hjt

Re: hijack this log

Nice try!


Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

Re: hijack this log

Also since you have SO MANY problems, you need to add to the other steps and do the below too:

• Download Nail/Bolder/Aurora Remover 0.3.1 Beta and save it to its own folder like c:\ABIremover
• Now extract the abiremover.exe file from the ZIP file into the folder you created but do not run the EXE yet. We will run it later.
• IMPORTANT: Now boot in safe mode, run the abiremover.exe but make sure you are physically disconnected from the internet (unplug your cable to be sure). Just click install, wait (explorer window will disapear)
• When abiremover finishes just reboot into normal and continue with the below steps. But if it makes a reference to removing a hidden process, look for and delete the below files while still in safe mode:
  • C:\WINDOWS\svcproc.exe
  • C:\WINDOWS\Nail.exe
  • C:\WINDOWS\System32\vwgdoc.exe
  • C:\WINDOWS\System32\ilidyb.exe

- Note: If ABIremover fails to remove the nail.exe (See F2 line in HJT) problem and the SVCProc service entry in HJT O23 services list, use the below uninstaller:

Nail Uninstaller




Also download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster
• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program

 

Well that is a little better because I can see some of your problems are now fixed, but you still did not run ALL steps in the read me. Specifically the things I can tell that were not run are:

• MS Antispyware from step 5
• BitDefender online scan from step 6
• PandaActiveScan from step 6

And you did not attach the logs for BitDefender and Panda either. See step 6. This is a require step prior you running HJT and posting a log.

You have definitely made some progress by running some of the steps and you also appear to have run what I gave you in message # 3. And this has made a significant improvement. Following all steps will help us to remove ALL of your malware.

 

Merry Christmas too you too!

Your BitDefender log says nothing about was was fixed. Did you have it try to fix problems or did you only do a scan without fixing?

 

Re: hijack this log

Is the below part of the Ares P2P file downloading software? Ares is known to contain malware.
O4 - HKCU\..\Run: [Ares Galaxy FasterDownload] C:\Program Files\Ares Galaxy FasterDownload\Ares Galaxy FasterDownload.exe

For all OS types, make sure viewing of hidden files is enabled (per the tutorial).
Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Windows Updater] Winupdte.EXE
O4 - HKLM\..\RunServices: [Windows Updater] Winupdte.EXE
O4 - HKCU\..\Run: [Windows Updater] Winupdte.EXE

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
c:\windows\Winupdte.EXE or c:\windows\system32\Winupdte.EXE

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Reminder Note: Once we have determine you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Re: hijack this log

Okay your log is basically clean but you can have HJT fix these two lines:

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

How are things working now?

 

You're welcome. Now work your way thru this: How to Protect yourself from malware!