1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Removing the virus Trojan.Nebula

Discussion in 'Malware and Virus Removal Archive' started by bombagirl, 2006/08/20.

Page 3 of 4
  1. 2006/08/23
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine

    Jotti File Submission will scan "that file" with a number of different scanners to see if it is infected or a infection.

    The other one, This person is very interested in seeing that file. to see if Spyware Quake is trying to come up with something new to load on a system.

    Geri
     
    Geri,
    #41
  2. 2006/08/23
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    Why do we turn off and turn the system restore on again like that please?
     
    bombagirl,
    #42


  3. to hide this advert.

  4. 2006/08/23
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    Couldn't find the file now...why is that? Can it be that it only appears when I run smitfraud fix?
     
    bombagirl,
    #43
  5. 2006/08/23
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Many infections will store them selfs in your system restore. Then if at some point you had to do a system restore it would also restore the infection back into your system.
    Doing this will delete them and give you a good clean restore point.


    Maybe it was part of the Trojan or Spyware Quake that was removed?
    If the file is no longer there then just disregard, can't send it if you don't have it:)

    Surf safely
    Geri
     
    Last edited: 2006/08/23
    Geri,
    #44
  6. 2006/08/23
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    ok thanks for everything then.

    Claudine :rolleyes:
     
    bombagirl,
    #45
  7. 2006/08/27
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    SmitfraudFix

    How can I know (from the log of Smitfraudfix) whether I'm infected or not please?
     
    bombagirl,
    #46
  8. 2006/08/27
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine
    Are you having any problems?
    If you think you may be infected again you can run the Option 1 as instructed before and post the log.

    SmitfraudFix
    Warning : running option #2 on a non infected computer will remove your Desktop background

    Geri
     
    Geri,
    #47
  9. 2006/08/28
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    Spyb ot detected smitfraud...although after scanning I removed it still want to know how to recognise if there is smitfraud after running smitfraudfix pls.

    THanks
    Claudine

    by the way...what do you mean with:

    SmitfraudFix
    Warning : running option #2 on a non infected computer will remove your Desktop background
     
    bombagirl,
    #48
  10. 2006/08/28
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    F-prot antivirus discovered...

    C:\SystemInformation\_restore{3888EA3B-59DB-4E7E-9A4A-59CBA7ACFDEE}\RP61\A0005566.EXE (UPX) Infection: W32/Methodbod.gen

    what's this please? when I ran the scan it didn't show...it only shows on F-prot's realtime scanner
     
    bombagirl,
    #49
  11. 2006/08/28
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine
    If you are not infected with smitfraud it will delete the backround on your desktop, you will end up with just a white backround.

    Smitfraudfix is a tool made for certin infections and is updated as these infections are changed to try and beat the fix, it is NOT made to use as a scanner like ewido or spybot.

    I would suggest that you delete it from your computer and leave the "how to recognise" smitfraud from it's log to people that deal with the tool daily.
    It could very well be updated next week and the one on your system not work on a newer infection.

    This is in your system restore. Did you delete your old restore points and make a new one, as I asked you to do?
    If you did, Then you should post another HJT log so we can go through it.

    Geri
     
    Geri,
    #50
  12. 2006/08/28
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    OK so from where do I download the latest smitfraud in case I need it please?
     
    Last edited: 2006/08/28
    bombagirl,
    #51
  13. 2006/08/28
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    Logfile of HijackThis v1.99.1
    Scan saved at 15:37:59, on 28/08/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\FSI\F-Prot\fpavupdm.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\FSI\F-Prot\F-Sched.exe
    C:\Program Files\FSI\F-Prot\F-StopW.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.go.com.mt/mygo
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
    O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
    O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [CabelasGrandSlamHunting2.exe] C:\DOWNLO~1\CABELA~1.EXE /r
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
     
    bombagirl,
    #52
  14. 2006/08/28
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine
    You have picked up the "BackDoor-CXT TROJAN "

    Please set up ewido like this,

    You will need run ewido and update the definition files.
    [*]On the main screen select the icon "Update" then select the "Update now" link.
    • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
    [*]Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
    [*]Once in the Settings screen click on "Recommended actions" and then select "Quarantine ".
    [*]Under "Reports "
    • Select "Automatically generate report after every scan "
    • Un-Select "Only if threats were found "
    [/list]Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
    1. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
      IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:
    2. Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
    3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan ".
    4. ewido will now begin the scanning process, be patient this may take a little time.
      Once the scan is complete do the following:
    5. If you have any infections you will prompted, then select "Apply all actions "
    6. Next select the "Reports" icon at the top.
    7. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
    8. Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.

    Please post a new HJT log also.

    Geri
     
    Geri,
    #53
  15. 2006/08/28
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine
    OK, First off, Your log shows no sign of smitfraud.
    This tool is specific to SmithFraud and is not needed for every day usage.

    If you must have it Google for it.

    Also if you are going to have that tool then you may need the 20-30 other specialized tools that are used by malware experts to fight specific infections.

    All those tools "to use just in case" is useless because the tools are usually updated sometimes daily and most weekly. So by the time you needs it, you'll need to DL a fresh copy any how.

    Also, If you download and use them you do so at your own risk.
    Many can harm your system to the point of a reformat if used incorrectly or if not needed.

    Geri
     
    Geri,
    #54
  16. 2006/08/29
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    Reharding smitfraudfix...I understood your point...in case of trouble I'll send my querie here instead of trying to fix it myself, thanks

    Is this: BackDoor-CXT TROJAN of high risk? and why do we run ewido in safemode? is it not effective when run in normal mode?

    Thanks
    Claudine
     
    bombagirl,
    #55
  17. 2006/08/29
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine
    Right now it is listed at Low. see below.
    http://vil.nai.com/vil/content/v_138575.htm

    Many times files become "in use" when in normal mode and there for harder to remove or even can not remove because they are in use. It is also a safty reason in case they are attached to other files.

    Geri
     
    Geri,
    #56
  18. 2006/08/29
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    that explains why I can't delete certain files...as it tells me some program is using them..thus you suggest me to use safe mode to delete harmful files?
     
    bombagirl,
    #57
  19. 2006/08/29
    bombagirl

    bombagirl Inactive Thread Starter

    Joined:
    2006/08/20
    Messages:
    155
    Likes Received:
    0
    Logfile of HijackThis v1.99.1
    Scan saved at 13:20:36, on 29/08/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\FSI\F-Prot\F-Sched.exe
    C:\Program Files\FSI\F-Prot\F-StopW.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\FSI\F-Prot\fpavupdm.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsbbs.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.go.com.mt/mygo
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
    O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
    O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [CabelasGrandSlamHunting2.exe] C:\DOWNLO~1\CABELA~1.EXE /r
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 13:17:40 29/08/2006

    + Scan result:



    C:\Documents and Settings\Owner\My Documents\Ewido.Anti-Spyware4.0.0.172 premium patch\Patch.exe -> Not-A-Virus.Hacktool.Crack : Cleaned with backup (quarantined).
    C:\Documents and Settings\Owner\My Documents\My Received Files\Ewido.Anti-Spyware4.0.0.172.premium.patch.rar/Ewido.Anti-Spyware4.0.0.172 premium patch\Patch.exe -> Not-A-Virus.Hacktool.Crack : Cleaned with backup (quarantined).
    C:\Program Files\ewido anti-spyware 4.0\Patch.exe -> Not-A-Virus.Hacktool.Crack : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\nvsvcd.exe -> Proxy.Horst.av : Cleaned with backup (quarantined).
    C:\Documents and Settings\Owner\Cookies\owner@clickbank[2].txt -> TrackingCookie.Clickbank : Cleaned with backup (quarantined).
    C:\Documents and Settings\Owner\Cookies\owner@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
    C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).


    ::Report end
     
    bombagirl,
    #58
  20. 2006/08/29
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine

    That's correct.

    Geri
     
    Last edited: 2006/08/29
    Geri,
    #59
  21. 2006/08/29
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Claudine
    OK, This one's being stubborn.
    It is still in your HJT log.

    Lets see if HJT will remove it before getting tougher.

    Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

    O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.

    Reboot into safe mode.
    Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

    Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these files (if present):

    C:\WINDOWS\system\smss.exe <<Make sure you are NOT in your system32 folder.

    After that, Reboot.


    Please post a new HJT log.

    Geri
     
    Last edited: 2006/08/29
    Geri,
    #60
Page 3 of 4

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...