Member Avatar for Tom Wade

finally got my computer going... not in safe mode. that ashweb seems to be a huge problem.

here is my newest hijack

Logfile of HijackThis v1.99.1
Scan saved at 8:41:07 AM, on 8/4/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: localhost 127.0.0.1
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lfoql.exe] C:\WINDOWS\System32\lfoql.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{54073110-24A0-4593-A4A8-73ED5C793859}: NameServer = ,
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{54073110-24A0-4593-A4A8-73ED5C793859}: NameServer = ,
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
O20 - Winlogon Notify: fslbpxhf - C:\WINDOWS\SYSTEM32\fslbpxhf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: xoamefwa - C:\WINDOWS\SYSTEM32\xoamefwa.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

please.. anyone... this is my third attempt here. i've been without a computer for 4 weeks.

  • 7 Contributors
  • 9 Replies
  • 261 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Short addendum to the thread (builds on and ): ashWebSv showing in a HijackThis log is most commonly the Avast Web‑Scanner component, but the important steps are verification and safe cleanup rather than blind removal. Confirm the file path and publisher first (legitimate installs historically live under C:\Program Files\Alwil Software\Avast4\ or C:\Program Files\AVAST Software\Avast\), and check the file’s Digital Signatures tab in Properties to make sure it’s signed by Avast. (community.avast.com)

Quick, reliable checks:

  • Look in Task Manager / Process Explorer for the process and note its full path.
  • Open Services (services.msc) and find the avast Web Scanner service name.
  • Right‑click the executable file → Properties → Digital Signatures to confirm the publisher.
    Do not delete a file by hand from System32; that can break the product or leave services/registry entries pointing to missing files.

If Avast was uninstalled incompletely (leftover service entries in HijackThis), remove it properly with the official removal utility (Avast Clear / avastclear.exe) and follow the vendor’s Safe Mode instructions, then reboot. Reinstall only if you need that product. Official uninstall instructions are here: Avast Uninstall Utility. (avast.com)

The HijackThis NameServer entries you posted (85.255.116.29 / 85.255.112.134) sit inside ranges that have been used by DNS‑changing malware in past campaigns (these trojans alter the NameServer registry keys to redirect DNS). Remedy by resetting your adapter DNS to obtain automatically (Network Connections → TCP/IP properties) and clear the local resolver cache with:

ipconfig /flushdns

Then run a full scan with an up‑to‑date anti‑malware product. For background on DNS‑changer behavior and the 85.255.* addresses, see F‑Secure and reporting on Operation Ghost Click. (f-secure.com) (learn.microsoft.com)

Note: running multiple real‑time antivirus engines causes conflicts and instability — pick one AV, fully uninstall the others (use vendor removal tools), then scan again. (microsoft.com)

Recommended Answers

All 9 Replies

Member Avatar for Maggot

:sad: i hate to inform you but that file is a malicous file.:sad:

remove it

Member Avatar for seaniesean

Yeah, i know it's old, but there's not a lot of information on this and this link comes up near the top of google search for ashwebsv.exe. Also, this still happens even with the newest version of HJT. I just want to make sure that nobody follows the advice of this complete idiot.

ashwebsv.exe is AVAST ANTI-VIRUS'S WEBSCANNER!!! YOU NEED IT IF YOU HAVE AVAST ANTIVIRUS!!! Furthermore, the "file missing" is a BUG in hijackthis. you will find that if you search your drive, it is likely not missing unless you uninstalled avast wrong or something. If you find the file, it's not missing, is it? If you run avast, you need it. Ignore hijack this and this idiot above. DO NOT REMOVE IT YOU WILL HAVE NO AVAST WEBSCANNER!!!

Member Avatar for jholland1964

Your problem is more than likely caused by the fact that you have THREE anti-virus programs running on the computer...at least a portions of Ewido Security Suite, and also Norton and Avast. The absolute rule is ONE anti-virus program on a computer. Pick ONE and totally UNINSTALL the others. Your choice. But be sure to UNINSTALL via Add/Remove, DON'T under any circumstances just delete them. If that Avast file shows as missing then it probably means that you attempted to uninstall but did not. You must do it the correct way otherwise portions of programs remain and cause problems.

Once you have done the uninstalls then REBOOT the computer. Delete the OLD version of HiJackThis that you have and download the newest version from Be sure to install it to a folder of it's own. To do this create a new folder by right clicking on the desktop and choose New Folder. Then Rename the Folder HJT.
Download the new version of HJT to this folder and then run a new full system scan. Post back here with that new log.
You need to run a new scan with the newest version of HJT because there IS malware showing on the present log.

Member Avatar for crunchie

The OP is long gone I suspect. Was posted back in 06 :D

Member Avatar for jholland1964

Lordy! Didn't even look at the original date!

Member Avatar for PhilliePhan

Lordy! Didn't even look at the original date!

Nice one, Judy! :D

Member Avatar for Nifnat

is normally a pat of avast home edition anti virus.

Member Avatar for Nifnat

If you are not using avast but have been in the past I sugest that you make sure you have properly uninstalled avast or that you left click ashwebsv.exe in windows task manager and end the proccess tree.

Member Avatar for crunchie

Thank you :).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.