O
I'm getting svohost.exe not found error in my winxp os!. is this trojan/virus? and which one u think as a best antivirus which also provides worm threat protection.
virus?
svohost.exe is a virus.....
update ur Antivirus and run a complete system scan...
First get McAfee Stinger and do a scan (Stinger is not a full fledged AV, it's a removal tool for most of the viruses and it should remove svohost.exe)...
*vil.nai.com/vil/stinger/
after this post the content of HijackThis log file here (this is essential because svohost.exe adds itself to explorer shell, and we have to remove it by deleting registry editing)...
*www.spychecker.com/program/hijackthis.html
and for AntiViruses, get urself Kaspersky AntiVirus, NOD32 or if u want a Free Good AV, then go for AVG....
update ur Antivirus and run a complete system scan...
First get McAfee Stinger and do a scan (Stinger is not a full fledged AV, it's a removal tool for most of the viruses and it should remove svohost.exe)...
*vil.nai.com/vil/stinger/
after this post the content of HijackThis log file here (this is essential because svohost.exe adds itself to explorer shell, and we have to remove it by deleting registry editing)...
*www.spychecker.com/program/hijackthis.html
and for AntiViruses, get urself Kaspersky AntiVirus, NOD32 or if u want a Free Good AV, then go for AVG....
S
Hey guys my NAV 2005 Retail dosnt get installed on my XP System (256MB RAM, 2.8 GHz HT ) it just terminates after doing 20%
Y
It might be due to presence of some Virus on ur system??
did U had some AV before Norton 2005 on ur system ...
try installing some free AV first like AVG .. do a system scan & then try & install NAV2005
did U had some AV before Norton 2005 on ur system ...
try installing some free AV first like AVG .. do a system scan & then try & install NAV2005
Like swatkat said, its the Backdoor.Nibu.D (Symantec) / W32/Dumaru (McAfee) virus. You probably may not even be able to access the Symantec or Mcafee sites, so the best thing to do is to download the Stinger tool onto a floppy from somewhere else.
Run it and it will clean the W32/Dumaru infection. Once its done, search for the following files and delete them:
Rundlln.sys
Prntsvr.dll
feff35a0.htm
fe43e701.htm
fa4537ef.tmp
Click on Start>Run and type in
regedit
and press Enter to get into the Registry Editor.
Navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value,
"load32"="%System%\svohost.exe"
Then navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
and select "Shell" and then change
"explorer.exe <some other data here>"
to just plain "explorer.exe"
Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\SARS and
HKEY_USERS\.DEFAULT\SOFTWARE\SARS
and delete the SARS key completely.
Close the registry editor, and then click Start>Run and type in
notepad C:\Windows\win.ini
In the [windows] section of the file, look for a line similar to:
run=%Windir%\dllreg.exe
If you find such a line, delete it completely.
Save and exit Notepad.
If you dont want to be bothered with editing the registry and all yourself manually, get the Removal Tool that will do the job for you automatically.
*securityresponse.symantec.com/avcenter/venc/data/w32.dumaru.removal.tool.html
Chances are that your antivirus already detected and cleaned your virus infection and its trying to look for the svohost.exe file at load time and coming up blank.
Follow the steps anyway to be sure that you're not infected and make sure you run a latest, updated antivirus software at all times.
Once you're done, post your HijackThis log here anyway, so that we can be sure that you're totally squeaky clean.
Run it and it will clean the W32/Dumaru infection. Once its done, search for the following files and delete them:
Rundlln.sys
Prntsvr.dll
feff35a0.htm
fe43e701.htm
fa4537ef.tmp
Click on Start>Run and type in
regedit
and press Enter to get into the Registry Editor.
Navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete the value,
"load32"="%System%\svohost.exe"
Then navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
and select "Shell" and then change
"explorer.exe <some other data here>"
to just plain "explorer.exe"
Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\SARS and
HKEY_USERS\.DEFAULT\SOFTWARE\SARS
and delete the SARS key completely.
Close the registry editor, and then click Start>Run and type in
notepad C:\Windows\win.ini
In the [windows] section of the file, look for a line similar to:
run=%Windir%\dllreg.exe
If you find such a line, delete it completely.
Save and exit Notepad.
If you dont want to be bothered with editing the registry and all yourself manually, get the Removal Tool that will do the job for you automatically.
*securityresponse.symantec.com/avcenter/venc/data/w32.dumaru.removal.tool.html
Chances are that your antivirus already detected and cleaned your virus infection and its trying to look for the svohost.exe file at load time and coming up blank.
Follow the steps anyway to be sure that you're not infected and make sure you run a latest, updated antivirus software at all times.Once you're done, post your HijackThis log here anyway, so that we can be sure that you're totally squeaky clean.
hey enoomai.. i too got the same prob.. but after doin all the reg edit stuffs u said.. when i opened startup using MSCONIG.. i have sumthin sayin SVCHOST D:\Windows\svchost.exe location -> Software\microsoft\windows\currentversion\run.. but when i looked for it in the registry its not there.. also i have one thing called syslog32.exe from the same location.. also not found in regis.. are these two imp? i have deactivated them.. but no errors come in startup...
If you find it in msconfig, then the calling program can exist in one of four places,
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
or
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or
C:\Documents and Settings\<your user name>\Start Menu\Programs\Startup
And svchost.exe, found in C:\Windows\System32 is a valid file necessary for the proper working of Windows. If HijackThis, Spybot, Stinger, McAfee and Norton didnt find anything bad on your computer, then it probably isn't there. syslog32.exe is also a valid Windows file (that CAN get infected) and if this is at startup, then it indicates a virus. Do a full scan for viruses either online or from a known clean disk.
And, if you disable them from msconfig, it wont signal a error (just a message that some applications are disabled because of Selective Startup, and this can be disabled) The error will come when the entry says the file should be in a location like C:\Windows and it doesnt find it there, kind of like trying to open a document on a floppy via the Recent Documents panel when you've inserted and removed it while back. Please do a full update and scan for viruses and keep your AV program updated weekly. This is a hard and fast rule that should ALWAYS be adhered to.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
or
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or
C:\Documents and Settings\<your user name>\Start Menu\Programs\Startup
And svchost.exe, found in C:\Windows\System32 is a valid file necessary for the proper working of Windows. If HijackThis, Spybot, Stinger, McAfee and Norton didnt find anything bad on your computer, then it probably isn't there. syslog32.exe is also a valid Windows file (that CAN get infected) and if this is at startup, then it indicates a virus. Do a full scan for viruses either online or from a known clean disk.
And, if you disable them from msconfig, it wont signal a error (just a message that some applications are disabled because of Selective Startup, and this can be disabled) The error will come when the entry says the file should be in a location like C:\Windows and it doesnt find it there, kind of like trying to open a document on a floppy via the Recent Documents panel when you've inserted and removed it while back. Please do a full update and scan for viruses and keep your AV program updated weekly. This is a hard and fast rule that should ALWAYS be adhered to.
According to what I can find online, "svohost" is either part of spyware or some sort of virus.
The partially good news is that while Windows has instructions to look for and load svohost, it can't find it. So you either had some malware and it was partially gotten rid of or your computer is infected but it didn't get installed correctly or completely.
Do a full system scan with an up-to-date antivirus program or, if you don't have one installed, use one of the free online scans at Panda (*www.pandasoftware.com/activescan/activescan.asp?language=2&Country=63&Partner=1&Ref=EN-PR-AS-107) and Housecall (*housecall.antivirus.com/housecall/start_pcc.asp).
Then, if you haven't already, download, install, immediately update and then run Spybot (*download.com.com/3120-20-0.html?qt=SPYBOT&tg=dl-2001&search=+Go!+) and/or Ad-Aware (*www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button). Read the help files to familiarize yourself with how they work. I recommend you use them both since each tends to find things the other misses. Let them clean up any spyware found.
See if that clears things up.
The partially good news is that while Windows has instructions to look for and load svohost, it can't find it. So you either had some malware and it was partially gotten rid of or your computer is infected but it didn't get installed correctly or completely.
Do a full system scan with an up-to-date antivirus program or, if you don't have one installed, use one of the free online scans at Panda (*www.pandasoftware.com/activescan/activescan.asp?language=2&Country=63&Partner=1&Ref=EN-PR-AS-107) and Housecall (*housecall.antivirus.com/housecall/start_pcc.asp).
Then, if you haven't already, download, install, immediately update and then run Spybot (*download.com.com/3120-20-0.html?qt=SPYBOT&tg=dl-2001&search=+Go!+) and/or Ad-Aware (*www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button). Read the help files to familiarize yourself with how they work. I recommend you use them both since each tends to find things the other misses. Let them clean up any spyware found.
See if that clears things up.
@ chacko it wld b better if u had the URL tag.. i had to copy n paste the address of the free online scan sites..
@enoonmai.. i downloaded and spyware remover named XoftSpy 4.10 after i searched for HIJACK THIS on google.. n m8 it showed a spyware but am not able 2 remove it.. says i need to register it.. n if i scan the folder it says with spybot it doesn show any spyware.. also tried with AVG 7,MSanitspyware.. the name of the spyware.. is
i have WIN 98 in C: and XP in D:
i have WIN 98 in C: and XP in D:
Just go to the folder and delete the file manually and rescan.
@enoonmai i tried that.. when i went to that folder there is no such file 
no folders are hidden..
no folders are hidden..
Open the folder, and make sure "Show hidden files and folders" is selected. And uncheck "Hide Protected Operating System Files (Recommended)" and then check for the file in the location specified. Make sure you turn these options back to their defaults once you're done.
i tried wat u said.. still its not showing that file.. n btw everytime i boot the system it says needs to check drive for consistency.. even tho it shuts down normally.. this comes even if i restart.
n btw everytime i boot the system it says needs to check drive for consistency.. even tho it shuts down normally.. this comes even if i restart.
bharathbala2003 said:
Dude, How do u do the url tag thing , i'm not familiar with that
either press the URL option b4 pasting the site address.. or type manually.. and end it with [/ur l] (cut out the space in
[/b]i'll try it out next time[/list]
@enoonmai here is my hijack this log..
T
thats ur hijack this log ?
ur kidding me right ?
ur kidding me right ?
no no.. this is my 1st post based on hijack this.. if u can tell me the correct way i shall post it that way.. it was like 3 pages or more in a MS Word.. with font size at 10.. so tout this was the main stuff n pasted..
if u can tell me the correct way i shall post it that way.. it was like 3 pages or more in a MS Word.. with font size at 10.. so tout this was the main stuff n pasted..
do u have latest version of HijackThis, that is 1.99?
if u have this, then when u open HijackThis, it will give u an options screen, here there will be many buttons like "Scan computer and Save log file", "Scan computer only" etc..
Here u click, "Scan Computer and Save Log File", after this it scans ur comp and opens a Dialog box for saving te Log file, it automatically gives it a name as hijackthis.log, u click OK.
then open this "hijackthis.log" file in NotePAd and copy the entire content and post it here.....it will be approximately 1 page...
*www.spychecker.com/program/hijackthis.html
if u have this, then when u open HijackThis, it will give u an options screen, here there will be many buttons like "Scan computer and Save log file", "Scan computer only" etc..
Here u click, "Scan Computer and Save Log File", after this it scans ur comp and opens a Dialog box for saving te Log file, it automatically gives it a name as hijackthis.log, u click OK.
then open this "hijackthis.log" file in NotePAd and copy the entire content and post it here.....it will be approximately 1 page...
*www.spychecker.com/program/hijackthis.html
hijack log runs into lots of pages, swat, dude u've got 2 teach me to interpret it.....
i'll send u a surprise all d way from blore......
i'll send u a surprise all d way from blore......
Logfile of HijackThis v1.99.1
Scan saved at 9:36:56 PM, on 3/2/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\WINDOWS\system32\pctspk.exe
D:\WINDOWS\system32\ZONELABS\vsmon.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Shareaza\Shareaza.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Bala\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.thinkdigit.com/forum
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = *www.thinkdigit.com/forum
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - *go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - *v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1109423309296
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - *www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - *messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - D:\WINDOWS\system32\pctspk.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - D:\WINDOWS\system32\ZONELABS\vsmon.exe
Scan saved at 9:36:56 PM, on 3/2/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\WINDOWS\system32\pctspk.exe
D:\WINDOWS\system32\ZONELABS\vsmon.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Shareaza\Shareaza.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Bala\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.thinkdigit.com/forum
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = *www.thinkdigit.com/forum
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - *go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - *v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1109423309296
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - *www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - *messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - D:\WINDOWS\system32\pctspk.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - D:\WINDOWS\system32\ZONELABS\vsmon.exe
log is clean....
anyway scan ur system with AdAware.....
*www.lavasoftusa.com/software/adaware/
and Webroot Spysweeper....
*www.webroot.com/downloads/?WRSID=4ee5ab6ab4ed7f4b0130594328f83ed7
download demo of SpySweeper from the above link (this demo also removes Spywares...)
or else if u have already deleted files related to ShopAtHomeSelect, then u can check registry for these entries and delete them, if u find them...
HKEY_LOCAL_MACHINE\software\vgroup\sahagent\download
HKEY_LOCAL_MACHINE\software\vgroup\sahagent\readytoinstall
HKEY_LOCAL_MACHINE\software\vgroup\sahagent\valid
Go to Start> Run and type regedit and press Enter..
From here expand the branch HKEY_LOCAL_MACHINE and then expand the branch Software.
Here right click on the branch vgroup and delete it.
anyway scan ur system with AdAware.....
*www.lavasoftusa.com/software/adaware/
and Webroot Spysweeper....
*www.webroot.com/downloads/?WRSID=4ee5ab6ab4ed7f4b0130594328f83ed7
download demo of SpySweeper from the above link (this demo also removes Spywares...)
or else if u have already deleted files related to ShopAtHomeSelect, then u can check registry for these entries and delete them, if u find them...
HKEY_LOCAL_MACHINE\software\vgroup\sahagent\download
HKEY_LOCAL_MACHINE\software\vgroup\sahagent\readytoinstall
HKEY_LOCAL_MACHINE\software\vgroup\sahagent\valid
Go to Start> Run and type regedit and press Enter..
From here expand the branch HKEY_LOCAL_MACHINE and then expand the branch Software.
Here right click on the branch vgroup and delete it.
dude chck mine 2...
Logfile of HijackThis v1.99.1
Scan saved at 11:05:47 AM, on 3/3/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADSERV.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADKEEP.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PKWARE\PKZIPW\pkzipw.exe
C:\WINDOWS\DESKTOP\PKTMP000.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = *minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = *minisearch.startnow.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Preview AdService] C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADSERV.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O8 - Extra context menu item: + &Download Express: download this file - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dataone
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 61.1.96.69,61.1.96.71
Logfile of HijackThis v1.99.1
Scan saved at 11:05:47 AM, on 3/3/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADSERV.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADKEEP.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PKWARE\PKZIPW\pkzipw.exe
C:\WINDOWS\DESKTOP\PKTMP000.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = *minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = *minisearch.startnow.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Preview AdService] C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADSERV.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O8 - Extra context menu item: + &Download Express: download this file - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dataone
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 61.1.96.69,61.1.96.71
swatkat said:
m8 it got del las nite b4 i posted the log.. anyways when i went to regedit there was nuthin called as vgroup..
n btw i dunno y but for las 2 days.. when ever i restart my system.. b4 the log on screen the system is checked for consistency all drives except D: ( MY XP is installed in that ) y does this happen?anyways to sto that?
achacko@dataone.in said:dude chck mine 2...
Logfile of HijackThis v1.99.1
Scan saved at 11:05:47 AM, on 3/3/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADSERV.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADKEEP.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PKWARE\PKZIPW\pkzipw.exe
C:\WINDOWS\DESKTOP\PKTMP000.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = *minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = *minisearch.startnow.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Preview AdService] C:\PROGRAM FILES\PREVIEW ADSERVICE\PREVADSERV.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O8 - Extra context menu item: + &Download Express: download this file - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dataone
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 61.1.96.69,61.1.96.71
First go to Add/Remove Programs and uninstall the following program, if u find it:-
1]Preview AdService
Then close ALL applications and kill these processes by using the HijackTHis ProcessManager (which will be in Misc Tools section):-
1]PREVADSERV.EXE
2]PREVADKEEP.EXE
Then scan the system again in HijackThis and, Select the Red Entries and click Fix.
Then Restart in Safe Mode and delete the following files:-
1]PREVADSERV.EXE
2]PREVADKEEP.EXE
3]related.htm
and also delete the Folders containing them (do not delete the Windows Default Folders...!!)
After this reboot and run CCLeaner and CleanUp!.....
*cleanup.stevengould.org/
and post a fresh log....
@swat.. answer to my post too still gettin that cr@ppy consistency error n scans my disks
still gettin that cr@ppy consistency error n scans my disks
chkdsk runs at every startup if there is an inconsistency in the File System..... This inconsistency is indicated by a Dirty Bit, if this Dirty Bit is SET, then it is assumed that File System in inconsisten and hence chkdsk runs at every startup....bharathbala2003 said:@swat.. answer to my post too
so, u check whether Dirty Bit is SET or RESET, by doing this:-
Go to Start>Run and type cmd and press Enter.
Here, u type fsutil dirty query DriveLetter:
(u have to check the Drives which r scanned at every boot...)
There r two possible outputs:-
1]Volume DriveLetter: is dirty
2]Volume DriveLetter: is not dirty
if u get FIRST output, then at the same Command Prompt, type chkntfs /D and Reboot....(note that there is SPACE between chkntfs and /)
At the boot time, all drives r checked once (dont cancel it) and then in furthur boots, they r not checked.
m8 mine is a FAT32 partition havin win 98 in C.. i tried ntfs its not workin says must specify atleast one drive name
u should type chkntfs /D only,here D means Default, no matter what drives r checked at boot time....did u typed chkntfs /C ?bharathbala2003 said:
nope sorry i did C.. sorry ill do it n post the result..
Edited.. its done m8.. now all's fine.. thnx for the help..
Edited.. its done m8.. now all's fine..
thnx for the help..
Before I attach the log file, i would like to ask you that I have spybot installed with the resident in the taskbar as enoonmai had told me.... The resident asks me for change when I install any software, how do i know what shud be changed ( Allow/Deny change ). Also how do i stop the spyware from entering again .....
Please let me know..... Heres the log below
Logfile of HijackThis v1.99.1
Scan saved at 2:40:08 PM, on 3/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PKWARE\PKZIPW\pkzipw.exe
C:\WINDOWS\DESKTOP\PKTMP000.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = *minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = *minisearch.startnow.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: + &Download Express: download this file - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dataone
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 61.1.96.69,61.1.96.71
Please let me know..... Heres the log below
Logfile of HijackThis v1.99.1
Scan saved at 2:40:08 PM, on 3/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PKWARE\PKZIPW\pkzipw.exe
C:\WINDOWS\DESKTOP\PKTMP000.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = *minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = *minisearch.startnow.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: + &Download Express: download this file - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dataone
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 61.1.96.69,61.1.96.71
achacko@dataone.in said:Before I attach the log file, i would like to ask you that I have spybot installed with the resident in the taskbar as enoonmai had told me.... The resident asks me for change when I install any software, how do i know what shud be changed ( Allow/Deny change ). Also how do i stop the spyware from entering again .....
Please let me know..... Heres the log below
Logfile of HijackThis v1.99.1
Scan saved at 2:40:08 PM, on 3/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PKWARE\PKZIPW\pkzipw.exe
C:\WINDOWS\DESKTOP\PKTMP000.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = *www.google.co.in/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = *minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = *minisearch.startnow.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: + &Download Express: download this file - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dataone
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 61.1.96.69,61.1.96.71
those entries still remain.....
do one thing.....Get About:Buster and run it and after this run a scan using SpyBot SnD.
Downlaod AboutBuster from here, and also dont forget to read the instructions there!!!!
*www.besttechie.net/forums/index.php?showtopic=1488
Blue entrt above is the Alexa's "Related" Service, it's used by MSN, it is used to show the pages related to the ones u r currently visitng, this doesnt collect info abt ur page until unless u click "Show Related" in IE. Also, there is a possibility that, when IE is upgraded, this "Show Related" of Alexa get's vanished and only file remain, so in this case SpyBot doesnt show Alexa in it's scan report.
After running SpyBot and AboutBuster, run CleanUp! and then scan with HijackThis, and see that red entries still remain, if yes, post it here.....
V
nortan is best solution my friend
swatkat said:
the link is corrupt ........
The link is working perfectly, check it again.
@enoonmai.. the link is working perfectly for me also.. but once u download the file.. it doesn open it says corrupt.. thats wat he meant.. i also downloaded it from another source thro google.. but same result.. it downloads.. then it doesn open.. try it out..
I just downloaded the file from here:
*www.malwarebytes.biz/AboutBuster.zip
The last link on that page. Snapfiles.com and it works perfectly. No problems here. Anyway I've posted the direct download link. Try it out.
*www.malwarebytes.biz/AboutBuster.zip
The last link on that page. Snapfiles.com and it works perfectly. No problems here. Anyway I've posted the direct download link. Try it out.
@enoonmai.. same prob.. after downloadin the zip of 64KB.. when i open the .exe in the zip it says database corrupt..
enoonmai said:
dude, its the same..... dont knw why?????
wht 2 do??????
There is something seriously wrong with either your connections or your download managers. Hmm, I extracted the files myself, compressed them and uploaded them here. Try downloading it from here:
*rapidshare.de/files/766093/aboutbuster.rar.html
Hope this helps. I personally verified them.
*rapidshare.de/files/766093/aboutbuster.rar.html
Hope this helps. I personally verified them.
try here....
*www.bleepingcomputer.com/files/aboutbuster.php
*www.spychecker.com/program/aboutbuster.html
but read the instructions here...
*www.besttechie.net/forums/index.php?showtopic=1488
@achako....almost ALL softwares, be it bad or good, u install make a Registry entry in Windows. And SpyBot's TeaTimer every time asks u whether to allow or deny the registry entry being made by the Software.
and it also lists the program name or file name which is making the Reg entry, so look for the program name or software name there, if u find it as a good one (like an Antivirus software or like Adobe Acrobat etc), u click "Allow" and u may also select the option "Remember this setting" so that it doesnt ask again for the same software again......
*www.bleepingcomputer.com/files/aboutbuster.php
*www.spychecker.com/program/aboutbuster.html
but read the instructions here...
*www.besttechie.net/forums/index.php?showtopic=1488
@achako....almost ALL softwares, be it bad or good, u install make a Registry entry in Windows. And SpyBot's TeaTimer every time asks u whether to allow or deny the registry entry being made by the Software.
and it also lists the program name or file name which is making the Reg entry, so look for the program name or software name there, if u find it as a good one (like an Antivirus software or like Adobe Acrobat etc), u click "Allow" and u may also select the option "Remember this setting" so that it doesnt ask again for the same software again......
enoonmai said:
This is what I get when I download the link....
The error is database is either corrupt or missing. please dowwnload a new one.
LOL, priceless! I dont know what else to do. It seems that your computer just doesn't want the file. 
Did all the links provided on the page swatkat posted fail?
I dont know what else to do. It seems that your computer just doesn't want the file. Did all the links provided on the page swatkat posted fail?
Yup, why is it so ?
I tried all the links 4 about:buster........
Isnt there any other software, as it ?
I tried all the links 4 about:buster........
Isnt there any other software, as it ?
hey...isnt this ur old problem? check that every downloaded files get corrupted or what?
@swat.. i again started gettin that scandisk!! 
now when i ran that fsutil stuff in dos.. instead of c,e,f like las time.. it was d,e,f... y is this happenin again n again?
now when i ran that fsutil stuff in dos.. instead of c,e,f like las time.. it was d,e,f... y is this happenin again n again?
now u have to exclude the drives from being checked.... try this...go to Start>Run and type cmd and press Enter.
here, type this chkntfs /x d: e: f: (notice a SPACE between chkntfs and /x and also between the drive list)and Reboot....this means, the drives d:, e: and f: r excluded from checking.....
here, type this chkntfs /x d: e: f: (notice a SPACE between chkntfs and /x and also between the drive list)and Reboot....this means, the drives d:, e: and f: r excluded from checking.....
@swat.. done.. but why is the problem comin again n again? y is it bcomin dirty?