Member Avatar for Razhem

I'm sorry that this has to be my first post here.

Did a couple of big mistakes with .exe files and I'm paying the price. Explorer turns off and on reseting itself and every time it does it, it also closes any folders that may be open. Also, from another source, I have problems browsing some webpages with Firefox.

This is my Hijack This Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:24:38, on 29/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Archivos de programa\Java\jre1.6.0_07\bin\jusched.exe
C:\Archivos de programa\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\wscntfy.exe
C:\ARCHIV~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\imapi.exe
C:\Archivos de programa\CCleaner\CCleaner.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O4 - HKLM\..\Run: [StartCCC] C:\Archivos de programa\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Archivos de programa\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{BFA8D811-39DD-4849-B039-A713D71035BD}: NameServer = ;
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2EEF9F0-0B70-4B8F-AFAC-3E80DEF3F2AB}: NameServer = ;
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Archivos de programa\Archivos comunes\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4153 bytes

Thanks for any help given and sorry for the mess...

  • 2 Contributors
  • 4 Replies
  • 255 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by cohen

Dani AI

Generated

Good to see this was resolved: steered things toward an on-demand scanner and reports Spybot removed the offending items. For anyone who finds this thread later, here is a compact, practical follow‑up checklist to make sure the system is fully clean and to stop Explorer/network symptoms from coming back.

  • Run full, updated scans from multiple on‑demand tools (Malwarebytes plus a reputable online scanner or a rescue/rescue-ISO scan) while booted to Safe Mode where possible.

  • Reset the network stack and DNS cache to clear LSP/hook artifacts and cached hijacks. Run these from an elevated command prompt, then reboot:

    ipconfig /flushdns
netsh int ip reset resetlog.txt
netsh winsock reset

  • Inspect the hosts file at C:\Windows\System32\drivers\etc\hosts for unexpected entries and remove any lines that redirect common domains. Check the adapter TCP/IP properties and restore DNS to automatic (or set to a trusted public DNS) if custom servers were placed without your consent.

  • Use Autoruns (Sysinternals) to review startup items, shell extensions and Winsock providers; disable unknown entries rather than deleting them outright. Check Event Viewer (Application/System) for explorer.exe crash entries to get a timestamped error code or module name.

  • If browsers still fail on specific pages, try creating a fresh browser profile or reinstalling the browser; test with another browser to separate system vs. browser-level problems.

  • After cleanup, run SFC (sfc /scannow) to repair system files (XP may request the install CD), change important passwords, and make a backup image or system restore point.

If problems persist or you suspect a rootkit, an offline rescue disk scan or a clean OS reinstall (after backing up data) is the safest final step.

Recommended Answers

All 4 Replies

Member Avatar for Razhem

Bump

Member Avatar for cohen

Hello and Welcome to Daniweb.

Sorry for the delay in reply....

A virus is mot likely causing you problems.... so pls follow below and we can find out the problems :)

1. - Download Malwarebytes' Anti-Malware (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

2. - Download hijackthis and post the log.

In your reply, post the logs (in this order):
1. - Malware Bytes Log
2. - Hijackthis Log

Thanks,

Cohen

Member Avatar for Razhem

Already solved it, only needed to do a scan with a good antispyware program. Spybot Search and Destroy did the deed.

Member Avatar for cohen

OK,

No Problems.

Post back if you have any more future problems :)

Cohen

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.