HijackThis Log for a Freezing Computer

Question

My in-laws asked me to figure out why their computer freezes. I installed and ran AVG anti-virus, Spybot & Adaware. I found lots of trojans, worms, etc. After quarantining, healing and removing items, their computer runs a lot better.   Would you please analyze this current HijackThis log and let me know if there is anything else.   Thanks,   Ray   Logfile of HijackThis v1.99.1 Scan saved at 9:39:41 PM, on 3/21/2005 Platform: Windows XP  (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Nhksrv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe C:\WINDOWS\DELLMMKB.EXE C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe C:\WINDOWS\System32\wuamgrds.exe C:\WINDOWS\System32\msmsgr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Webshots\WebshotsTray.exe C:\Program Files\Netropa\OSD.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Anti-Virus Programs\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webshots.com/r/internal/start/client/RAND R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\Wkfud.exe O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe O4 - HKLM\..\Run: [Microsoft Updates] wuamgrds.exe O4 - HKLM\..\Run: [Microsoft System Services] msmsgr.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\RunServices: [Microsoft Updates] wuamgrds.exe O4 - HKLM\..\RunServices: [Microsoft System Services] msmsgr.exe O4 - HKCU\..\Run: [Microsoft Updates] wuamgrds.exe O4 - HKCU\..\Run: [Microsoft System Services] msmsgr.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe O23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe (file missing) O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

ShadowEdge · Answer

There are a couple of things the main one is the Agobot VIRUS. If that virus is one the computer you should consider reinstalling.

ShadowEdge · Answer

O4 - HKCU\..\Run: [Microsoft System Services] msmsgr.exe  is the entry from the virus

Loesch · Answer

Thanks for your reply. Please remind me what to do.. use HijackThis to remove "O4 - HKCU\..\Run: [Microsoft System Services] msmsgr.exe"? Will that take care of the virus or what do you mean by the computer should consider reinstalling?

Thanks again,

Ray

ky331 · Answer

Just a few comments (and words of caution)...   1) Can someone confirm, absolutely, that the file  MSMSGR.exe is actually bad?  Specifically, that it has nothing to do with MSN Messenger (which surely would be a 'sound-alike', that we wouldn't want to accidentally remove).  2) If Shadowedge is correct in his diagnosis, the virus's name is Gaobot (not Agobot) 3) Reinstalling (windows?) (or reformatting your drive) should always be a last resort.  every other reasonable avenue should be explored first.   If you're patient, hopefully one of the HJT experts here will analyze your log and come up with fix to your problem.  If for any reason they can't, then you might consider downloading/running the Gaobot removal tool from Symantec: http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html   Disclaimer:  1) I have not definitively confirmed that gaobot / msmsgr is in fact your problem.                      2) I personally have never used this particular tool. Hence, based on (1) and (2), I must advise:         3)While Symantec is a highly reputable source, I cannot take any personal responsibility for the results of you using this tool, either correctly or INcorrectly, if you choose to use it.   Wait for the experts here... see what they have to say...   This response should not be construed in any way as me taking 'ownership' of this thread.  The forum experts are all welcome to join in.

Bertha2 · Answer

Hey,   Ky331 yes MSMSGR.exe is Messenger hwoever trojans and worms use this file to hide themselves in and cause mischief.   Anyway the tool you have used would work but there are other worms on Loesch computer.     Loesch I have analysed you Hijackthis Log and will get back to you shortly   Bertha2 Message Edited by Bertha2 on 03-22-2005 11:17 AM

Bertha2 · Answer

Hey Leosch,Print the following instructions off as you will need to be offlineRun some online scans:Housecall - http://housecall.trendmicro.com/housecall/start_corp.asp CoD - http://www.commandondemand.com/ Panda - http://www.pandasoftware.com/activescan/com/activescan_principal.htm Allow them to remove anything they find and note down anything they find but cannot rmeove and its location and post back here in your replyTurning off Spybot’s Teatimer Spybot’s Teatimer needs to be turned off before we can fix anything with Hijackthis.To do this right click the running icon of Spybot’s Teatimer and choose exit, otherwise it can interfere.Ending Process’sOpen task Manager (alt+ctrl+del) and click the process’s tabHighlight if found:wuamgrds.exe (may not be there)Then click end processRun Hijackthis and with all windows closed put a check mark next to the following OptionalR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =Mandatory R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:// red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:// red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com   O4 - HKLM\..\Run: [NT Logging Service] syslog32.exeO4 - HKLM\..\Run: [Microsoft Updates] wuamgrds.exeO4 - HKLM\..\Run: [Microsoft System Services] msmsgr.exeO4 - HKLM\..\RunServices: [Microsoft Updates] wuamgrds.exeO4 - HKLM\..\RunServices: [Microsoft System Services] msmsgr.exeO4 - HKCU\..\Run: [Microsoft Updates] wuamgrds.exeO4 - HKCU\..\Run: [Microsoft System Services] msmsgr.exe O23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe (file missing)Click 'FIX' Showing Hidden Files and FoldersClick Start· Open My Computer· Select the Tools Menu and click Folder Options· Select the View Tab· Under the hidden files and folders heading, Select Show · Uncheck: Hide File extensions for known file types· Uncheck: Hide protected operating system files· Click Yes to Confirm· Click OkReboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete the following:These may not be thereC:\WINDOWS\System32\wuamgrds.exemsmsgr.exe (should be in System32 folder)C:\WINDOWS\System32\libsysmgr.exe Reverse the above to hide your files and folders againReboot Run Cleanup to empty all yourTemporary Internet Folders as Hijackthis and other programsleave a lot of junk behind: http://cleanup.stevengould.org Post a New Log Back HereBertha2

Loesch · Answer

Good morning Bertha2,   Thank you for your help. Here is what I have done.   I could not run any of the online scans that you suggested because the computer now has problems with its dial-up connection. Dell Support determined it is not the modem because it can make a call on the hyper terminal. Later today, I will call the ISP provider. I ran AVG anti-virus, Adaware, & Spybot. Nothing was found. I ended the process 'wuamgrds.exe'. In Hijackthis, I checked and fixed the items you listed. In the safe mode, I found and deleted C:\WINDOWS\System32\wuamgrds.exeI do not remember: msmsgr.exe . I could not find C:\WINDOWS\System32\libsysmgr.exe. NOTE: The search did find C:\WINDOWS\Prefetch\wuamgrds.exe-0115D10.pf and C:\WINDOWS\Prefetch\libsysmgr.exe-13288A20.pf. Should I delete these? I will check again for msmsgr.exe.   This is the current Hijackthis.   Please advise and thanks again,   Ray   Logfile of HijackThis v1.99.1Scan saved at 11:30:38 PM, on 3/22/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Nhksrv.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeC:\WINDOWS\DELLMMKB.EXEC:\Program Files\Common Files\Real\Update_OB\evntsvc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeC:\WINDOWS\System32\HPPhotoManager.exeC:\WINDOWS\System32\msmsgr.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Webshots\WebshotsTray.exeC:\Program Files\Netropa\OSD.exeC:\Anti-Virus Programs\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webshots.com/r/internal/start/client/RANDR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.comO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\Wkfud.exeO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osbootO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeO4 - HKLM\..\Run: [HP Photo Manager] HPPhotoManager.exeO4 - HKLM\..\Run: [NT Logging Service] syslog32.exeO4 - HKLM\..\Run: [Microsoft System Services] msmsgr.exeO4 - HKLM\..\RunServices: [HP Photo Manager] HPPhotoManager.exeO4 - HKLM\..\RunServices: [Microsoft System Services] msmsgr.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [HP Photo Manager] HPPhotoManager.exeO4 - HKCU\..\Run: [Microsoft Updates] wuamgrds.exeO4 - HKCU\..\Run: [Microsoft System Services] msmsgr.exeO4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exeO4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXEO23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exeO23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exeO23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe (file missing)O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

Loesch · Answer

Hi Bertha2, Not sure if I did something wrong. I replied yesterday and have not received a response. I am now without a modem, so my in-laws are wondering.. Thanks, Ray

Bertha2 · Answer

Hey loesch,   What do you mean you have no modem?   You had one before you posted the original Hijackthis Log didnt you?   Bertha2

Loesch · Answer

Hi Bertha2,

I am glad to hear from you.

I figured out the modem problem. After you last post, I tried installing Service Pack 2. That somehow messed up the modem because it now works after I used a restore point.

Last night, I went online and ran 2 of the 3 online scans that you suggested. COD ran Panda found and fixed some stuff. For some reason, I could not completely download Housecall.

Also, before running these online scans, I double-checked your instructions and did another Hijackthis. Most of the stuff you asked me to fix was still there. I think it was because I incorrectly answered a Spybot alert and allowed them back onto the computer.

The computer is running alot better, however there are a couple unusual things. One, I cannot run Hijackthis. I tried downloading a fresh zip file, but it does not work. Second, I cannot open the Task Manager to check processes. When I press ctl+alt+del, it flashes on the screen and the taskbar, and then disappears.

AVG keeps finding a Trojan Horse called Collected.5.L that is attacking c:msdirectx.sys. I keeped moving it to the vault, but that does not help.

Any and all help is appreciated.

Ray

Bertha2 · Answer

Hey Loesch, You are not helping me or you out by messing about between the advised fixes which I offer to you, and downloading SP2 and such. I have not advsied you to download SP2 yet for a reason and also doing the system restore will have just taken us back to exactly where we started from as the Malware would have been hiding in your system restore folder and then when you decide to do a restore it all comes back again!!! If you insist on messing about between fixes then we are going to get no where and it really is annoying to you and me Now then about the problem we have now: I will need to see a new Hijakcthis Log to see exactly where we need to start from again!! Try renaming Hijackhtis to something else it doesnt matter what and see if that works But before you post a new Hijackthis Log do the follwoing: Reboot into safe mode (Keep pressing F8 on startup and select Safe Mode) Run a Full AVG scan in safe mode and see if that helps Then reboot Post a New Hijackthis Log here Bertha2

Loesch · Answer

Good Morning Bertha2,   I apologize for the Service Pack 2 install. Actually, it was done by someone else who was following the instructions from an Automatic Update. Since the modem was not working and neither Dell nor MSN could help, I used the System Restore for my first time. Can I undo a System Restore?   I was able to get a HijackThis log while in the safe mode. Please take a look at it and let me know what I should do next.   Thanks for everything, Ray   Logfile of HijackThis v1.99.1Scan saved at 9:16:45 AM, on 3/26/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\savedump.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Documents and Settings\Administrator.SCHUTZ\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.comO2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\Wkfud.exeO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osbootO4 - HKLM\..\Run: [NT Logging Service] syslog32.exeO4 - HKLM\..\Run: [Compaq Service Drivers] msnsvc.exeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeO4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exeO4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitewdl32.exeO4 - HKLM\..\Run: [xH7rAa] C:\WINDOWS\miccbm.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exeO4 - HKLM\..\RunServices: [Compaq Service Drivers] msnsvc.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [MoneyStartUp] C:\Program Files\Microsoft Money\System\Money Startup.exeO4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c11.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cabO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXEO23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exeO23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exeO23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe (file missing)O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

Loesch · Answer

Hello Bertha2,

Since I have not received a reply from you, I have been running some online scans. Panda ActiveScan says I have a virus called W32/Gaobot.gen.worm. Their description suggests downloading a patch from Microsoft... "If you have a Windows 2003/XP/2000/NT computer, it is highly recommendable to download the security patches for the RPC DCOM and WebDAV vulnerabilities from the Microsoft website."

Also see the next post for the latest HJT Log.

Loesch · Answer

Logfile of HijackThis v1.99.1Scan saved at 9:46:50 PM, on 3/28/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeC:\WINDOWS\DELLMMKB.EXEC:\Program Files\Common Files\Real\Update_OB\evntsvc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeC:\Program Files\Media Access\MediaAccK.exeC:\WINDOWS\miccbm.exeC:\WINDOWS\System32\eetu.exeC:\Program Files\Media Access\MediaAccess.exeC:\WINDOWS\System32\devldr32.exeC:\WINDOWS\System32\?hkntfs.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Netropa\OSD.exeC:\WINDOWS\Nhksrv.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\ISTsvc\istsvc.exeC:\Documents and Settings\Bill and JoAnne\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.comO2 - BHO: (no name) - {B36B8D59-3DB0-3846-CBD7-358199B00F91} - C:\WINDOWS\System32\apa.dllO2 - BHO: (no name) - {B36B8D5B-3DB5-3F44-CBA7-3081EEB30F9F} - C:\WINDOWS\System32\apa.dllO2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\Wkfud.exeO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osbootO4 - HKLM\..\Run: [NT Logging Service] syslog32.exeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeO4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exeO4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitewdl32.exeO4 - HKLM\..\Run: [xH7rAa] C:\WINDOWS\miccbm.exeO4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exeO4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exeO4 - HKCU\..\Run: [Aida] C:\WINDOWS\System32\eetu.exeO4 - HKCU\..\Run: [Wcu] C:\WINDOWS\System32\?hkntfs.exeO4 - HKCU\..\RunServices: [Compaq Service Drivers] msnsvc.exeO4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c11.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cabO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXEO23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exeO23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exeO23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe (file missing)O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe ================= I know you are very busy. I really appreciate any assistance you can provide. Thanks, Ray

ChrisRLG · Answer

Hi Berha has asked me to help out - he is short on time at the moment.

When we're done cleaning off your system, i'd recommend that you install all the critical windows updates available from Microsoft, upto service pack 1. This will help to make your system more secure and prevent many ' problems' from reoccuring in the future.

Download the Adware.Istbar removal utility from Symantec and following the instructions on the same page.

Run HiJackThis then:

1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"
-
Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

C:\WINDOWS\miccbm.exe
C:\WINDOWS\System32\eetu.exe
C:\WINDOWS\System32\?hkntfs.exe
C:\Program Files\ISTsvc\istsvc.exe

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process".
Now, click " Refresh", check again, and repeat this step if any remain.

Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

regsvr32 /u apa.dll

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save on the typing.

Before we begin, let's move HiJackThis to it's own folder; like c:\HJT. When we're done ' cleaning' off your system, we're going to ' flush' the temporary folders which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later. Also move the " Backups" folder, for HiJackThis, if present.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com

O2 - BHO: (no name) - {B36B8D59-3DB0-3846-CBD7-358199B00F91} - C:\WINDOWS\System32\apa.dll
O2 - BHO: (no name) - {B36B8D5B-3DB5-3F44-CBA7-3081EEB30F9F} - C:\WINDOWS\System32\apa.dll
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitewdl32.exe
O4 - HKLM\..\Run: [xH7rAa] C:\WINDOWS\miccbm.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [Aida] C:\WINDOWS\System32\eetu.exe
O4 - HKCU\..\Run: [Wcu] C:\WINDOWS\System32\?hkntfs.exe

O4 - HKCU\..\RunServices: [Compaq Service Drivers] msnsvc.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c11.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab

O23 - Service: NT login service (ntlogin32) - Unknown owner - C:\WINDOWS\System32\libsysmgr.exe (file missing)

Now, with all windows closed except HiJackThis, click " Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Program Files\ISTsvc

files...

C:\WINDOWS\miccbm.exe
C:\WINDOWS\System32\eetu.exe
C:\WINDOWS\System32\apa.dll
C:\windows\system32\elitewdl32.exe
C:\WINDOWS\System32\gah95on6.exe

Search for...

syslog32.exe
msnsvc.exe

...using " Start | Search...".
-
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Post back a new log, and let me know how everything goes.

-

ChrisRLG

Virus & Spyware

HijackThis Log for a Freezing Computer

Was this post helpful?