Your system is severely infected. Be advised that I will only start the process of trying to repair things. My goal is to remove two specific types of popups: WinFixer, and NAIL (A Better Internet / The Best Offers Network). After that, someone else will hopefully take-over to assist you with your remaining problems, of which there will be many. Please be patient as we try to proceed.
This is a rather long list of things to do. I would strongly suggest you print all this out, and then, carefully proceed exactly as indicated.
**********************
First: You're running HJT from a TEMP directory:
C:\Documents and Settings\Laura\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
When you do so, either HJT will not create its log files and backup files; or if it does, you risk losing them when the TEMP's cache is cleared. It's important that you save these backup files, in case you have to "undo" [restore] some of the things you "FIX" incorrectly.
So you need to move HJT into a separate, non-temporary, non-Desktop, directory of its own. We recommend using the directory C:\HJT , so that it will then appear in your log, under running processes, as C:\HJT\HiJackThis.exe
************************
Among other things, you have a NAIL/epolvy/SvcProc infection... I'm going to try to help you to remove this first [and then we can move on to other problems]. This fix involves using Ad-Aware, and its VX2-cleaner. It is critical that you use the current versions as indicated below... if you use an older/obsolete version, the fix will not work.
If you don't already have it, download Ad-Aware SE Personal 1.06 from
[Note: If you have an older "build" of Ad-Aware SE --- or even worse, if you're still using Ad-Aware 6 --- you must upgrade to this version/build, SE 1.06 ]
Install the Ad-Aware program (following any indicated directions). [As part of the installation, it will check to see if you already have an older version of Ad-Aware installed, and if one is found, it will ask ("advise") you to allow the older one to be removed... so if asked, please allow it.]
Open/start Ad-Aware SE. Click on Check for Updates Now, and Connect . if found, follow the directions to download/install the latest reference file, till you FINISH.
After updating, from the STATUS screen, click on START.
then make sure you have a RED X in front of "Search for negligible risk entries"
(if you see a GREEN CHECK, then CLICK on it, to change it to the RED X. )
then hit NEXT to perform a Smart Scan. Allow it to remove any problems founds.
Close-down Ad-Aware.
then download the VX2-cleaner add-on by clicking-on the link near the bottom of
This will download the file vx2cleaner_inst.exe ; click on it, and follow the directions to install the VX2-cleaner.
Start Ad-Aware SE again. Click on the Add-Ons button. Click on the VX2-Cleaner. Click on Run Tool, and then click OK . If it finds any VX2 problems, follow all the directions to CLEAN things. (I believe this will include a reboot, and directions to run another smart scan. Follow all indicated directions [i.e., various/multiple scans] until it tells you you're clean of VX2.
This should have removed all traces of NAIL/Aurora/epolvy/SvcProc.
*********************************
Please note: I am including two "search engines" in the following list of suggested removals. If you have knowingly and intentionally chosen either couldnotfind.com or search-exe.com , and wish to keep them, then you shouldn't check them off.
close your internet browser
Run HJT. click on DO A SYSTEM SCAN ONLY
Place a check-mark in the box in front of each of the lines:
Please generate and post a new HiJackThis log, REPLYing to this thread. Let me know if you've noticed any differences so far, especially in terms of popups.
ky331
3 Apprentice
•
15.6K Posts
0
February 20th, 2006 11:00
Your system is severely infected. Be advised that I will only start the process of trying to repair things. My goal is to remove two specific types of popups: WinFixer, and NAIL (A Better Internet / The Best Offers Network). After that, someone else will hopefully take-over to assist you with your remaining problems, of which there will be many. Please be patient as we try to proceed.
This is a rather long list of things to do. I would strongly suggest you print all this out, and then, carefully proceed exactly as indicated.
**********************
First: You're running HJT from a TEMP directory:
C:\Documents and Settings\Laura\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
When you do so, either HJT will not create its log files and backup files; or if it does, you risk losing them when the TEMP's cache is cleared. It's important that you save these backup files, in case you have to "undo" [restore] some of the things you "FIX" incorrectly.
So you need to move HJT into a separate, non-temporary, non-Desktop, directory of its own. We recommend using the directory C:\HJT , so that it will then appear in your log, under running processes, as C:\HJT\HiJackThis.exe
************************
Among other things, you have a NAIL/epolvy/SvcProc infection... I'm going to try to help you to remove this first [and then we can move on to other problems]. This fix involves using Ad-Aware, and its VX2-cleaner. It is critical that you use the current versions as indicated below... if you use an older/obsolete version, the fix will not work.
If you don't already have it, download Ad-Aware SE Personal 1.06 from
http://www.majorgeeks.com/Ad-Aware_SE_Personal_d506.html
[Note: If you have an older "build" of Ad-Aware SE --- or even worse, if you're still using Ad-Aware 6 --- you must upgrade to this version/build, SE 1.06 ]
Install the Ad-Aware program (following any indicated directions). [As part of the installation, it will check to see if you already have an older version of Ad-Aware installed, and if one is found, it will ask ("advise") you to allow the older one to be removed... so if asked, please allow it.]
Open/start Ad-Aware SE. Click on Check for Updates Now, and Connect . if found, follow the directions to download/install the latest reference file, till you FINISH.
After updating, from the STATUS screen, click on START.
then make sure you have a RED X in front of "Search for negligible risk entries"
(if you see a GREEN CHECK, then CLICK on it, to change it to the RED X. )
then hit NEXT to perform a Smart Scan. Allow it to remove any problems founds.
Close-down Ad-Aware.
then download the VX2-cleaner add-on by clicking-on the link near the bottom of
http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml
This will download the file vx2cleaner_inst.exe ; click on it, and follow the directions to install the VX2-cleaner.
Start Ad-Aware SE again. Click on the Add-Ons button. Click on the VX2-Cleaner. Click on Run Tool, and then click OK . If it finds any VX2 problems, follow all the directions to CLEAN things. (I believe this will include a reboot, and directions to run another smart scan. Follow all indicated directions [i.e., various/multiple scans] until it tells you you're clean of VX2.
This should have removed all traces of NAIL/Aurora/epolvy/SvcProc.
*********************************
Please note: I am including two "search engines" in the following list of suggested removals. If you have knowingly and intentionally chosen either couldnotfind.com or search-exe.com , and wish to keep them, then you shouldn't check them off.
close your internet browser
Run HJT. click on DO A SYSTEM SCAN ONLY
Place a check-mark in the box in front of each of the lines:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
http://websearch.drsnsrch.com/sidesearch.cgi?id=R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
http://websearch.drsnsrch.com/sidesearch.cgi?id=R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.couldnotfind.com/search_page.html?&account_id=1000940R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
http://websearch.drsnsrch.com/sidesearch.cgi?id=R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Band Class - {0007522A-2297-43C1-8EB1-C90B0FF20DA5} - C:\WINDOWS\enhtb.dll (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O2 - BHO: (no name) - {26909350-1061-7829-6E04-19CEFBEB71F9} - C:\WINDOWS\Bvwpesbd.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB57.dll
O2 - BHO: (no name) - {A78860C8-EE1A-46DF-A97F-E3E6D433E80B} - C:\WINDOWS\system32\00n6dix.dll (file missing)
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
O2 - BHO: BestOffers Shopping BHO - {F5DE8ADB-4A69-4e56-96AB-823171C8E9D8} - C:\Program Files\TBONAS\TBONlchr.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Search - {DA88D68A-F161-F626-F6CE-CBAE788D4C51} - C:\WINDOWS\Bvwpesbd.dll
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll (file missing)
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB57.dll
O3 - Toolbar: BestOffers Shopping v1.20 - {7FD44536-9DF0-4034-939F-5BD4D98E3187} - C:\Program Files\TBONAS\TBONlchr.dll
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKCU\..\Run: [WinFixer2005] "C:\Program Files\WinFixer2005\UWFX5.exe" /min
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
http://click.mirarsearch.com (HKLM)O15 - Trusted Zone:
http://redirect.mirarsearch.com (HKLM)O15 - Trusted Zone:
http://awbeta.net-nucleus.com (HKLM)O15 - Trusted Zone:
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
Click on FIX CHECKED. Close HJT. Reboot.
************
Please generate and post a new HiJackThis log, REPLYing to this thread. Let me know if you've noticed any differences so far, especially in terms of popups.
Message Edited by ky331 on 02-20-2006 09:09 AM