50 replies to this topic

[New_Age]

Hi, I'm over here at my GF's house and I don't have much time. please look at the log aSAP. Thx to anyone who can help

P.S - They have Avast! Home Edition (Up-To-Date) and Ewido and A-Squared. I have scanned and done everything. I now turn for help here!

Logfile of HijackThis v1.99.1
Scan saved at 4:03:52 PM, on 8/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\IObit\Advanced WindowsCare V2\Awc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Documents and Settings\Owner.YOUR-6JNHHU0520\Desktop\HijackThis.exe
C:\Documents and Settings\Owner.YOUR-6JNHHU0520\My Documents\HTJ\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.wildtangent.com/ddc/hpcompaq_migrate
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Advanced WindowsCare] "C:\Program Files\IObit\Advanced WindowsCare V2\Awc.exe" /startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150842517921
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1150842483593
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[YoKenny]

New_Age, I'll provide my observations of the log.

In case something goes wrong and you need to backup then create a Folder for HijackThis as you do not want the HijackThis logs in the Temp Folder nor all over your Desktop.
Depress the Windows key + e to start Windows Explorer then navigate to the hard drive then right click then select New then Folder then name it HJT.
Move HijackThis into this folder.

Go to Add/Remove Programs and uninstall WildTangent

Start HijackThis after you have closed ALL other applications then check the following then "Fix checked" if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ <== this is good
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SE...S01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.wildtange...pcompaq_migrate
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

Install SiteAdvisor as it shows an an indicator of bad sites you are visiting:
http://www.siteadvisor.com

Install ALL prevention protection recommended and keep them updated regularly by reading the announcements at Calendar of Updates

[Tarun]

Ignore what YoKenny said. It may say that files are missing for Avast, but they are present. Just look at the top of the log where it clearly says:
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Just stop posting YoKenny.

New_Age, aside from WildTangent (remove that asap from Add/Remove Programs) your log is clean. You should definitely trash this:
O4 - HKCU\..\Run: [Advanced WindowsCare] "C:\Program Files\IObit\Advanced WindowsCare V2\Awc.exe" /startup
It screws up your services and causes numerous other errors, including with other software.

You should run a scan with Ad-Aware and Spybot, definitely.

[New_Age]

Tarun, on Aug 27 2006, 06:44 PM, said:

Ignore what YoKenny said. It may say that files are missing for Avast, but they are present. Just look at the top of the log where it clearly says:
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Just stop posting YoKenny.

New_Age, aside from WildTangent (remove that asap from Add/Remove Programs) your log is clean. You should definitely trash this:
O4 - HKCU\..\Run: [Advanced WindowsCare] "C:\Program Files\IObit\Advanced WindowsCare V2\Awc.exe" /startup
It screws up your services and causes numerous other errors, including with other software.

You should run a scan with Ad-Aware and Spybot, definitely.

I can no longer help my GF's parents out on their computer as I'm at home. I will conitune next time I'm over there. I'll do what you said *Taren but why is *YoKenny wrong?

Note: I've ran Spybot and Ad-ware and it didn't help much. I Installed Maxthon and have all Ad-blockers checked but still get pop-up Ad's. I ran a scan with Ewido and it found two High Risk file *Hi.Jacker.Virus or... the name was similar but it did contain the name HiJacker or whatever. I removed it though.

I did again scanned for viruses and I don't know but last time I checked it came up with none but now IDK... as I haven't gotten a chance to scan. Again... thx for the help and I'll get too it when I have a chance to get over there again which will probably be by next Saturday.

[rridgely]

Next time your over there do this:

Run Kaspersky WebScanner

• Please go HERE and click Kaspersky Online Scanner
  
• Read and Accept the Agreement
  
• You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  
• If you see a Windows dialog asking if you want to install this software, click the Install button.
  
• The program will launch and then begin downloading the latest definition files,
  
• When the "Update progress" line changes to "Ready" and the "NEXT ->" button becomes available, please click on it.
  
• Click on the Scan Settings button, and in the next window select the Extended database, and click Ok.
  
• Under "Please select a target to scan:", click My Computer to start the scan.
  
• When the scan is finished, click the "Save as Text" button, and save the file as kavscan.txt to your Desktop, close the Kaspersky On-line Scanner window.

Post that kaspersky log as well as a new hijack this log.
-------------------------------------------------------------------------

As for the avast(file missing) entries, its an old problem of hijackthis to wrongly list some files as missing when they really aren't. Thats why you have to be careful when deleting things.

[New_Age]

rridgely, on Aug 27 2006, 07:05 PM, said:

Next time your over there do this:

Run Kaspersky WebScanner

• Please go HERE and click Kaspersky Online Scanner
  
• Read and Accept the Agreement
  
• You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  
• If you see a Windows dialog asking if you want to install this software, click the Install button.
  
• The program will launch and then begin downloading the latest definition files,
  
• When the "Update progress" line changes to "Ready" and the "NEXT ->" button becomes available, please click on it.
  
• Click on the Scan Settings button, and in the next window select the Extended database, and click Ok.
  
• Under "Please select a target to scan:", click My Computer to start the scan.
  
• When the scan is finished, click the "Save as Text" button, and save the file as kavscan.txt to your Desktop, close the Kaspersky On-line Scanner window.

Post that kaspersky log as well as a new hijack this log.
-------------------------------------------------------------------------

As for the avast(file missing) entries, its an old problem of hijackthis to wrongly list some files as missing when they really aren't. Thats why you have to be careful when deleting things.

I was stupid enough and tried to scan the computer through Maxthon but it came up with an error while Installing due... to that the *ActiveX Blocker was Enabled. I was mad but I told them that it finished scanning which was a lie. Yes.. I still ashamed and I told them it found nothing. I'll scan it with just... IE next time. I will do as told. Till then... guys and Thx!

[Tarun]

New_Age, on Aug 27 2006, 06:53 PM, said:

I can no longer help my GF's parents out on their computer as I'm at home. I will conitune next time I'm over there. I'll do what you said *Tarun but why is *YoKenny wrong?

Note: I've ran Spybot and Ad-ware and it didn't help much. I Installed Maxthon and have all Ad-blockers checked but still get pop-up Ad's. I ran a scan with Ewido and it found two High Risk file *Hi.Jacker.Virus or... the name was similar but it did contain the name HiJacker or whatever. I removed it though.

I did again scanned for viruses and I don't know but last time I checked it came up with none but now IDK... as I haven't gotten a chance to scan. Again... thx for the help and I'll get too it when I have a chance to get over there again which will probably be by next Saturday.

Pretty much what I said in my post.

He's having you remove search pages (which is fine) but he's telling you to remove the services for Avast. The thing is, those services are present and working.

It'd be like me telling you to stop running and to remove services that are required for Windows to load.

This is why people should only listen to actual PC Techs.

[New_Age]

Tarun, on Aug 27 2006, 07:14 PM, said:

Pretty much what I said in my post.

He's having you remove search pages (which is fine) but he's telling you to remove the services for Avast. The thing is, those services are present and working.

It'd be like me telling you to stop running and to remove services that are required for Windows to load.

This is why people should only listen to actual PC Techs.

lol, ok. I quite did understood why. Just thought I'd see what you had to say. I may be 19 but my GF and her parents are GLAD they have me around otherwise they would of bought a new computer in the next couple of months.

P.S - Your link to your website doesn't work. Fix it please...

[Tarun]

New_Age, on Aug 27 2006, 07:17 PM, said:

lol, ok. I quite did understood why. Just thought I'd see what you had to say. I may be 19 but my GF and her parents are GLAD they have me around otherwise they would of bought a new computer in the next couple of months.

P.S - Your link to your website doesn't work. Fix it please...

Tech savvy people rule; so long as they have a real tech to be guided by. ;P

There was a network issue along the way to Lunarsoft.net earlier. It should be all sorted now.

[New_Age]

The page still fails to load.

No matter though. I'll try some other time. *Want to stay on topic here

[New_Age]

Ok, I'm heading over there tomorrow after School. i'll post the log ASAP when its finished.

[Tarun]

Good deal!

[New_Age]

Fixing switched to this Saturday. Till then guys...

[New_Age]

Ok, here the log...

[rridgely]

Clear out system restore and you should be good.

To Flush the infected restore points:

Click Start Menu > All Programs > Accessories > System Tools > SystemRestore

Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

Have all the problems stopped?
Also might be a good idea to post a new hijackthis log.

[New_Age]

Ok, I will do as old but you seem to be posting the same stuff to different users who have problems. By any chance do you have this copied in notepad or microsoft word

[rridgely]

Yep.
Don't worry I only use them when they apply to the specific issue though.
Its just a way to keep me from typing everything each time. Andy sent me a few useful ones.(including the above one)

[New_Age]

Any other problems?

[rridgely]

Looks good.
Is the computer acting right now?

[New_Age]

let me search through the web some and i'll report back.