Member Avatar for JeromyLeng

Hey, i have gotten an annoying peice of malware on my comp. It is a message that keeps displaying saying Your Computer is Infected! Critical System Error! Blah Blah Blah. I have gotten rid of all the viruses and spyware associated with this. Here is my Hijack This log.

Logfile of HijackThis v1.99.1
Scan saved at 7:45:58 PM, on 7/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometab.bellsouth.net/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Trixie.Bho - {B0744341-96E0-4341-9ED2-8BC36CE0CCD0} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [msnsmgr] MsnMsr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O21 - SSODL: fairydom - {5839511e-ec1b-4f91-ace3-fb88e52f5239} - C:\WINDOWS\system32\jevtxpg.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

IF you know what the problem is, plz repost or [Mod's note: email addy snipped as per our posting rules]. Your help will be highly appreciated. Thanks for the time.

  • 2 Contributors
  • 3 Replies
  • 218 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

Quick summary: ’s System Restore removed the visible fake-alerts, but that only fixes the symptom. Rogue “fake‑antivirus” families (SpyFalcon / SpywareQuake and relatives) are designed to show alarming taskbar warnings and can leave behind files, registry entries and persistence mechanisms that survive simple fixes. See a community removal writeup for this family for details. (SpyFalcon removal guide). (bleepingcomputer.com)

Why that matters: System Restore keeps snapshots (restore points) that can contain copies of infected files. Because of that, it’s generally recommended to leave System Restore enabled while cleaning so a working rollback is available, and only purge/flush restore points once the system is confirmed clean. Other guides recommend deleting old restore points after a successful cleanup to avoid re‑infecting the machine. (discussion on restore points and malware, example removal guide that follows this workflow). (experts-exchange.com)

Practical checklist to follow now (actionable and ordered):

  1. If the machine is still showing alerts, disconnect network access.
  2. Boot into Safe Mode (with Networking) or use a rescue environment.
  3. Update and run a current anti‑malware scanner (Malwarebytes or equivalent) and remove everything it finds.
  4. Run a trusted anti‑rootkit utility (for example TDSSKiller) and any rescue‑disk scanners if infections persist.
  5. Re‑scan with a second‑opinion scanner and review any remaining persistence (startup entries, scheduled tasks, browser helpers). If unsure, generate fresh logs for review before deleting things. (See vendor guides for tool usage and rescue options.) (malwarebytes.com)

Aftercare: once multiple clean scans show no re‑appearance, delete old restore points and create a fresh restore point, update Windows and all apps, and change important passwords from a known‑clean device. If malware keeps returning or a rootkit is suspected, a full reinstall (after file backup) is the most reliable cure. If further help is needed, re-post the current scan logs and a short description of what you see — ’s suggestion to re-run diagnostics is still a good next step. (bitdefender.co.uk)

Recommended Answers

All 3 Replies

Member Avatar for DMR

I have gotten rid of all the viruses and spyware associated with this.

Unfortunatley, your HJT log disagrees with you... :mrgreen:

You have a variant of the Spy Falcon/Spyware Quake malware, the removal of which requires the use of a specific procedure.
The most up-to-date version of that procedure can be found here. Please follow the instructions fully and carefully. When you have completed the removal procedure, please post the contents of the C:\smitfiles.txt and C:\Program Files\RoguesScanFix\task.txt log files which were created during the procedure.

Member Avatar for JeromyLeng

Hey thanks for the time, but i just did a system restore and everything is back to normal. I appreciate the effort though. Thank you.

Member Avatar for DMR

I'm glad the Restore got rid of the bogus alert, but there were other indications of infections in your HJT log. If any of those infections were present on the date/time that you restored back to, at least some of the malicious components will still exist on your computer (whether or not you actually see any symptoms).

If you would like, I'd suggest scanning the newly-restored system with HijackThis and posting the log for our review. As the saying goes: better safe than sorry. :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.