Think PC is finally clean, please check log.

whoaru99 · Oct 22, 2005

I have followed all the steps in the sticky and advice on removing specific threats. The computer was infected way bad with trojans, viri, and malware galore.

Some of the harder ones were AbetterInternet.Aurora and Altnet, but there were many, many, MANY others.

Think it's good to go thanks to this forum.

Would someone please check my HJT log just to be sure?

Thank you all!!!

chaslang · Oct 22, 2005

No you are not clean yet. You seem to have items that could be from an older form of Virtumundo.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [*srvlog] C:\WINDOWS\msagent\srvlog.exe
O4 - HKLM\..\Run: [*dvdcr] C:\WINDOWS\Tasks\dvdcr.exe
O4 - HKLM\..\Run: [*taskutil] C:\WINDOWS\Drivers\Intel\taskutil.exe
O4 - HKLM\..\Run: [*pcinfo] C:\WINDOWS\Tasks\pcinfo.exe
O4 - HKLM\..\Run: [*sysdoc] C:\WINDOWS\Tasks\sysdoc.exe
O4 - HKLM\..\Run: [*runanti] C:\WINDOWS\AppPatch\runanti.exe
O4 - HKLM\..\Run: [*ole] C:\WINDOWS\repair\ole.exe
O4 - HKLM\..\Run: [*winbak] C:\WINDOWS\inf\winbak.exe
O4 - HKLM\..\Run: [*sdb] C:\WINDOWS\system\sdb.exe
O4 - HKLM\..\Run: [*pcsys] C:\WINDOWS\inf\pcsys.exe
O4 - HKLM\..\Run: [*asmc] C:\WINDOWS\system\asmc.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete the below files (also look for and delete the same filenames but with any of the following extensions in addition to the .exe externison. .ini, .ini2, .bak, .bak2, .tmp, .dat )
C:\WINDOWS\msagent\srvlog.exe <--- example: also delete srvlog.ini srvlog.ini2...etc
C:\WINDOWS\Tasks\dvdcr.exe
C:\WINDOWS\Drivers\Intel\taskutil.exe
C:\WINDOWS\Tasks\pcinfo.exe
C:\WINDOWS\Tasks\sysdoc.exe
C:\WINDOWS\AppPatch\runanti.exe
C:\WINDOWS\repair\ole.exe
C:\WINDOWS\inf\winbak.exe
C:\WINDOWS\system\sdb.exe
C:\WINDOWS\inf\pcsys.exe
C:\WINDOWS\system\asmc.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

whoaru99 · Oct 27, 2005

Finally back to the computer.

Followed your instructions to run and fix the items indicated with HJT then searched in safe mode for the specified files. The search results were completely negative for all files indicated including the extension variants.

Ran Ccleaner and deleted the files in C:\windows\prefetch.

Computer seems to be running fine.

Attached is the new HJT log from normal boot mode per your request.

chaslang · Oct 28, 2005

Okay! Your log is clean! Time to check out the below to help keep you that way:

How to Protect yourself from malware!

Log in or Sign up

Think PC is finally clean, please check log.

whoaru99 Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

whoaru99 Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member