Member Avatar for batigoali

title pretty much says it. think its malware but i ran malbytes and avg antivirus and got nothing. here is my hijack log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:05:32 PM, on 6/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Internet Explorer\iexplorer.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [SystemManger] C:\Program Files\Internet Explorer\iexplorer.exe
O4 - HKUS\S-1-5-21-1935655697-1897051121-725345543-500\..\Run: [SystemManger] C:\Program Files\Internet Explorer\iexplorer.exe (User '?')
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4180 bytes

  • 2 Contributors
  • 1 Reply
  • 196 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Quick diagnosis and safe priorities — the symptoms you describe (web works only right after a reboot) point at two common causes: a small autorun program that later spawns or interferes with browsing, or corruption/third‑party hooks in the Winsock/LSP layer. A browser‑masquerading executable is a well‑known trick; antivirus web‑interceptors (LinkScanner/Active Surf‑Shield) can also inject protocol handlers that change how pages load. (bleepingcomputer.com)

Practical first moves (non‑destructive)

  • Do a fresh HijackThis “Scan Only” and note any suspicious autorun item (as suggested). Boot to Safe Mode with Networking to remove the offending startup entry or file if it won’t delete in normal mode.
  • Before deleting: confirm the executable’s full path and signer (don’t remove legit Microsoft files). Inspect the running process with Process Explorer and, if possible, submit the file/hash to VirusTotal for a second opinion. These checks avoid deleting the real browser binary by mistake. (learn.microsoft.com)

Network layer repairs (low‑risk)

  • Reset the Winsock catalog and flush DNS, then reboot. On XP this is done from an elevated command prompt:
    netsh winsock reset and ipconfig /flushdns — reboot afterwards. Winsock resets are a common fix for LSP/corruption problems but may require reinstalling any software that installs its own network hooks (antivirus, VPN clients). (learn.microsoft.com)

What to watch for next

  • If you see an unknown Winsock provider entry in the HJT log (name/provider DLL) it may be a legacy NetWare provider and not malware — treat it differently than an obvious rogue. If AVG’s LinkScanner (or similar) is present, try updating or temporarily disabling it; real‑time pre‑scanning modules have historically caused browsing glitches. After cleanup re‑run HJT and post the new log so helpers can confirm the changes. (pchell.com)

Notes and cautions: make a restore point or image before manual removals; if removal or Winsock reset breaks a needed program, reinstall that program rather than attempting registry surgery.

Member Avatar for gerbil

Hello, bati. Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.

O4 - HKCU\..\Run: [SystemManger] C:\Program Files\Internet Explorer\iexplorer.exe
O4 - HKUS\S-1-5-21-1935655697-1897051121-725345543-500\..\Run: [SystemManger] C:\Program Files\Internet Explorer\iexplorer.exe (User '?')
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:

Delete this file: C:\Program Files\Internet Explorer\iexplorer.exe [it's okay... the correct file is iexplore.exe, and it may still be in the Internet Explorer folder].
Post another log run afterward with yur comments, please.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.