Hijak This Log BIG TROUBLE...Help!

Samantha MAS · Jun 9, 2005

My computer is dumping to memory, the whole thing has been taken over by smut, my desktop wallpaper has been changed to some big warning saying my computer is infected and gives you a link to an AVGold anitvirus. Google has been hijack so that all ads etc are all adult sites and nasty words. I have run AVG (it found viruses and removed them), spybot ( also removed some stuff), Microsoft Anti spyware, all kinds of stuff. I read the tutorial for the Hijack this logs and tried to remove what I could, seems some of the things just came right back, like the AZE thing I keep removing! Please help, I don't want my kids to come home and try using the computer and see the stuff it says all over it. Here is my log:

Samantha MAS · Jun 9, 2005

Here is a picture of my desktop, no matter what I do I can't change the wallpaper

http://img.photobucket.com/albums/v18/SamanthaMas/Misc/Image1.jpg

AbbySue · Jun 9, 2005

You mention that you went through the HJT tutorial but did you follow ALL the steps in the READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal thread? If you have not, please go through the cleaning process now then post back with any questions you may have and give specifics as to what you found, what you could or could not do...what was removed. etc.

(If you have already completed the clean up please provide the above information re: specifics. If not and you are doing the complete clean up for the first time then proceed with the below when you are done.)

After doing ALL of the above if you still have a problem:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

Samantha MAS · Dec 28, 2005

Ok, I did everything I was told to in those threads and a few things of my own. I had viruses, spyware etc, that is supposed to be all gone now, but I still hav that giant warning taking over my desktop and everytime I click on it, it take me to this AntivirusGold website! I removed it, it came back. I ended the process, it started itself again!http://forums.majorgeeks.com/images/smilies/mad.gif I can't think of anything to do. Iran hijack this again, and have attached my log file. Hopefully someone can help me get this thing off my computer, I've already lost a ehole days work trying to fix it http://forums.majorgeeks.com/images/smilies/frown.gif

Thanks A Bunchhttp://forums.majorgeeks.com/images/smilies/wink.gif

chaslang · Jun 9, 2005

You have multiple antivirus applications installed (AVG and Panda). You must pick the one you want and uninstall the other.

Also look in Add/Remove program for AntivirusGold and uninstall if found.

You must remember to exit browsers before running HijackThis. Also you did not install HijackThis as requested. The below two lines are from your log and show what I mean:
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Samantha & Thomas.SAMANTHA-THOMAS\Desktop\KILLERS\hijackthis\HijackThis.exe

Fixing Locked Desktop
Also you should right click on your Desktop and select Properties. Then click the Desktop tab and then the Customize Desktop button. Now in the next window that comes up click the Web tab. Make sure at the bottom that Lock desktop items is unchecked. Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too. Then click OK. Apply. OK.

Now click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
On the page that opens, scroll down to System Startup Service or SvcProc ... right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

Next, open up HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

SvcProc

Now exit HijackThis and move on to my next message but make sure you have install HJT properly first.

chaslang · Jun 9, 2005

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 213.219.251.78 google.com
O1 - Hosts: 213.219.251.78 google.co.uk
O1 - Hosts: 213.219.251.78 google.ca
O1 - Hosts: 213.219.251.78 google.es
O1 - Hosts: 213.219.251.78 google.de
O1 - Hosts: 213.219.251.78 google.fr
O1 - Hosts: 213.219.251.78 google.com.au
O1 - Hosts: 213.219.251.79 www.yahoo.com
O1 - Hosts: 213.219.251.79 yahoo.com
O1 - Hosts: 66.218.75.184 mail.yahoo.com
O4 - HKLM\..\Run: [msxct] msxct.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) <--- may already be gone

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete (if found):
C:\WINDOWS\svcproc.exe
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Samantha MAS · Dec 28, 2005

Hi there, thanks for your help. I did everything you said to do, and to my knowlege I did it properly, but the damn thing is still on my desktop and it driving me absolutely insane!!! I have posted my new Hijack this log below, thanks a bunch

chaslang · Jun 12, 2005

You still have the below:

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Did all the steps related to this service work properly without errors? Were you able to find, stop, and disable the service? Were you able to Delete the NT service with HJT?

Please try the below.

Download Nail/Bolder/Aurora Remover 0.3.1 Beta and save it to its own folder like c:\ABIremover

- Now extract the abiremover.exe file from the ZIP file into the folder you created but do not run the EXE yet.

- Reboot into Safe Mode with no network suppost and do not run anything else but what I tell you to run!

- Run the ABIRemover.exe, press install, wait (explorer window will disapear)

- When it finishes just reboot into normal mode get a new HJT log and attach it. Also let me know the status of your Desktop.

Log in or Sign up

Hijak This Log BIG TROUBLE...Help!

Samantha MAS Private E-2

Samantha MAS Private E-2

AbbySue MajorGeeks Administrator

Samantha MAS Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Samantha MAS Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member