1.2503 06.12.2007 no virus found
NOD32v2 2325 06.12.2007 Win32/SkSocket.109
Norman 5.80.02 06.12.2007 Hupigon.gen12
Panda 9.0.0.4 06.12.2007 Suspicious file
Prevx1 V2 06.12.2007 no virus found
Sophos 4.18.0 06.12.2007 Mal/Packer
Sunbelt 2.2.907.0 06.09.2007 no virus found
Symantec 10 06.12.2007 no virus found
TheHacker 6.1.6.132 06.11.2007 no virus found
VBA32 3.12.0.1 06.11.2007 Backdoor.Win32.SkSocket.109
VirusBuster 4.3.23:9 06.12.2007 no virus found
Webwasher-Gateway 6.0.1 06.12.2007 Trojan.Crypt.NSPM.Gen
 
Hi

Thanks for results :)

This is the next step:

Download suspicious file packer from here

Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

c:\temp\svchost.exe
C:\WINNT\system32\dnservice.exe

Go to spykiller

Press new topic, make threads title "Files for Shaba"
Include to your message a link to here, then attach the cab/zip file to your message and post the topic
If you cant locate it through the browse button just copy/paste the filename and path.

Let me know when you have done it, so we can continue :)
 
on another subject

the files with akamai (virtool webplayer class) and yg52 in the hijack post what are they for. i tried to follow the yg52 and it timed out and the akami is some kind of web marketing deal from what i can gather. would love it if u could explain these to me ty

O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe

O23 - Service: www.yg52.com - Unknown owner - C:\WINNT\www.yg52.com
 
Hi

As for virtools, see here

As for yg52.com, I think it's some chinese web site.

I ask you to upload one more file to virustotal.

c:\temps\svchost.exe

Post results here, please :)
 
virus total scan on c:\temps\svchost.exe

Antivirus Version Update Result
AhnLab-V3 2007.6.12.2 06.13.2007 no virus found
AntiVir 7.4.0.32 06.13.2007 no virus found
Authentium 4.93.8 06.12.2007 no virus found
Avast 4.7.997.0 06.12.2007 no virus found
AVG 7.5.0.467 06.13.2007 no virus found
BitDefender 7.2 06.13.2007 BehavesLike:Win32.Malware
CAT-QuickHeal 9.00 06.12.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 06.12.2007 no virus found
DrWeb 4.33 06.13.2007 no virus found
eSafe 7.0.15.0 06.12.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3715 06.13.2007 no virus found
Ewido 4.0 06.13.2007 no virus found
FileAdvisor 1 06.13.2007 no virus found
Fortinet 2.85.0.0 06.13.2007 no virus found
F-Prot 4.3.2.48 06.12.2007 no virus found
F-Secure 6.70.13030.0 06.13.2007 no virus found
Ikarus T3.1.1.8 06.13.2007 no virus found
Kaspersky 4.0.2.24 06.13.2007 no virus found
McAfee 5051 06.12.2007 no virus found
Microsoft 1.2503 06.13.2007 no virus found
NOD32v2 2326 06.13.2007 no virus found
Norman 5.80.02 06.12.2007 no virus found
Panda 9.0.0.4 06.13.2007 Suspicious file
Prevx1 V2 06.13.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 06.09.2007 VIPRE.Suspicious
Symantec 10 06.13.2007 no virus found
TheHacker 6.1.6.132 06.11.2007 no virus found
VBA32 3.12.0.1 06.12.2007 no virus found
VirusBuster 4.3.23:9 06.12.2007 no virus found
Webwasher-Gateway 6.0.1 06.13.2007 Win32.Malware.gen#PECompact!84 (suspicious)
 
Hi

Thanks for that, too :)

Open suspicious file packer & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

c:\temps\svchost.exe

Go to spykiller

Press new topic, make threads title "Files for Shaba"
Include to your message a link to here, then attach the cab/zip file to your message and post the topic
If you cant locate it through the browse button just copy/paste the filename and path (you can add another reply to same thread you created if forum allows it).
 
Hi

Thanks again :)

It's recommended that you don't use any credit card things/online banks during cleaning process as you have some very serious infections. You should also change all your online passwords after you're clean.


# Run Spybot-S&D in Advanced Mode.
# If it is not already set to do this Go to the Mode menu select "Advanced Mode"
# On the left hand side, Click on Tools
# Then click on the Resident Icon in the List
# Uncheck "Resident TeaTimer" and OK any prompts.
# Restart your computer.

Open HijackThis, click do a system scan only and checkmark these:

O23 - Service: Messager - Unknown owner - c:\temp\svchost.exe
O23 - Service: Messenger - Unknown owner - c:\temps\svchost.exe
O23 - Service: Remote DnsClien Service (WinDnser) - Unknown owner - C:\WINNT\system32\dnservice.exe
O23 - Service: Windows_Server - Unknown owner - C:\WINNT\system32\ddos.exe (file missing)
O23 - Service: www.yg52.com - Unknown owner - C:\WINNT\www.yg52.com

Close all windows including browser and press fix checked.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.

  • Delete these and after that empty Recycle Bin:

    c:\temp\svchost.exe (delete entire folder if you haven't put anything there on purpose)
    c:\temps\svchost.exe (same as above)
    C:\WINNT\system32\dnservice.exe
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
 
SDFix & new Hijack logs

Logfile of HijackThis v1.99.1
Scan saved at 9:57:43 AM, on 6/13/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\notepad.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159897217328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159897265265
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.0/installer.exe
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Remote DnsClien Service (WinDnser) - Unknown owner - C:\WINNT\system32\dnservice.exe (file missing)
O23 - Service: Windows Cron Service - Unknown owner - C:\WINNT\System32\crons.exe
O23 - Service: Windows_Server - Unknown owner - C:\WINNT\system32\ddos.exe (file missing)


SDFix: Version 1.87

Run by Administrator - Wed 06/13/2007 - 9:31:05.26

Microsoft Windows 2000 [Version 5.00.2195]

Running From: C:\DOCUME~1\ADMINI~1\Desktop\SDFix

Safe Mode:
Checking Services:






Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINNT\system32\i - Deleted



Removing Temp Files...

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINNT\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINNT\system32\svchost.exe
No streams found.

Checking if ADS is attached to ntoskrnl.exe
C:\WINNT\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Remaining Files:
---------------

Backups Folder: - C:\DOCUME~1\ADMINI~1\Desktop\SDFix\backups\backups.zip

Listing Files with Hidden Attributes:

C:\WINNT\www.yg52.com
C:\Recyclers\svchost.exe
C:\WINNT\system32\crons.exe

Listing User Accounts:

User accounts for \\THEBIGBA-E2C4A7


Administrator Guest


Finished
 
another question yet

after this fix will my clock quit reseting to 2 years ago? every time i start system the date is posted as being 2 years behind.
 
Hi

Well I think time thing might be BIOS battery issue, not malware issue.

Have you installed this?

O23 - Service: Windows Cron Service - Unknown owner - C:\WINNT\System32\crons.exe

Please click Start > Run and type in: services.msc
Click OK
In the Services window find: Remote DnsClien Service (WinDnser)
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK

Repeat step for this:

Windows_Server

Now, go to Start > Run, and copy/paste the following into the Open box:
sc delete WinDnser
Click: OK

Repeat step for this:

Windows_Server

Please download the Killbox.
Save it to the desktop.

Please run Killbox.

Select "Delete on Reboot" and "All files"

Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINNT\www.yg52.com
C:\Recyclers\svchost.exe

Go to the File menu, and choose "Paste from Clipboard".

Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Post a fresh HijackThis log.

If your computer does not restart automatically, please restart it manually.
 
yet another hijack log lol

hoping that i followed instruction throughly Ty again for your patience



Logfile of HijackThis v1.99.1
Scan saved at 12:24:08 PM, on 6/13/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINNT\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159897217328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159897265265
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.0/installer.exe
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Remote DnsClien Service (WinDnser) - Unknown owner - C:\WINNT\system32\dnservice.exe (file missing)
O23 - Service: Windows Cron Service - Unknown owner - C:\WINNT\System32\crons.exe
 
cron service

O23 - Service: Windows Cron Service - Unknown owner - C:\WINNT\System32\crons.exe

i did not down load this specifically that i am aware of
 
Hi

First stop TeaTimer.exe process (ctrl+alt+del -> end process)

After that:

Open HijackThis, click do a system scan only and checkmark these:

O23 - Service: Remote DnsClien Service (WinDnser) - Unknown owner - C:\WINNT\system32\dnservice.exe (file missing)
O23 - Service: Windows Cron Service - Unknown owner - C:\WINNT\System32\crons.exe

Close all windows including browser and press fix checked.

Reboot.

Delete if present:

C:\WINNT\System32\crons.exe

Empty Recycle Bin

Post a fresh HijackThis log.
 
You must log in or register to reply here.
Back
Top