Serious problems - please look at HJT log

Most people are under the very mistaken misconception that HijackThis is a scanning and detection tool. It is not! HijackThis is simply a tool that is used to identify browser hijackers and in some cases it will show entries for some malware that is for instance running at startup. A HijackThis log shows the following:

• a running process list with no reference to good or bad
• it lists the contents of a selected group of registry keys that is an an extremely small subset of the tens of thousands of keys that may exist. Again no reference to good or bad.
• and some of the above keys that are shown may show some non-Microsoft system services that are running. Again with no reference to good or bad.

The decision on what is good or bad is left a person with significant Windows and malware cleaning experience.

HijackThis does not come close to showing all malware that could be hiding on a PC. Anyone who has an infected computer and is relying on HijackThis without the benefit of running other scans such as Spybot, Windows Defender, BitDefender & Panda, CCleaner, etc. are more than likely still infected. In most cases, where there is one virus/trojan there are more.

The goal of this forum is to remove all malware, and this cannot be done properly by just seeing a HijackThis log.



Since you have posted here in the past, you should already know the procedures which are given below.

Make sure you uninstall one of the two antivirus programs you are running as requested in step 3 of the READ ME.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis​

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy - only for Windows XP, 2K, & NT users
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

At a minimum for us to get started, we will need the below logs.

runkeys.txt - the log from GetRunKey.bat
newfiles.txt - the log from ShowNew.bat
HijackThis

Preferably obtained after running the other scans. But if you cannot run them, then try to get the above three logs. If you do not have the ability to exract files from a ZIP file on your PC, you will have to download GetRunKey.zip and ShowNew.zip onto another PC and extract them on the other PC (you can extract both ZIP files into one folder). Then copy them via floppy, flashdrive, CD....etc to the problem PC.

 

NO! You must attach logs! Please read the notes in the the sticky.

Posting inline logs will result in them being deleted. It makes threads too long and it takes significantly longer to open the thread and respond to messages. In additon, it corrupts the formatting of the text in the logs making them more difficult and time consuming to read. Thus we cannot read them this way since we do not have time to spare. These logs will be deleted. Please attach them.

Then you should run AVG Antispyware as requested in the READ ME.

If is is inline, it will be deleted.


You did not uninstall one of your two antivirus programs as requested. Why not? If it is because you cannot figure out how to get to Add/Remove programs, try this. From Task Manager, run appwiz.cpl which should bring up Add/Remove programs.

You also need to uninstall Kazaa Lite v2.1.0 [K++ Edition] [build 3] as requested in step 0 of the READ ME.

Also uninstall the below:
Ad-aware 6 Personal - this is an old out of date version that should have been removed before install Ad-Aware SE Personal
ewido anti-malware - this has been replace by and is the same application as AVG Antispyware which you also have installed.
SpywareGuard v2.2 - out of date and will conflict with Window Defender & AVG Antispyware that you have install

You also have Pest Patrol installed. You probably installed it at the same time as Authentium's Command AV which you more than like got for free from your ISP. You cannot keep AVG Antispyware, Windows Defender, and Pest Patrol all installed. All but on must go! AVG Antispyware is only a trial unless you purchase it so it will not provide protection on a long term basis.


I see that Ccleaner was not run! Are you unable to download, install and run it? If you cannot run CCleaner, can you do the below which does not require and installation:

Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

 

No! This is actually sounding more like your Windows OS is corrupted and less like malware.

No!


Please attach the logs from GetRunKey, ShowNew, and HJT but I'm not expecting them to be of much help since I expect your problems is beyond malware.

Does the c:\windows\explorer.exe file exist? Have you looked for it by using a command prompt window?

 

It appears that you did not run ATF-Cleaner. Were you not able to run it?

At this point I will have to refer you to the Software Forum since your problems are not malware. You seem to have either deleted your c:\windows\explorer.exe file or you have blocked it from loading somehow (perhaps with Windows Defender or something else). You need to verify whether or not c:\windows\explorer.exe even exists. That does not mean by trying to run it. That means you need to open a command prompt windows and and do a directory listing to see if the file is found. Run cmd from Task Manager which will open a command prompt. Then in the command prompt windows enter the below command:

dir c:\windows\explorer.exe

What exactly do you get?

Based on your previous statements it sounded like it probably exists but when you attempt to run it, it is being shutdown.

 

Okay it looks like you have a valid Windows Explorer file!

Why can't you boot into safe mode? Don't you have the Administrator password? If you do have the password, then what happens what you boot in safe mode?

In the user account that you are currently using, does it have full admin priviledges?


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

After clicking Fix, exit HJT.

Now reboot in normal mode

Now attach a new HJT log


Do you have your Windows XP CD? You could be looking at a reinstall. But first check all of the below programs to make sure you are not blocking anything from loading (especially explorer.exe)
Windows Defender
AVG Antispyware
Spyware Guard
Avast
Command Antivirus
Ewido
Norton Firewall

 

It is not sufficient to guess! Can you run this NUSRMGR.CPL from Task Manager to check users accounts. Verify that your account is shown as Computer Administrator.

That is not what I asked. I said to verify that you have not comfigured anything in the programs to block anything from loading. You need to run the programs and look at the configuration and settings.

Why did you post your log inline! Please remember to ATTACH logs!

Does MSconfig run from Task Manager?

Can you install software without a problem? If yes, try installing this Your Uninstaller! 2006
Try using Your Uninstaller to uninstall ALL of the below:

• Ad-aware 6 Personal
• Authentium
• Avast
• AVG Antispyware
• Antispyware or Pest Patrol (I'm not sure how it will show)
• Ewido
• Norton Firewall
• Spyware Guard
• Windows Defender

 

Probably came with stuff you installed from your ISP. Uninstall this: BellSouthr Scan and Clean Tool"

The Authentium Antivirus and PestPatrol appear like the below in your newfile.txt log:
"DisplayName"="Anti-Spyware"
"DisplayName"="Authentium"

And then attach new logs from ShowNew and HJT.

I also suggest you uninstall the below now with Your Uninstaller:

• Kazaa Lite v2.1.0 [K++ Edition] [build 3]
• LiveReg (Symantec Corporation)
• LiveUpdate 1.80 (Symantec Corporation)

Then reboot and then attach new logs from ShowNew and HJT.

Any change to your problems?

When you installed this, you added more protection software (as we are removing above) and if you already had an antivirus and realtime antispyware blocker installed then that was a bad idea. Did it cause your exact problems......well I would not expect that but it is an unusual coincidence.

 

They probably uninstalled when you removed the Bellsouth stuff.

Just attach the requested logs so I can see where you are at.

 

Try doing the below to see if the Manage Attachments button appears.


Now we need to Reset Web Settings:

1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!

Then refresh you web page a couple times. Now try starting a new message and click Go Advanced and continue.

If it does not work using IE, then try using FireFox.

 

Earlier you said you ran ATF-Cleaner but based on the dates of files showing in your Temp folders it was not run or it was not run properly. Please run it again and make sure you have it cleanup all temp folders by using the instructions I gave.


What is the below folder for and why is it in your Path Environment variable?
C:\icode
What are the below items I see installed:
tgi... Updates
tgi... Utiliies ver 3


Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run this Getting Uninstall Programs List From The Registry and attach the requested log so I can see if there is an uninstall we can use to uninstall Authentium and Pest Patrol.

Also go to this website: http://virusscan.jotti.org/ and click the Browse button. Navigate to your c:\windows\explore.exe file and double click it to select it so that a scan can be run on it. Post back a report if anything is found.

 

fixME.reg is a file to be saved on your Desktop (the Desktop is a folder). However you probably cannot do what I said since you do not have a Desktop if explorer.exe is not running. So save the fixME.reg file to the root folder of drive C ( C:\fixME.reg ). Then from Task Manager run regedit to open the registry editor. Then click File and select Import. Then navigate to the c:\fixME.reg file and double click on it. Allow it to add into the registry when prompted. Tell me whether you receive a success message or not.

 

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

• Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
• On the page that opens, scroll down to DvpApi
• then right click the entry, select Properties and press Stop Service.
• When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
• Click OK until you get back to Windows.

• Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
• At the lower right, click on the Config button
• Then click the Misc tools button
• Select Delete an NT Service
• Copy/pastedvpapi into the box that opens, and press OK
• If you receive any error messages just ignore them and continue.
• Now exit HJT and reboot when it tells you it needs to.

After reboot, delete the below folders
C:\Program Files\Common Files\PestPatrol
C:\Program Files\Common Files\Command Software

Now from a Task Manager open a command prompt window by entering cmd
In the command prompt window enter the below command. It may ask for you Windows XP CD, so have it ready.

sfc /scannow

Let me know if it asks for your CD or if it gives you any messages.



Reboot again after running the sfc command!

Now attach new logs from:

• GetRunKey
• ShowNew
• HJT

Can you get Windows Explorer to run now?

What happens if you open a command prompt window and try to run explorer.exe from the command prompt?

What happens if you do the same from safe mode?

 

Just import this new fixME.reg patch into regedit like I had you do last time.

Be specific. You must give me exact word for word messages. Was the message what you gave in post # 32?

Did this occur before, during, or after doing the steps?

Does the c:\windows\system32\mmcndmgr.dll file exist?
If so, did you try registering it as suggested? If not, try it. This is a valid DLL. The command you use would be:

regsvr32 c:\windows\system32\mmcndmgr.dll


Run the sfc /scannow procedure no matter what happens above.

 

That is not "ink". It is lnk. That's a lower case L. This extension is pronounced a "link" because that is what it is. It is a shortcut (aka a link) to a process to run. They are valid.

 

This is valid. Since you still have it installed, run it as they requested before we remove it.