8 replies to this topic

[rossoneri_forever]

Hello guys. I am new to this Hijack this community but i need your help.


My problem is that i think a got a virus/worm/trojan. This seems to be slowing my internet connection + windows update does not update and has error code 80070424 + windows defender reports a threat on boot.

I have performed

- A NOD32 virus scan, which found 1 infiltration and cleaned it
- MalwareBytes Anti-Malware which found 3 and cleaned it
- Spybot Search and Destroy which found 85 possible threats and removed.
- Windows Defender which supposedly fixes the intrusion, but on boot pops up the message

So i downloaded HiJack this since i really think i still have a serious problem and i will upload here for you experienced users to help me out.

HiJackThis log (i couldnt get the upload attachment to work.)

I am looking forward for your help. Many thanks in advance.

[1972vet]

Download "Dial-a-fix" from Here and save it to your Desktop. Right-click on the .zip file and select Extract All...open the folder and double-click the Dial-a-fix.exe icon. Place a check in the box for the option titled "Fix Windows Update" under the heading WU/WUAU, then click the Go button at the bottom. Follow the prompts. When completed, try the Windows Update site again. Post back your results. Thanks!

[rossoneri_forever]

1972vet, on Aug 23 2008, 02:33 PM, said:

Download "Dial-a-fix" from Here and save it to your Desktop. Right-click on the .zip file and select Extract All...open the folder and double-click the Dial-a-fix.exe icon. Place a check in the box for the option titled "Fix Windows Update" under the heading WU/WUAU, then click the Go button at the bottom. Follow the prompts. When completed, try the Windows Update site again. Post back your results. Thanks!

When i try to run it, it says that is not compatible with Vista.

[JeanInMontana]

You don't upload the HJT log, is that what you mean? You simply copy and past it, into your reply. Also let us see the logs from MBAM please.

[rossoneri_forever]

JeanInMontana, on Aug 23 2008, 10:28 PM, said:

You don't upload the HJT log, is that what you mean? You simply copy and past it, into your reply. Also let us see the logs from MBAM please.

Ok...here they are:


MBAM

Quote

Malwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 6.0.6000

1:00:37 8/24/2008
mbam-log-08-24-2008 (01-00-37).txt

Scan type: Quick Scan
Objects scanned: 40629
Time elapsed: 2 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

HIJACKTHIS

Quote

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:01:07 AM, on 8/24/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ASUS\AI Remote\AiRc.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\SoundMAX.exe
C:\Program Files\BUFFALO\Encrdisk\ENCRDLG.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ASUS\AI Remote\AiRemote.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Memeo\AutoBackup\MemeoBackup.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Ai Remote Help] "C:\Program Files\ASUS\AI Remote\AiRc.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\SoundMAX.exe" /tray
O4 - HKLM\..\Run: [SecureLockWare Drive] C:\Program Files\BUFFALO\Encrdisk\ENCRDLG.exe -ClientMode
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Memeo AutoBackup] C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe --silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagea...en/preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Br...018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1BF6593-DA6B-4262-8104-8B9CF92CFF80}: NameServer = 98.184.192.18,91.184.192.2
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SecureLockWare ??????? (SecureLockWare_InputPassword) - BUFFALO INC. - C:\Program Files\BUFFALO\Encrdisk\ENCRDLG.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9267 bytes

[1972vet]

1) click Start, then All programs, then Accessories
2) Right click on Command Promt and select run as Administrator
3) At the command prompt copy and paste the following:

%SYSTEMROOT%\SYSTEM32\REGSVR32.EXE %SYSTEMROOT%\SYSTEM32\WUAUENG.DLL

It should pop up a window saying the .dll registration succeeded. Try Windows Update again. Post back your results. Thanks!

[rossoneri_forever]

1972vet, on Aug 24 2008, 05:12 AM, said:

1) click Start, then All programs, then Accessories
2) Right click on Command Promt and select run as Administrator
3) At the command prompt copy and paste the following:

%SYSTEMROOT%\SYSTEM32\REGSVR32.EXE %SYSTEMROOT%\SYSTEM32\WUAUENG.DLL

It should pop up a window saying the .dll registration succeeded. Try Windows Update again. Post back your results. Thanks!

It worked. Thanks! Windows Update is working again now. Though the internet connection is still slow, and no problems on the provider side.

[1972vet]

Computer and browser slowness are not always malware related

Poor performance and other problems can be the result of disk fragmentation, disk errors, corrupt system files, too many startup programs, unnecessary services running, not enough RAM, dirty hardware, etc. As your system gets older it becomes filled with more files/programs and has a natural tendency to slow down so cleaning and regular maintenance is essential.

Listed below are a few things you can do to improve speed and system performance. Many of the these suggestions will apply if you're using Windows Vista but may be done a bit differently. Near the bottom of this thread there is a section specifically devoted to Vista Users.

For browser problems, see:

• Its not always malware: How to fix the top 10 Internet Explorer issues
  
• How and Why to Clear Your Cache

If your having connectivity issues or errors such as Page cannot be displayed see

• Repair/Reset Winsock settings
  
• Troubleshooting Internet Connection Problems

If you're using Vista or Internet Explorer 7, see

• Why is my Internet connection so slow?
  
• Windows Vista - My Internet connection is slow
  
• The Phishing Filter may slow down the PC
  
• Tuning IE7 for Better Performance
  
• How to optimize or reset Internet Explorer 7

If you have a lot of toolbars and add-ons attached to Internet Explorer, you could try improving performance by disabling those which are unecessary. See:

• Control Internet Explorer Add-ons with Add-on Manager
  
• Troubleshooting and Internet Explorer’s (No Add-ons) Mode

Vista users see:

• Internet Explorer Add-ons FAQs

Clean up your hard drive by removing unused programs and transferring old data, pictures, music files to a CD or an external hard drive.

When you have moved/saved the files you want to keep, run Disk Cleanup and let it scan your system for files to remove. Don’t clean out the Prefetch folder - This is a common myth that will not improve performance.

You may be instructed to remove prefetch files if you had experienced some virus/malware issues otherwise removing prefetch files is not really necessary. Although the prefetch folder can become quite bloated in time, removing old prefetch data as a matter of routine is not recommended. Your boot time immediately after clearing the prefetch folder is much slower...but it will speed up after the first reboot when windows begins to put back some of the files that you removed.

As an alternative to Disk Cleanup you can download and scan with CCleaner.
(Scroll to the last one and click the "CCleaner Slim"...it has no toolbar that comes packaged with it)

• After installation, see see the CCleaner Tour: Using and Understanding CCleaner
  
• Make sure you go to Options-->Advanced and uncheck the box to Only delete files in Windows Temp folders older than 48 hours before running a scan
  
• An added benefit of using CCleaner is the Issues scan which allows you to clean the registry
  
• Always back up your registry before making any changes
  
• When done using CCleaner's Issues scan, I highly recommend following the steps in PCBruiser/Registry Maintenance

Check for any unnecessary running services

If you have a typical installation, many services are configured as "automatic"; that is, they start automatically when the system starts or when the service is called for the first time. Use Black Viper's "Services Configuration" to help fine tune this area.

Check for disk errors by running CHKDSK in "SAFE MODE" or from the Recovery Console

In the Check Disk dialog box, select the "Scan for and attempt recovery of bad sectors" check box, click "Start" and have it repair anything it finds. As you use your hard drive, it can develop bad sectors which slow down hard disk performance and make data writing difficult. Check Disk scans the hard drive and verifies the logical integrity of a file system by checking for system errors, lost clusters, lost chains, and bad sectors. When encountering logical inconsistencies in file system data, it will perform the necessary actions to repair the file system data.

Check for damaged, altered or missing critical system files by running the System File Checker

If SFC discovers that a protected file has been damaged, altered or missing, it restores the correct version of the file from the cache folder.
You must be logged on as an administrator or as a member of the Administrators group to run sfc and it may ask you to insert your XP Installation CD so have it available.

Defrag your system

Disk fragmentation slows the overall performance of your system. When files are fragmented, the computer must search the hard disk when a file is opened. Disk Defragmenter consolidates fragmented files and folders on the hard disk so that each occupies a single space on the disk. This speeds up reading and writing to the disk. Read "The Importance of Disk Defragmentation" for instructions.

Note: It is recommended to shut down all applications (including your Anti-virus) before running Defrag to ensure that no programs attempt to write to the drive while it is being defragmented. Not doing so may cause you to have to restart the entire process. If you have disabled all running programs and still find that the defrag routine is constantly interrupted, you can defrag from "SAFE MODE".

Check for any unnecessary applications loading at startup when Windows boots by using MSConfig

Some startup programs are necessary so be careful what you disable. If you are unsure what any of the startup entries are or if they are safe to disable, then search one of the following Startup Databases:

• StartupList Index
  
• Startup Programs Database

Note: MSConfig.exe is a troubleshooting utility used to diagnose system configuration issues. Although it works as a basic startup manager, msconfig should not be used routinely to disable auto-start programs. It is a temporary solution and not a good practice for several reasons. When uninstalling programs while disabled with msconfig, they may not be uninstalled properly and orphaned entries often will be left behind. When used to switch back to normal startup mode, these orphan entries can result in boot up errors. Further, msconfig does not list all applications loaded in all possible startup locations (some entry points are hidden and unknown to the user) and does not allow the complete removal of disabled entries from its list.

You should not use msconfig to disable startup applications related to a running service. Doing so alters the registry and there are services that are essential for hardware and booting. When you uncheck a service in msconfig, you completely disable it. If you uncheck the wrong one, you may not be able to restart your computer. You should only disable services using Control Panel-->Administrative Tools-->Services.

A better alternative is to use a startup manager. If you have Spybot S&D installed, launch it, go to Mode and select Advanced. Then go to Tools, select System Startups. You will be provided with a list of programs that load when Windows starts. If you untick an entry it will no longer run at startup. This will allow you to experiment and see how your system performs with any of them disabled. Other startup managers you can download and use for free are:

• Startup Control Panel,
  
• Autoruns,
  
• Starter by CodeStuff, and
  
• StartUpLite by RubberDucky.

Remove any third party "Memory Manager" or "Optimizer"

Windows XP memory management was designed to make the best use of Ram and these memory management utilities defeat that purpose. They push applications out of RAM into the pagefile, creating holes in the RAM and slowing down your computer's performance by doing so.

Disable some visual effects

While visual embellishments may be attractive, they don’t do anything else for you. Disabling some of them frees up system resources and makes the operating system perform better.

• Right click My Computer, choose Properties-->Advanced then click on Settings
  
• In the Visual Effects tab, select Adjust for best performance or uncheck all the visual effects, except for the last three
  
• Click "Apply", then "Ok", then "Ok" again
  
• Then right click your Desktop and choose Propertie-->Appearance-->Effects
  
• Uncheck the first two boxes and hit "OK"

Add more RAM

This is a quick solution that can have a dramatic affect on your system's speed and responsiveness. You can check how much RAM you have by going to Start-->Program Files-->Accessories-->System Tools-->System Information and look at your System Summary. For more info see "Understanding, Identifying and Upgrading the RAM in your PC".

For more suggestions and performance tips read:

"Restore Your Computer's Performance with Windows XP"
"XP Performance Tweaks"
"Performance Boost for XP"

For Vista Users:

Vista Features Explained: Performance
Vista Features Explained: SuperFetch
SuperFetch & ReadyBoost
Tips to boost Vista performance
Windows Vista Performance Tuning
Top 12 Tweaks To Improve Vista Looks and Performance

When you are all done be sure to Create a new Restore Point to enable your computer to "roll-back" to a clean working state keeping all the changes you just made. Then use Disk Cleanup to "remove all but the latest Restore Point".

Vista Users can refer to these links:

• Create a New Restore Point
  
• Disk Cleanup

[JeanInMontana]

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine. Please start a thread of your own and someone will be happy to help you.