Very Challenging Worm 2

chaslang · Mar 7, 2006

Vast41 said:

The answer to this >>>> (Search your PC for alg.exe or alg.ex_
Tell me where you find them (if any)!) Is no performing othet steps now.
Click to expand...

Do you have your Windows XP CD and is it the same SP level as what is running on your system right now?

Vast41 · Mar 7, 2006

No i don't have a disk anymore, is that a problem i need to know??

Vast41 · Mar 7, 2006

Ok, performed all the steps in post 49 all were not there>>

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe
SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP....

C:\WINDOWS\qyhsotqe.exe
C:\Program Files\ISTsvc... NEVER could find them before, can't now. Logs are attached.

Vast41 · Mar 7, 2006

I meant to say these entrys were not in HJT

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe
SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

chaslang · Mar 8, 2006

Are you using MSconfig to control startups? It seems like it. Now those things I ask you to fix are showing in the runkeys.txt log.

There is no way that that stuff was in one log and not in the next unless you already fixed it previously. But now it shows in runkeys!

What exactly is it that you are doing???? Are you using msconfig instead of HijackThis to fix lines I gave you????

What happened to all the other programs that used to be running???? Why are they all missing from the O4 lines and now showing as being controlled by msconfig. I'm starting to wonder whether you are purposely not following instructions.

Please run msconfig and make sure you have selected Normal Startup then reboot and attach a new HJT log. And DO NOT RUN MSCONFIG ANYMORE unless I ask you to do so.

Log in or Sign up

Very Challenging Worm 2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Vast41 Private First Class

Vast41 Private First Class

Attached Files:

runkeys.txt

hijackthis.log

Vast41 Private First Class

chaslang MajorGeeks Admin - Master Malware Expert Staff Member