ID exe and hijacker lines

hic-lock · Sep 16, 2004

First off GREAT SITE.

I have "only the best" aka "HSA" and "about:blank" hijackers.

I have read, downloaded and followed the step-by-step instructions on the "READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal" post by Major Attitude and it still shows up.

At the "Scanning And Cleaning Step:#7, I turned my efforts to the "When all else fails-Generic Solution to HSA (Only the Best) & About:Blank hijack" post by chaslang. I am currently trying to ID good/bad lines in my Processes list and the 04 section of my HijackThis.log file before I continue, as recomended before I continue.

At this point my questions are:

The "nvsvc32.exe" appears to be a virus, is this correct.

I'm not able to find substantial info on the "winth32.exe" and the "sysiw32.exe". Chaslang's post describes that the 32 just before the .exe may point to a bad file. Are these to come out?

Also I see a few strings in the R1 - 016 section of the log that should come out. But it is very difficult to ID these things so any help there will be appreciated.

chaslang · Sep 16, 2004

nvsvc32.exe is a process that belongs to the NVIDIA graphics card drivers. This process should not be removed to ensure that your graphics card drivers is working properly.

Here are your R0 & R1 lines R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\neakt.dll/sp.html#96676

Thus the file you need to delete the contents of and resave is: C:\WINDOWS\system32\neakt.dll

Your BHO line is:
O2 - BHO: (no name) - {B2E5AAE7-C7F0-C2A6-61EC-3AB838955A17} - C:\WINDOWS\system32
\crdp.dll

Your O4 process (only 1):
O4 - HKLM\..\Run: [sysiw32.exe] C:\WINDOWS\system32\sysiw32.exe

Other processes (only 1):
C:\WINDOWS\winth32.exe

Did you find either NSS or WNS running? If so, what was the path to executable? Was it C:\WINDOWS\winth32.exe ?

Do you have enough now to continue? Please note you may need to check your log again before proceeding since this problem can mutate with reboots and from attempted partial fixes.

hic-lock · Sep 16, 2004

chaslang, thanks for the reply. I was impatient and went forward with the cleaning before the reply.

I did have NNS running and it was in your stated path.

As of now about blank is not hijacking but OTB has poped up once.

I'm at the last step of your solution page. I'm doing some minor surfing with a few reboots with my sys restore still disabled.

I'll be glad to post my HJT log again if you ask. Sorry about the first one, I did not see the ATTN. post at the top of the page.

chaslang · Sep 16, 2004

hic-lock said:

chaslang, thanks for the reply. I was impatient and went forward with the cleaning before the reply.

I did have NNS running and it was in your stated path.

As of now about blank is not hijacking but OTB has poped up once.

I'm at the last step of your solution page. I'm doing some minor surfing with a few reboots with my sys restore still disabled.

I'll be glad to post my HJT log again if you ask. Sorry about the first one, I did not see the ATTN. post at the top of the page.
Click to expand...

If you got an OTB popup, it sounds like you still have the problem to me! Note: you should not be surfing while doing the repairs. You must be disconnected and remain disconnected until completes.

After finishing the procedure, post the logs as requested but do not shutdown or reboot your PC so we can avoid any mutation. Just what for me to come back with the next steps (unless you are sure you can figure out how to run thru the procedure again correctly on your own. That is...assuming there is still a problem.)

hic-lock · Sep 16, 2004

OK.... I did reboot as told in the solution. I also reestablished my connection to the internet and visited here and some other minor surfing.

I was not surfing nor connected while repairing.

In the future I will wait for a reply before continuing, as I am certain I can not cure this on my own.

Edit by chaslang: changed inline log to attachment.

chaslang · Sep 16, 2004

Right now your log looks good. The problem appears to be solved. But I have a few questions.

Did you actually do

1) step 13a (Reset Web Settings)
2) step 13k run About:Buster first time? Where's the log attachment?
3) step 16 run About:Buster second time? Where's the log attachment?

Part of the reason I ask is that no R0 & R1 lines show at all in your log.
Step 13 should have set defaults except home page (which was set to majorgeeks).
But both steps 13k and 16 should have reset the home page to www.google.com which I would expect to show in an R0 line.
Also I wanted to see the About:Buster logs as requested in the procedure.

Note your HJT log (and the About:Buster logs) should be posted as text attachments. Not in line text. Noticed how I fixed it for you.

Question & other comment:
1) Can I safely assume you know what these are:
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = waterway.waterway.net
O17 - HKLM\Software\..\Telephony: DomainName = waterway.waterway.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = waterway.waterway.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = waterway.waterway.net

2) You really need to get your OS & IE updated. At least get up to SP1 on both of them. And get the other critical updates too (other than WinXP SP2). When you are sure everything is running okay (no virus/other malware problems) your should look into SP2. Why haven't you updated? Slow internet connection?

hic-lock · Sep 16, 2004

chaslang, I have posted my HJT log from step 17. At step 19, after a few boots and some typ. surfing the OTB and A:B junk kicked back up. Thinking it would be benifical to check my HJT log I did and IT HAS CHANGED FROM WHAT I POSTED. My bad........

1) Yes I did complete step 13a... I even put majorgeeks.com in the home page line.

2 & 3) yes I ran aboutBuster in step 13k. The log file has been overwritten by step 16 and I have that log.

About the 017 lines, I now the Domain is waterway.

We do have an IT guy but he's not inhouse. If we have problems we call him. In my opinion he is a jackleg. I told him about my problems and he spent a whopping 15 seconds on my machine, then told me he would have to burn it down to get the problem fixed.

As far as the updates, I didn't know this was a problem. Thanks for pointing this out and I'll be sure to do it when I have the time. I would have thought the IT guy would have taken care of it for all of us.

Again, sorry for posting the older HTF.....

chaslang · Sep 16, 2004

Make sure you save the About:Buster logs to differnent file names each time (like ab1.txt then ab2.txt).

The following is the file you are going to edit with notepad in step 5:
C:\WINDOWS\system32\lcecf.dll

The following is your O2 BHO for step 7
O2 - BHO: (no name) - {50B7E5C6-CBCB-96EC-1B80-B6EEA0F4D5FC} - C:\WINDOWS\system32\d3od32.dll

The following are your O4 lines for step 8
O4 - HKLM\..\Run: [mfcyr.exe] C:\WINDOWS\mfcyr.exe
O4 - HKLM\..\RunOnce: [vedmy] C:\WINDOWS\twain_32.dll:vedmy

For step 10 you need to delete:
- C:\WINDOWS\system32\d3od32.dll
- C:\WINDOWS\mfcyr.exe
- C:\WINDOWS\twain_32.dll:vedmy <---- I'm guessing that this is going to be trouble finding or deleting. Let me know (but do not conect to the internet using this PC during this repair process. Wait until you finish to tell me.
- and any files you find in step 6 for NSS or WNS
The following are your lines for Step 12:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lcecf.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lcecf.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - Default URLSearchHook is missing

In step 14 where I have you run Ad-aware SE, this time do not select full system scan. Do the below:
Run Ad-aware SE and click Scan Now, the choose the Scan volume for ADS. The click the underlined word 'Select'. Choose you harddisk drive (C) and then click Proceed. The click Next. If it finds anything tell me what it finds.

hic-lock · Sep 20, 2004

chaselang, as of now I have paused at step 17, the problem PC is still in safe mode and disconnected.

I have completed steps below and here is what you have requested.

hic-lock · Sep 20, 2004

one more thing, twain_32 was not hard to find and WNS did show up with that same path

hic-lock · Sep 20, 2004

here is the rest of the log files

btw, i've lost the ability to edit posts

chaslang · Sep 20, 2004

You do not have the proper version of Ad-aware SE. Please update to 1.05.

Did Ad-Aware fix all of the ADS items it found?

hic-lock · Sep 21, 2004

sure did, i updated as i was wating for your reply, and yes had it fix the ADS files it found.

Well, thanks to you fine folks at Majorgeeks.com, my problem has been solved. I also learned a few things to boot! This is a very helpful site and I'm amazed at the promtness to reply.

I'll now look into updating mt OS and IE as you stated.

Thanks again,
Mark L.
Virginia Beach, VA.

chaslang · Sep 21, 2004

You're welcome. So I assume the hijacker problems are all resolved?

hic-lock · Sep 21, 2004

Yes chaslang you're right, no more hijacker!

As for the rest of the folks that are struggling, hang in there. These Major Geeks are top-notch.

Thanks again

chaslang · Sep 21, 2004

You are most welcome again! Happy surfing!

Log in or Sign up

ID exe and hijacker lines

hic-lock Private E-2

Attached Files:

hijack this.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

Attached Files:

hjt.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

Attached Files:

hijackthis-a1.txt

AB LogFile.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

Attached Files:

AB LogFile2a.txt

Ad-Aware_SE-2.txt

hic-lock Private E-2

hic-lock Private E-2

Attached Files:

AB LogFile_2b.txt

hijackthis_2b.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ID exe and hijacker lines

hic-lock Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

Attached Files:

hic-lock Private E-2

hic-lock Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hic-lock Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches