please check my log

Comments

• Crunchie Mandurah. Western Australia. Member

  August 2006 edited August 2006

  Can you please do the following.
  
  ===============
  
  Scan with HijackThis and then place a check next to all the following, if present:
  
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
  
  O4 - HKLM\..\Run: [vssms32] G:\WINDOWS\System32\vssms32.exe
  
  
  Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
  
  ===============
  
  Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:
  
  files...
  
  G:\WINDOWS\System32\vssms32.exe
  
  -
  
  Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear.

  Select the first option to run Windows in Safe Mode hit enter.
  
  -
  
  Reboot.
  
  ===============
  
  Please download and install ewido anti-spyware tool

  • Close all other Applications Select language click Ok
  • Click I Agree
  • Click next
  • Click Install
  • Click Finish
  • Wait and Ewido will open to the main screen automatically.
  • Wait again a few minutes and Ewido Should Auto update itself. If it doesn't click update at top of screen.
  • This is very important to get updates
  • When updating has finished. Close Ewido.

  If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.

  • Next, please reboot your computer in Safe Mode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear use arrow up to highlight
  • Select the first option, to run Windows in Safe Mode hit enter.
  • For additional help in booting into Safe Mode, see the following site: HERE
    
    You MUST manage to get into Safe Mode for the fix to work.

  Make sure to close all open windows/programs/folders. Have nothing else open while ewido performs its scan!

  • Open Ewido.
  • Click on scanner at top of Ewido sceen.
  • Click on Settings.
  • Under How to Act click on Recommended Action and choose Quarantine.
  • Under How to scan all boxes should be selected.
  • Under Possibly unwanted software all boxes should be selected.
  • On right side under Reports: click on Automatically generate report after every scan.
  • Under What to scan select scan every file.
  • Click On scan Tab.
  • Click on Complete system scan.
  • Let the program scan the machine It can take awhile give it time.
  • When scan has finished at bottom of screen click Apply all Actions.
  • Click Save report
  • Click Save Report as (Save as window's screen should pop up.)
  • Click desktop.
  • Click Save.
  • Exit ewido.

  Reboot back to normal mode.
  
  After rebooting, rescan with hijackthis and post back a new log as well as the log from Ewido. Please let me know how your pc is now.

  0
• Nutty110

  August 2006 edited August 2006

  hello....im posting now on my old slow computer....
  I tryed putting my computer new one in Safe Mode but it keeps rebooting on me....It goes part way in Safe Mode then text stops scrolling. Then it reboots. On my new computer I had 2 boot areas...1 in C drive and the infected newer boot drive in G Drive. G drive is what Ive been using for years now, and that is the original highjackthis log I posted. I tryed using ewido ant-spyare tool on the boot C drive which it found many problems....I followed the instructions you gave me. I tryed rebooting and using G drive but now it doesnt boot on normal and Safe Mode. Do you have any ideas how I can reboot my G drive and get it going without it looping on me....thanks

  0
• Nutty110

  September 2006 edited September 2006

  Finally got it to boot up.....But It still loops when I try to go into SAFE Mode......any suggestions?

  0
• Crunchie Mandurah. Western Australia. Member

  September 2006 edited September 2006

  Not sure what is happening there. For now, just run Ewido in normal mode following all other instructions above and let's see what we have.

  0
• Nutty110

  September 2006 edited September 2006

  Here is my Highjackthis log....Still cant do a Safe mode.....the problem before was my error as I used the System Configuration Utility method and left the BOOT.ini in safemode option...its set back to normal now. Also my Ewido log was to long...I will rescan with Ewido and send log....thanks
  
  Logfile of HijackThis v1.99.1
  Scan saved at 12:34:39 PM, on 9/1/2006
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  G:\WINDOWS\System32\smss.exe
  G:\WINDOWS\system32\winlogon.exe
  G:\WINDOWS\system32\services.exe
  G:\WINDOWS\system32\lsass.exe
  G:\WINDOWS\System32\Ati2evxx.exe
  G:\WINDOWS\system32\svchost.exe
  G:\WINDOWS\System32\svchost.exe
  G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  G:\WINDOWS\system32\Ati2evxx.exe
  G:\WINDOWS\Explorer.EXE
  G:\WINDOWS\system32\spoolsv.exe
  G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  G:\WINDOWS\System32\devldr32.exe
  G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  G:\utilities\ewido anti-spyware 4.0\guard.exe
  G:\Program Files\Common Files\Symantec Shared\ccApp.exe
  G:\WINDOWS\System32\GEARSec.exe
  C:\Norton AntiVirus\navapsvc.exe
  C:\Norton AntiVirus\AdvTools\NPROTECT.EXE
  G:\WINDOWS\System32\HPZipm12.exe
  C:\Norton AntiVirus\SAVScan.exe
  G:\WINDOWS\System32\svchost.exe
  G:\utilities\eBay\eBay Toolbar2\eBayTBDaemon.exe
  G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  G:\utilities\ewido anti-spyware 4.0\ewido.exe
  G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  G:\WINDOWS\System32\dllhost.exe
  G:\Program Files\Outlook Express\msimn.exe
  G:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  G:\Utilities\Hijackthis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://G:\Utilities\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nforce.nl/index.php?menu=sections&sectionid=2
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=:
  R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - G:\UTILIT~1\COPERN~1\COPERN~1.DLL
  F2 - REG:system.ini: UserInit=g:\windows\system32\userinit.exe
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - G:\utilities\eBay\eBay Toolbar2\eBayTB.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - G:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar2.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - G:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - G:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - G:\utilities\eBay\eBay Toolbar2\eBayTB.dll
  O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - G:\Utilities\Copernic Agent\CopernicAgentExt.dll
  O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  O4 - HKLM\..\Run: [EPSON Stylus CX5400] G:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB001" /M "Stylus CX5400"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Advanced Tools Check] C:\NORTON~1\AdvTools\ADVCHK.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] G:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [SSC_UserPrompt] G:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
  O4 - HKLM\..\Run: [eBayToolbar] G:\utilities\eBay\eBay Toolbar2\eBayTBDaemon.exe
  O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
  O4 - HKLM\..\Run: [!ewido] "G:\utilities\ewido anti-spyware 4.0\ewido.exe" /minimized
  O4 - Startup: Poppy for Windows.lnk = G:\Utilities\Poppy\Poppy.exe
  O8 - Extra context menu item: &eBay Search - res://G:\utilities\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
  O8 - Extra context menu item: &Google Search - res://g:\program files\google\GoogleToolbar2.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://g:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://g:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://g:\program files\google\GoogleToolbar2.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\UTILIT~1\MICROS~1\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Search Using Copernic Agent - res://G:\Utilities\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
  O8 - Extra context menu item: Similar Pages - res://g:\program files\google\GoogleToolbar2.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://g:\program files\google\GoogleToolbar2.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
  O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - G:\UTILIT~1\COPERN~1\COPERN~1.EXE
  O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - G:\UTILIT~1\COPERN~1\COPERN~1.EXE
  O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - G:\UTILIT~1\COPERN~1\COPERN~1.EXE
  O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - G:\Program Files\UltimateBet\UltimateBet.exe
  O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - G:\Program Files\UltimateBet\UltimateBet.exe
  O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - G:\WINDOWS\System32\shdocvw.dll
  O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - G:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - G:\WINDOWS\System32\shdocvw.dll
  O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - G:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\WINDOWS\System32\shdocvw.dll
  O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\WINDOWS\System32\shdocvw.dll
  O15 - Trusted Zone: http://virtualearth.msn.com
  O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
  O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136916728625
  O16 - DPF: {70522FA0-4656-11D5-B0E9-0050DAC24E8F} - http://cc.iwon.com/ct/pm3/iwonpm_12_1,0,2,5.cab
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {D2BD7935-05FC-11D2-9059-00C04FD7A1BD} - http://activex.microsoft.com/objects/ocget.dll
  O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15021/CTPID.cab
  O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com//games/v47/h2hpool/h2hpool.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: AutorunsDisabled - G:\WINDOWS\
  O20 - Winlogon Notify: WgaLogon - G:\WINDOWS\
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\System32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - G:\utilities\ewido anti-spyware 4.0\guard.exe
  O23 - Service: GEARSecurity - GEAR Software - G:\WINDOWS\System32\GEARSec.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - G:\Utilities\iPod\bin\iPodService.exe
  O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Norton AntiVirus\AdvTools\NPROTECT.EXE
  O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\System32\HPZipm12.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - G:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  0
• Crunchie Mandurah. Western Australia. Member

  September 2006 edited September 2006

  Is Norton still warning about a virus?

  0
• Nutty110

  September 2006 edited September 2006

  Norton IS NOT warning me of a virus now.....although its strange I cannot go into SAFE MODE as it scrolls a few pages then stops an reboots in a loop....any suggestions?....thanks

  0
• Crunchie Mandurah. Western Australia. Member

  September 2006 edited September 2006

  If you have your XP installation CD you can try the following to repair it;
  
  Go to Start>Run and type in sfc /scannow and hit ok. Put the CD in first and include the space between the 'c' and the switch.

  0
• Nutty110

  September 2006 edited September 2006

  hello again.....tryed the scan as you wrote above and everything seems ok........I noticed when trying to go into Safe Mode that it stops on the same file then reboots.....the file name is xmasbus.sys
  
  thanks again.....

  0
• Nutty110

  September 2006 edited September 2006

  I found this on a site......Im not sure if this is safe to do or not.
  
  (To fix the endless cycle of reboot you need to go into Control Panel | System | Advanced | Startup and Recovery and uncheck the auto-restart option)

  0
• Crunchie Mandurah. Western Australia. Member

  September 2006 edited September 2006

  Please go to Jotti's or at virustotal and have that file scanned. Post the results back here.
  
  You will probably find it in the system32 folder.

  0
• Nutty110

  September 2006 edited September 2006

  I tryed the 2 virus checkers above using xmasbus.sys which is in
  G:\WINDOWS\system32\drivers
  Both virus checkers says the file is ok.
  What do you think? Should I delete file or quarantine it to see if it will go into Safe Mode, I want to make sure that if computer does not boot up normally I cant go into safe mode to fix. thanks again

  0
• Crunchie Mandurah. Western Australia. Member

  September 2006 edited September 2006

  Try renaming the file to oldxmasbus.sys or something like that and try again. I did read on the net that there is a file of that name that can cause boot problems, so keep your fingers crossed .
  
  Right click on that file too and go to properties and get all the info you can to try and see who it belongs to.

  0
• Nutty110

  September 2006 edited September 2006

  tryed the above renaming file and deleting file. When trying a Safe Mode again it reboots but not at the xmasbus.sys file but just after this file in a loop again....
  Im not sure whats going on here, although something is not right. I went a step further did a google search on the xmasbus.sys file and it said it had something to do with 100% alchol copy program.....well I uninstalled this program also but still same thing with the looping in safe mode.

  0
• Crunchie Mandurah. Western Australia. Member

  September 2006 edited September 2006

  That's what I found on a google search. I honestly have no answer for you regarding this . How is the pc otherwise?

  0
• Nutty110

  September 2006 edited September 2006

  thanks again.....Pc is running pretty good.

  0