naiya,
i see you've posted elsewhere... i've responded to you before... and i believe you indicated problems with more than one machine. Since BugBatter already helped you with a HJT, i hope this is the "other" machine.
***********************
first question: the symantec scan you ran, that found the 344 problems.... was that a scanner ONLY???
or did it allow you an option to quarantine [or delete] the infected files??
second question: in terms of anti-virus.... unless i'm overlooking something, it appears you're still running AVG version 6. that's an old program, and i don't know that it's currently being supported anymore. if it was a paid version, i'm not sure what to suggest.... but if it's the free version, you should upgrade to avg 7 FREE from here:
then, click on the avg71free... link near the bottom of the page
download the new AVG 7, uninstall the old one (6) [if it was the free version], install the new one (7), go online to get the latest updates (virus definition files), run a COMPLETE SCAN, and allow it to quarantine anything it finds.
***********************
Among other things, you have a NAIL/epolvy infection... I'm going to try to help you to remove this first. AFTER we remove NAIL, either I, or someone else will then consider your remaining problems.
This fix involves using Ad-Aware, and its VX2-cleaner. It is critical that you use the current versions as indicated below... if you use an older/obsolete version, the fix will not work.
If you don't already have it, download Ad-Aware SE Personal 1.06 from http://www.majorgeeks.com/Ad-Aware_SE_Personal_d506.html
[Note: If you have an older "build" of Ad-Aware SE --- or even worse, if you're still using Ad-Aware 6 --- you must upgrade to this version/build, SE 1.06 ]
Install the Ad-Aware program (following any indicated directions). [As part of the installation, it will check to see if you already have an older version of Ad-Aware installed, and if one is found, it will ask ("advise" ) you to allow the older one to be removed... so if asked, please allow it.]
Open/start Ad-Aware SE. Click on Check for Updates Now, and Connect . if found, follow the directions to download/install the latest reference file, till you FINISH.
After updating, from the STATUS screen, click on START.
then make sure you have a RED X in front of "Search for negligible risk entries"
(if you see a GREEN CHECK, then CLICK on it, to change it to the RED X. )
then hit NEXT to perform a Smart Scan. Allow it to remove any problems founds.
Close-down Ad-Aware.
then download the VX2-cleaner add-on by clicking-on the link near the bottom of
This will download the file vx2cleaner_inst.exe ; click on it, and follow the directions to install the VX2-cleaner.
Start Ad-Aware SE again. Click on the Add-Ons button. Click on the VX2-Cleaner. Click on Run Tool, and then click OK . If it finds any VX2 problems, follow all the directions to CLEAN things. (I believe this will include a reboot, and directions to run another smart scan. Follow all indicated directions [i.e., various/multiple scans] until it tells you you're clean of VX2.
This should have removed all traces of NAIL/Aurora/epolvy/SvcProc. Please generate and post a new HiJackThis log, REPLYing to this same thread.
Message Edited by ky331 on 04-16-200609:37 AM
sometimes an anti-virus [or anti-spyware] program needs to restart the system, to begin a spyware scan before all the "garbage" has a chance to load itself into the system.
when you say "it wouldnt allow [you] to type in [your] password", was it trying to do something else [like automatically continue/run a virus scan]?? or did the system just "freeze" on you? if it froze, and required a manual shut down, that doesn't sound right/good.
i want to call-in someone else, to get their opinion on this....
you wrote "In this particular instance, I wasnt able to type in my password after AVG restarted the computer while it was doing its scanning/cleaning."
i now take that to mean the computer booted up, and AVG was scanning/cleaning --- automatically --- and that, while scanning/cleaning, it did not offer you a "login" option. is this correct?
If so, then this was completely normal. the point being, that AVG was trying to do its job, clean your system, before any of the "garbage" had a chance to get loaded. and in such a case, as long as it was running, it needs to continue/complete its scan without interruption.
in any event, i see that you eventually were able to complete both an AVG and an Ad-aware scan, so i take that to mean your computer is still booting up, and allowing you to login. I will look at your HJT log in a few minutes.
well, it looks like ad-Aware+VX2 successfully removed NAIL/epolovy/SvcProc ...
which was the goal of that part of the fix. so we're making progress, albeit slowly....
now that you've run "several" scans with AVG and ad-aware... are both now reporting that you're "clean"?
[aside from any items that they may have successfully quarantined?] or is either one still reporting problems?
let's continue with your fix:
First, you should move the HJT program from your Desktop:
C:\Documents and Settings\Naiya\Desktop\HijackThis.exe
into a separate folder of its own... We recommend using folder C:\HJT , so that it will then appear in your log under running processes as C:\HJT\HijackThis.exe
[if your prefer, it's okay to have an HJT folder on your desktop, move the HJT program into this folder, and run it from there].
This is important because HJT generates log files, and backup files, in the folder from which it is run. So at present, all these logs/backups will just "clutter-up" your Desktop. And if you simply delete them from there, you'll lose the important backup information, which may be needed in case you have to "undo" [restore] some of the things you "FIX" incorrectly.
*********************************
after you move HJT, as i've just instructed:
close your internet browser
Run HJT. click on DO A SYSTEM SCAN ONLY
Place a check-mark in the box in front of each of the following lines:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: BestOffers Shopping BHO - {F5DE8ADB-4A69-4e56-96AB-823171C8E9D8} - C:\Program Files\TBONAS\TBONlchr.dll
O3 - Toolbar: BestOffers Shopping v1.20 - {7FD44536-9DF0-4034-939F-5BD4D98E3187} - C:\Program Files\TBONAS\TBONlchr.dll
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
Click on FIX CHECKED. Close HJT. Reboot.
see if this reduced the popups any... specifically, those which were marked "Best Offers".
then generate a brand-new HJT log, REPLY to this thread, and post it here.
********************************
you still have significant problems [Zeno, and several others] but most, if not all, can be "conquered"... with some patience. However, at this point, i personally have taken your analysis about as far as i feel comfortable, so i'm gonna have someone else [most likely RKinner] take over.
good luck.
