hijackthis post, aurora problem,winpatrol exe.r files, yikes

Question

xceptioner 0 Newbie Poster

21 Years Ago

My girlfriends son downloads off bit torrent sites. Recently he downloaded movie and it said it was corrupt. Now winpatrol pops up frequently about exe.r files and if I'd like them to start-up automatically. I downloaded hijackthis, here is a log, any help, guildance apprieciated.

Logfile of HijackThis v1.99.1
Scan saved at 8:17:04 PM, on 6/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\Grisoft\AVG Free\avgemc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.935\HijackThis.exe
C:\Documents and Settings\user\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
c:\windows\system32\sfsvlyw.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: www.symantec.com
O1 - Hosts: www.sophos.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: www.f-secure.com
O1 - Hosts: www.avp.com
O1 - Hosts: www.kaspersky.com
O1 - Hosts:
O1 - Hosts: www.ca.com
O1 - Hosts: www.my-etrust.com
O1 - Hosts: www.nai.com
O1 - Hosts: www.trendmicro.com
O1 - Hosts: securityresponse.symantec.com
O1 - Hosts: sophos.com
O1 - Hosts: mcafee.com
O1 - Hosts: liveupdate.symantecliveupdate.com
O1 - Hosts:
O1 - Hosts: f-secure.com
O1 - Hosts: kaspersky.com
O1 - Hosts:
O1 - Hosts: avp.com
O1 - Hosts:
O1 - Hosts: ca.com
O1 - Hosts:
O1 - Hosts: my-etrust.com
O1 - Hosts: download.mcafee.com
O1 - Hosts: dispatch.mcafee.com
O1 - Hosts: secure.nai.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: us.mcafee.com
O1 - Hosts: liveupdate.symantec.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: trendmicro.com
O1 - Hosts: sandbox.norman.no
O1 - Hosts: www.pandasoftware.com
O1 - Hosts: uk.trendmicro-europe.com
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [miktasv] c:\windows\system32\xtevjl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [uxkjzkj] c:\windows\system32\sfsvlyw.exe r
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks

microsoft:windows-nt-2000-xp security virus-malware

2 Contributors
10 Replies
300 Views
1 Week Discussion Span
Latest Post 21 Years Ago Latest Post by dlh6213

Dani AI

Generated 9 Months Ago

A quick summary and follow‑up for the thread: reported an infection after BitTorrent downloads and followed ’s removal steps (Ewido plus the targeted removal utility). The immediate symptoms and obvious files were removed and system performance improved. The advice below focuses on verification, cleanup left‑overs that often survive a first pass, and practical hardening to prevent reinfection.

Malware in this family commonly does three things: (1) injects persistent startup points (Run keys, services, startup folder entries), (2) alters name/location of the shell or system startup settings to relaunch itself, and (3) tampers with the hosts file or network settings to block antivirus/update sites. Some variants also drop randomly named executables into the Windows/System32 tree or install rootkit components that hide files/processes.

Recommended verification and cleanup checklist:

Inspect the hosts file at C:\Windows\System32\drivers\etc\hosts and remove any nonstandard entries (leave only the default localhost lines). Edit with Notepad run elevated.
Verify the shell setting (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and system.ini Shell line) is just Explorer.exe.
Use Sysinternals Autoruns to review every startup, service and scheduled task entry; disable unknown items and research unfamiliar image paths before deleting.
Run a current rootkit scanner (GMER/RootkitRevealer) and a full, up‑to‑date antivirus scan. Remove redundant real‑time AV products (running Norton and AVG simultaneously can cause problems); keep one and update signatures.
Turn off System Restore before final cleanup (malware can hide there), remove restore points, then re‑enable and create a fresh clean point.

Longer term: apply all Windows updates, uninstall unused P2P clients or run them in a sandbox/VM, maintain regular backups, and change important passwords after cleanup. If odd symptoms persist after these verifications, a clean OS reinstall is the safest option.

All 10 Replies

dlh6213 27 Posting Maven

21 Years Ago

Hi Xceptioner, welcome to DaniWeb :D

Aside from the legal aspects, malware is the next biggest problem with file sharing.

Nail is a part of Aurora.

Please review this thread:
http://www.daniweb.com/techtalkforums/thread24085.html

After you've moved HijackThis, please post a new log and we'll help you get the computer cleaned up.

dlh6213 27 Posting Maven

21 Years Ago

Either location would have been fine for HJT :) (C:\Documents and Settings\user\Desktop\hijackthis\HijackThis.exe or C:\Program Files\Hijackthis\HijackThis.exe)

You will need to disconnect from the internet so you may wish to print these instructions.

Download Ewido Security Suite from here:
http://fileforum.betanews.com/detail/ewido_security_suite/1098736486/1

Install and update it, and then close the program (don't scan yet).

Download Nailfix from here:

Unzip it to your desktop, but do not run it yet.

Disconnect from the net and reboot into Safe Mode.

Double-click on the Nailfix.cmd that is on your desktop. Your desktop and icons will disappear and reappear, and a window should open and close very quickly -- this is normal.

Then run a full system scan with Ewido (note: you will be posting the log from this scan when back in normal mode).

Still in Safe Mode, scan with hijackthis and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: www.symantec.com
O1 - Hosts: www.sophos.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: www.f-secure.com
O1 - Hosts: www.avp.com
O1 - Hosts: www.kaspersky.com
O1 - Hosts:
O1 - Hosts: www.ca.com
O1 - Hosts: www.my-etrust.com
O1 - Hosts: www.nai.com
O1 - Hosts: www.trendmicro.com
O1 - Hosts: securityresponse.symantec.com
O1 - Hosts: sophos.com
O1 - Hosts: mcafee.com
O1 - Hosts: liveupdate.symantecliveupdate.com
O1 - Hosts:
O1 - Hosts: f-secure.com
O1 - Hosts: kaspersky.com
O1 - Hosts:
O1 - Hosts: avp.com
O1 - Hosts:
O1 - Hosts: ca.com
O1 - Hosts:
O1 - Hosts: my-etrust.com
O1 - Hosts: download.mcafee.com
O1 - Hosts: dispatch.mcafee.com
O1 - Hosts: secure.nai.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: us.mcafee.com
O1 - Hosts: liveupdate.symantec.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: trendmicro.com
O1 - Hosts: sandbox.norman.no
O1 - Hosts: www.pandasoftware.com
O1 - Hosts: uk.trendmicro-europe.com
O4 - HKLM\..\Run: [miktasv] c:\windows\system32\xtevjl.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe (file missing)

Close any open windows, other then hijackthis, before hitting Fix checked.

Go to the following locations and delete the highlighted files:

C:\WINDOWS\Nail.exe
c:\windows\SvcProc.exe
c:\windows\system32\xtevjl.exe

Empty your Recycle Bin and reboot normally.

Close any open browser windows, scan with HJT and post a new log along with the Ewido log.

dlh6213 27 Posting Maven

21 Years Ago

Open Firefox, go to Tools, Options, and click on Privacy (padlock icon on the left); click on the Clear All button.

Go to C:\WINDOWS and delete Nail.exe

Empty your Recycle Bin and do a search for Nail.exe and delete any instances found.

Empty your Recycle Bin again, reboot, and do a search for Nail.exe again. Let us know if it still shows up, and where it's located if it does.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

xceptioner 0 Newbie Poster · Answer 1 · 2005-06-26T06:38:08+00:00

Sorry, almost forgot. I've got the NAIL.EXE virus as well.

thanks

xceptioner 0 Newbie Poster · Answer 2 · 2005-06-26T21:00:44+00:00

I did these things, well at least I thought so. I made the desktop folder, and I made a folder in c, program files, and I named it Hijackthis\Hijackthis.exe. should the file just be called hijackthis??

any clarification would be helpful. I was unsure when I did these things.

xceptioner 0 Newbie Poster · Answer 3 · 2005-06-26T21:05:51+00:00

I renamed the folder in program files and ran another log...

Logfile of HijackThis v1.99.1
Scan saved at 11:02:36 AM, on 6/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\user\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: www.symantec.com
O1 - Hosts: www.sophos.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: www.f-secure.com
O1 - Hosts: www.avp.com
O1 - Hosts: www.kaspersky.com
O1 - Hosts:
O1 - Hosts: www.ca.com
O1 - Hosts: www.my-etrust.com
O1 - Hosts: www.nai.com
O1 - Hosts: www.trendmicro.com
O1 - Hosts: securityresponse.symantec.com
O1 - Hosts: sophos.com
O1 - Hosts: mcafee.com
O1 - Hosts: liveupdate.symantecliveupdate.com
O1 - Hosts:
O1 - Hosts: f-secure.com
O1 - Hosts: kaspersky.com
O1 - Hosts:
O1 - Hosts: avp.com
O1 - Hosts:
O1 - Hosts: ca.com
O1 - Hosts:
O1 - Hosts: my-etrust.com
O1 - Hosts: download.mcafee.com
O1 - Hosts: dispatch.mcafee.com
O1 - Hosts: secure.nai.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: us.mcafee.com
O1 - Hosts: liveupdate.symantec.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: trendmicro.com
O1 - Hosts: sandbox.norman.no
O1 - Hosts: www.pandasoftware.com
O1 - Hosts: uk.trendmicro-europe.com
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [miktasv] c:\windows\system32\xtevjl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Also, I still have remaining issues with the serflog virus, I can't access anti-virus sites. It gives me the 404 cannot find server error.

xceptioner 0 Newbie Poster · Answer 4 · 2005-06-27T04:06:55+00:00

Hope this is better

Logfile of HijackThis v1.99.1
Scan saved at 6:06:11 PM, on 6/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: www.symantec.com
O1 - Hosts: www.sophos.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: www.f-secure.com
O1 - Hosts: www.avp.com
O1 - Hosts: www.kaspersky.com
O1 - Hosts:
O1 - Hosts: www.ca.com
O1 - Hosts: www.my-etrust.com
O1 - Hosts: www.nai.com
O1 - Hosts: www.trendmicro.com
O1 - Hosts: securityresponse.symantec.com
O1 - Hosts: sophos.com
O1 - Hosts: mcafee.com
O1 - Hosts: liveupdate.symantecliveupdate.com
O1 - Hosts:
O1 - Hosts: f-secure.com
O1 - Hosts: kaspersky.com
O1 - Hosts:
O1 - Hosts: avp.com
O1 - Hosts:
O1 - Hosts: ca.com
O1 - Hosts:
O1 - Hosts: my-etrust.com
O1 - Hosts: download.mcafee.com
O1 - Hosts: dispatch.mcafee.com
O1 - Hosts: secure.nai.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: us.mcafee.com
O1 - Hosts: liveupdate.symantec.com
O1 - Hosts:
O1 - Hosts:
O1 - Hosts: trendmicro.com
O1 - Hosts: sandbox.norman.no
O1 - Hosts: www.pandasoftware.com
O1 - Hosts: uk.trendmicro-europe.com
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [miktasv] c:\windows\system32\xtevjl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

xceptioner 0 Newbie Poster · Answer 5 · 2005-06-29T08:54:55+00:00

Hi, I did all the stuff in your reply (thanks for your time & advice). I couldn't find the xtevjl.exe file to delete it though. here is my new hijack log, & ewido log. Thanks again...

Logfile of HijackThis v1.99.1
Scan saved at 10:50:50 PM, on 6/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Documents and Settings\user\Desktop\security suite\ewidoctrl.exe
C:\Documents and Settings\user\Desktop\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\user\Desktop\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\user\Desktop\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



---------------------------------------------------------
 ewido security suite - Connection report
---------------------------------------------------------

 + Created on:          10:18:06 PM, 6/28/2005
 + Report-Checksum:     78D609B3

---------------------------------------------------------
 ewido security suite - Process report
---------------------------------------------------------

 + Created on:          10:17:45 PM, 6/28/2005
 + Report-Checksum:     CE44A8EE

       0: System Process
       4: System Process
     136: \SystemRoot\System32\smss.exe
     188: \??\C:\WINDOWS\system32\csrss.exe
     212: \??\C:\WINDOWS\system32\winlogon.exe
     256: C:\WINDOWS\system32\services.exe
     268: C:\WINDOWS\system32\lsass.exe
     420: C:\WINDOWS\system32\svchost.exe
     464: C:\WINDOWS\system32\svchost.exe
     528: C:\WINDOWS\system32\svchost.exe
    1420: C:\WINDOWS\system32\NOTEPAD.EXE
    1480: C:\WINDOWS\explorer.exe
    1568: C:\Documents and Settings\user\Desktop\security suite\SecuritySuite.exe

---------------------------------------------------------
 ewido security suite - Scan report
---------------------------------------------------------

 + Created on:          10:18:51 PM, 6/28/2005
 + Report-Checksum:     8CFC5F67

 + Scan result:

    :mozilla.26:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    :mozilla.27:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.28:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.53:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.54:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
    :mozilla.59:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
    :mozilla.61:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
    :mozilla.62:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
    :mozilla.75:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
    :mozilla.76:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.79:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.86:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.87:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.88:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.100:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
    :mozilla.101:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
    :mozilla.102:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
    :mozilla.112:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.113:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.114:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.115:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.117:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.118:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.119:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.120:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.121:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.122:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.123:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.124:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.125:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.126:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.127:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.128:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.129:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.130:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.131:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.132:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.133:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.147:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
    :mozilla.148:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
    :mozilla.149:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
    :mozilla.165:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\qc68d07h.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
    C:\Program Files\Grisoft\AVG Free\avgemc.exe -> Heuristic.Win32.Dialer : Cleaned with backup


::Report End

---------------------------------------------------------
 ewido security suite - Startup report
---------------------------------------------------------

 + Created on:          10:18:22 PM, 6/28/2005
 + Report-Checksum:     48FEE6D6

Reg\HKLM\Run         Logitech Utility                         Logi_MwX.Exe                                                                                        
Reg\HKLM\Run         Microsoft Works Portfolio                C:\Program Files\Microsoft Works\WksSb.exe /AllUsers                                                
Reg\HKLM\Run         NeroFilterCheck                          C:\WINDOWS\system32\NeroCheck.exe                                                                   
Shell\CommonStartup  Adobe Reader Speed Launch.lnk            C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk       
Shell\CommonStartup  Logitech Desktop Messenger.lnk           C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk      
Shell\CommonStartup  Microsoft Office.lnk                     C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk                
Shell\CommonStartup  Microsoft Works Calendar Reminders.lnk   C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
File\SystemIni       il.exe                                   Explorer.exe C:\WINDOWS\Nail.exe                                                                    
Reg\HKLM\Run         WorksFUD                                 C:\Program Files\Microsoft Works\wkfud.exe                                                          
Reg\HKLM\Run         SunJavaUpdateSched                       C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe                                                   
Reg\HKLM\Run         TkBellExe                                "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot                               
Reg\HKLM\Run         WinPatrol                                "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"                                                       
Reg\HKLM\Run         Microsoft Works Update Detection         C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe                             
Reg\HKLM\Run         ccApp                                    "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"                                           
Reg\HKLM\Run         iTunesHelper                             "C:\Program Files\iTunes\iTunesHelper.exe"                                                          
Reg\HKLM\Run         AVG7_CC                                  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP                                                     
Reg\HKLM\Run         AVG7_EMC                                 C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe                                                             
Reg\HKCU\Run         RHSI SHS                                 "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background                                           
Reg\HKCU\Run         Update Manager                           "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background                              
Reg\HKCU\Run         SHS                                      "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background                                           
Reg\HKCU\Run         msnmsgr                                  "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

Hope this looks better. If I should do anything else, please let me know.

xceptioner 0 Newbie Poster · Answer 6 · 2005-07-05T08:25:53+00:00

Hi, I did a search for the "NAIL.exe" file and found no instance of it?? I did a search in windows, and got no results. I'm hoping that's a good thing!!

Thanks alot, my pc runs a 100 x's better now.

dlh6213 27 Posting Maven Team Colleague · Answer 7 · 2005-07-07T17:28:31+00:00

Sounds like you're all cleaned up :)

To help prevent being reinfected, please follow the recommendations here:

http://www.daniweb.com/techtalkforums/thread27519.html

hijackthis post, aurora problem,winpatrol exe.r files, yikes

Dani AI

Recommended Answers Collapse Answers

All 10 Replies

Recommended Answers