help me i'm just a wiggy girl!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by wiggyirl, May 10, 2005.

  1. wiggyirl

    wiggyirl Private E-2

    I received some sort of attack on my computer that arrived with two icons, one is a dog called "cashback" and the other is a circle is a "websearch".

    I have a windows 98 machine. A friend told me to run this program called adaware, which I ran and it showed over 600 issues with my computer. Some could not be deleted.

    My computer is running so slowly and pop-ups keep shutting me down, I don't know what to do.

    I tried using Hijack This is per the same friend.

    Would anyone be able to help me identify what I should not have on my computer?

    Thanks,
    wigged
     
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    After doing ALL of the above if you still have a problem:


    [​IMG] Download HijackThis 1.99.1

    [​IMG] Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    [​IMG] Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

    [​IMG]Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    [​IMG]Run HijackThis and save your log file.

    [​IMG] Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

    [​IMG]Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting
     
  3. wiggyirl

    wiggyirl Private E-2

    Dear BJGarrick,
    Thank you so much for your assistance.
    Attached is the log you requested.
     

    Attached Files:

  4. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please look in Add/Remove Programs in Control Panel and uninstall the following:

    WinTools

    Toolbar

    CashBack

    NaviSearch


    After you uninstall the above programs, procede with running these online scans:
    TrendMicro Online Scan
    Bitdefender online scan
    RavAntivirus online scan <-- select Auto Clean then click Scan My PC
    TrojanScan online scan

    After you run these online scans, post your results as in what was found and if it was deleted or not. Also, reboot and post a fresh HJT log.
     
  5. wiggyirl

    wiggyirl Private E-2

    Thanks so much, I will do that.
    BTW, what does PM mean? I am new to this arena and I don't want to break any etiquitte.
     
  6. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Okay, will be awaiting results and new log.

    PM means "Private Message" ;)
     
  7. wiggyirl

    wiggyirl Private E-2

    Thanks for the information.


    I've run all the scans. They all found stuff but none of them were able to remove everything.

    Attached is the log from Hijack This after the last scan.
     

    Attached Files:

  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please look in Add or Remove Programs for the following and Uninstall them if found:

    ADVANCED SEARCHBAR

    NOW:
    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcy/defaults/sb/*http://www.yahoo.com/search/ie.h tml
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://yahoo.sbc.com/dial
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8 080;http=proxy.prodigy.net:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

    O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL (file missing)
    O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} -C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
    O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\TOOLBAR.DLL
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
    O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\SYSTEM\NSO233.DLL
    O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
    O2 - BHO: Fizzlebar.clsFwBar - {9056A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - C:\SYSFWB\9758255949\IEFWBAR.DLL
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL

    O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL (file missing)
    O3 - Toolbar: Advanced Searchbar - {43F02779-6D88-4958-8AD3-83C12D86ADC7} - C:\PROGRAM FILES\ADVANCED SEARCHBAR\TOOLBAR.DLL

    O4 - HKLM\..\Run: [PSoft1] C:\WINDOWS\SYSTEM\psoft1.exe
    O4 - HKLM\..\Run: [ktvozs] c:\windows\system\ktvozs.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\XUTXZU.exe
    O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\XVZWXN.exe
    O4 - HKLM\..\Run: [autoupdate] rundll32 C:\WINDOWS\SYSTEM\WINUP2DATE.DLL,SHStart
    O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
    O4 - HKCU\..\Run: [ZprqRWd7S] OIGISN12.EXE
    O4 - Startup: tddn.exe

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -%windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Navigate to and DELETE the following if they should remain:

    C:\Program Files\Advanced Toolbar ←–– Delete this whole folder if it exist!

    C:\SYSFWB ←–– Delete this whole folder if it exist!

    C:\WINDOWS\System\KTVOZS.exe

    C:\WINDOWS\System\XVZWXN.exe

    C:\WINDOWS\System\OIGISN12.exe

    C:\WINDOWS\System\MSBE.dll

    C:\WINDOWS\System\NSO233.dll

    C:\WINDOWS\System\psoft1.exe

    C:\WINDOWS\System\ktvozs.exe

    C:\WINDOWS\System\XUTXZU.exe

    C:\WINDOWS\System\WINUP2DATE.dll

    C:\WINDOWS\CFGMGR52.dll

    C:\WINDOWS\nrrvll.exe

    C:\WINDOWS\CFGMGR52.dll

    C:\WINDOWS\NRRVLL.exe

    C:\WINDOWS\PACKAGER.exe


    OIGISN12.exe <-- Search for this file and delete when found!

    tddn.exe <-- Search for this file and delete when found!

    NEXT:
    Run CCleaner and Spybot S&D and have Spybot fix what it finds.
    Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.


    Reboot to Normal Windows

    FINAL STEP

    Reset Web Settings & Default Security Settings:


    To Reset Web Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


    To Default Security Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


    After doing ALL of the above, Scan with HijackThis and attach the new log.
     
  9. wiggyirl

    wiggyirl Private E-2

    Thank You,
    It seems my computer is healthy now.
    Attched is the most rectent log for your perusal.
    Wow...what a difference!
     

    Attached Files:

  10. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Download Pocket KillBox
    (Don't run it yet though)

    Reboot into Safe Mode

    Now, once in safe mode scan with HJT and have it fix the below entries:

    O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\nrrvll.exe

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    Be sure you have ALL browsers closed before you click FIX!


    Locate PocketKillbox

    Now, Copy and Paste C:\WINDOWS\nrrvll.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES.

    Now allow Killbox to reboot you system. After your system has rebooted scan with HJT and attach one last log.
     
  11. wiggyirl

    wiggyirl Private E-2

    I'm stillhaving serious pop-up problems.
    I am running all the same scans.
    Should I post the Hijack This results? :(
     
  12. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    You have to follow my post in a timely manner. These infections mutate over time and cause more problems.

    When we begin a fix you need to stay with it until we are complete.

    Post a fresh HJT log and we will go from there.
     
  13. wiggyirl

    wiggyirl Private E-2

    Hi,
    I thought I did everything, but I guess I didn't.
    Here's the newest logfile:

    Edit by bjgarrick: Unrequested, Inline HJT log removed!
     
    Last edited by a moderator: May 28, 2005
  14. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your log is very bad, you have several issues we need to address. Try not to reboot any if possible as it will make it impossible. There are several steps in removing these new infections you have so it will take some work and time. This fix needs to be done in a timely manner if possible so we can nail it before it can mutate and get worse.

    Please look in Add or Remove Programs for the following and Uninstall them if found:

    AutoUpdate

    NaviSearch

    Virtual Bouncer


    After you uninstall the above programs, procede with these online scans.

    TrendMicro Online Scan
    Bitdefender online scan
    RavAntivirus online scan <-- select Auto Clean then click Scan My PC
    TrojanScan online scan

    After you complete these online scans above, procede with the below steps:

    1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

    2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.


    Now come back here and post both logs as attachments along with a fresh HJT log.
     
  15. wiggyirl

    wiggyirl Private E-2

    Thanks so very much. This was quite the adventure.

    Attached are two of the requested files. I'll attach the third log in the next posting.
     

    Attached Files:

  16. wiggyirl

    wiggyirl Private E-2

    Here is the third Log.
    Thanks!!!
     

    Attached Files:

  17. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Reboot into Safe Mode and procede with the below!


    Locate PocketKillbox

    Procede with this even if they do not show in blue!

    Now, Copy and Paste C:\WINDOWS\NRRVAA.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\OCCBQQQ.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\CERES.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\Buddy.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\system\WINUP2~1.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\system\QOOL.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\system\WMCONFIG.cpl into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\SYSTEM\ktvozs.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\SYSTEM\winup2date.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\SYSTEM\Qool.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\SYSTEM\mc-58-12-0000079.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

    Now, Copy and Paste C:\WINDOWS\SYSTEM\temperror32.dat into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES.

    Allow Killbox to reboot your system! After you have rebooted post 3 new logs!
     
  18. wiggyirl

    wiggyirl Private E-2

    wow! this was so much simpler.
    are we getting closer?
    thanks again.
    1 st two logs posted here.
    3rd log in next reply.
     

    Attached Files:

  19. wiggyirl

    wiggyirl Private E-2

    third log attached.
     

    Attached Files:

  20. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\PROGRAM FILES\CXTPLS\CXTPLS.DLL
    O2 - BHO: SDWin32 Class - {71BA2A40-CDDE-11D9-981F-000FB5088B8F} - C:\WINDOWS\SYSTEM\ENVNQ.DLL
    O2 - BHO: adlog Class - {22B9A67D-E689-44B6-B775-0E8FE84B4F9B} - C:\WINDOWS\SYSTEM\HQADEGO.DLL
    O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
    O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL (file missing)
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL

    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

    O4 - HKLM\..\Run: [PS1] C:\WINDOWS\SYSTEM\ps1.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\INHMIQ.exe
    O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\AFWRWN.exe
    O4 - HKLM\..\Run: [checkrun] C:\WINDOWS\SYSTEM\ELITEGWC32.EXE
    O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
    O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\nrrvaa.exe reg_run
    O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
    O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
    O4 - HKLM\..\Run: [ktvozs] c:\windows\system\ktvozs.exe
    O4 - HKLM\..\Run: [oE8k36R] ODTJUI09.EXE
    O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
    O4 - HKCU\..\Run: [ZprqRWd7S] NTD_CI.EXE
    O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000079-d.exe
    O4 - Startup: tddn.exe

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} - http://www.pacimedia.com/install/pcs_0016.exe

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Navigate to and DELETE the following if they should remain:

    C:\Program Files\Toolbar ←–– Delete this whole folder if it exist!

    C:\Program Files\Common Files\WinTools ←–– Delete this whole folder if it exist!

    C:\Program Files\CXTPLS ←–– Delete this whole folder if it exist!

    C:\WINDOWS\NRRVAA.exe
    C:\WINDOWS\OCCBQQQ.exe
    C:\WINDOWS\CFGMGR52.dll
    C:\WINDOWS\nrrvaa.exe
    C:\WINDOWS\wupdt.exe

    C:\WINDOWS\System\NTD_CI.exe
    C:\WINDOWS\System\HLIDYBR.exe
    C:\WINDOWS\System\HKIBECO.exe
    C:\WINDOWS\System\ENVNQ.dll
    C:\WINDOWS\System\HQADEGO.dll
    C:\WINDOWS\System\ps1.exe
    C:\WINDOWS\System\INHMIQ.exe
    C:\WINDOWS\System\AFWRWN.exe
    C:\WINDOWS\System\ELITEGWC32.exe <-- Also look for other files starting with ELITE and ending with EXE. There could be as many as 10 more.
    C:\WINDOWS\System\ktvozs.exe

    C:\WINDOWS\Start Menu\Programs\Startup\tddn.exe

    C:\Program Files\Common Files\mc-58-12-0000079-d.exe

    ODTJUI09.exe

    NEXT:
    Run CCleaner and Spybot S&D and have Spybot fix what it finds.
    Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.


    Reboot to Normal Windows , Scan with HijackThis and attach the new log along with 2 new logs from the tools.
     
  21. wiggyirl

    wiggyirl Private E-2

    OK...here are the latest logs.
    1 & 2 Here.
    3 coming.
    Thanks!
     

    Attached Files:

  22. wiggyirl

    wiggyirl Private E-2

    I am not able to attach the log from RK Files Tool - the attachment manager keeps telling me I've already posted this file even though I haven't (and I tried changing its name to something totally new). But it's a very short file with no information except:

    Files Found in all users windows Folder............
    ------------------------
    C:\WINDOWS\vsapi32.dll: UPX!t4
    C:\WINDOWS\tsc.exe: UPX!
    Finished
     
  23. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Great!:)

    Procede with this and we should be done!

    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    O2 - BHO: SDWin32 Class - {5BA702C0-D395-11D9-981F-000FB5088B8F} - C:\WINDOWS\SYSTEM\ENVNQ.DLL

    O4 - HKLM\..\Run: [envnqc] C:\WINDOWS\SYSTEM\envnqc.exe
    O4 - HKLM\..\Run: [guarnset] C:\WINDOWS\SYSTEM\guarnset.exe
    O4 - HKLM\..\RunServices: [hsaieab] C:\WINDOWS\SYSTEM\hsaieab.exe

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Navigate to and DELETE the following if they should remain:

    C:\WINDOWS\SYSTEM\ENVNQ.DLL

    C:\WINDOWS\SYSTEM\envnqc.exe

    C:\WINDOWS\SYSTEM\guarnset.exe

    C:\WINDOWS\SYSTEM\hsaieab.exe

    NEXT:
    Run CCleaner


    Reboot to Normal Windows , Scan with HijackThis and attach the new log.
     
  24. wiggyirl

    wiggyirl Private E-2

    Thanks so much.
    The only problem I'm having is that I was networked up to my other computers and I can't see this computer any more from the other computers from my network places. Would this have anything to do with networking?
    Is there anything I can do to get the other computers to recognize this one?
     
  25. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    The only thing I can do from here is recommend your posting this problem in the Networking Forum as its most likely a networking issue.

    Also, you should see this article on How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds