Thread: PC problems...BIG TIME..Help me please!

Hey!

getting problems with my computer for about, 2 weeks ago..Advertisment popups occured at the desktop and stuff like that..My pc runs a bit slow and when i play my games I suddendly find myself hanging at the desktop :S..I`ve tried searching the web after some good and free softwares to remove these problems, but i dont had much luck.. I use a AVG Antivirus software and Lavasoft ad aware se personal..

Please help me, I feel like throwing my pc out the window..

Thanks!

Hi,

Sounds like you still have spyware on your pc, can you download "hijackthis" software, (link is in right column on this page, under free tools)

Install hijackthis on your pc, but change the install path to C:\hijack rather then the default one,

Run the program and click on "Do a system scan a save a log file", this will open up your log file in notepad, cut and paste the contents of your log file and post it back to me.

thanks

Stmantec Email Proxy alert keeps coming up on my screen.....any suggestions?

When does this message appear, what are you doing on your pc?

thanks

Thanks TechMaster!

Logfile of HijackThis v1.99.1
Scan saved at 17:28:17, on 01.05.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programfiler\Norman\NPF\NPFSVICE.EXE
C:\Programfiler\D-Tools\daemon.exe
C:\WINDOWS\atiptaxx.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsch ed.exe
C:\Programfiler\MessengerPlus! 3\MsgPlus.exe
C:\Programfiler\HP\hpcoretech\hpcmpmgr.exe
C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe
C:\Programfiler\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programfiler\PC Tools AntiVirus\PCTAV.exe
C:\Programfiler\SPYWAREfighter\spfprc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Valve\Steam\Steam.exe
C:\Programfiler\Norman\NPF\npfmsg.exe
C:\Programfiler\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\PC Tools AntiVirus\ScanningProcess.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\WinRAR\WinRAR.exe
C:\Programfiler\WinRAR\WinRAR.exe
C:\DOCUME~1\Joachim\LOKALE~1\Temp\Rar$EX00.360\Hij ackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.vg.no/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
file://C:\APPS\IE\offline\nor.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft

Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Poly HTML Filter BHO - {0140DF95-9128-4053-AE72-F43F0CFCA062} -
C:\WINDOWS\system32\SiKernel.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AdsCleaner Helper - {40FB69E1-9B7B-453F-B238-37D8E9528929} -
C:\Programfiler\SoftInform\AdsCleaner Trial\PAKIEPlugins.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} -

C:\Programfiler\CleanMyPC Popup Blocker\CleanBHO.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programfiler\MSN
Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
C:\Programfiler\MSN Apps\MSN Toolbar\MSN
Toolbar\01.02.5000.1021\no\msntb.dll
O2 - BHO: Offliner AdFilter Helper - {DC9377A2-2E8D-44A1-99DB-F8A821DF254D}
- C:\WINDOWS\system32\SiPlugins.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
C:\Programfiler\MSN Apps\MSN Toolbar\MSN
Toolbar\01.02.5000.1021\no\msntb.dll
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} -
C:\Programfiler\CleanMyPC Popup Blocker\CleanBar.dll
O3 - Toolbar: AdsCleaner Links Bar - {A8415B7A-F661-4D31-92D7-4398E50483DF}
- C:\PROGRA~1\SOFTIN~1\ADSCLE~1\PAKIEGUI.dll
O3 - Toolbar: AdsCleaner Bar - {75CD0BC5-E317-449C-9FF6-4986B3D48F64} -
C:\PROGRA~1\SOFTIN~1\ADSCLE~1\PAKIEGUI.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe"
-lang 1033
O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe]
"C:\Programfiler\Fellesfiler\Real\Update_OB\realsc hed.exe" -osboot
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programfiler\MessengerPlus!
3\MsgPlus.exe"
O4 - HKLM\..\Run: [HP Component Manager]
"C:\Programfiler\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched]
C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinProfile] sndcfg16.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [w017d3ab.dll] RUNDLL32.EXE w017d3ab.dll,I2
0006dfba0017d3ab
O4 - HKLM\..\Run: [delcab] C:\drivers\deltreew.exe C:\cabs
O4 - HKLM\..\Run: [PCTAVApp] "C:\Programfiler\PC Tools AntiVirus\PCTAV.exe"
/MONITORSCAN
O4 - HKLM\..\Run: [spywarefighterguard]
C:\Programfiler\SPYWAREfighter\spfprc.exe
O4 - HKLM\..\Run: [Error Nuker] C:\Programfiler\Error
Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\Run: [AdwareAlert] C:\Programfiler\AdwareAlert\AdwareAlert.exe
-boot
O4 - HKLM\..\RunServices: [RDLL] RunDll16.exe
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programfiler\MessengerPlus!
3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Steam] C:\Programfiler\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [Pop up Blocker] "C:\Programfiler\Pop up Blocker\pd.exe"
Minimize
O4 - HKCU\..\Run: [AdsCleaner] C:\Programfiler\SoftInform\AdsCleaner
Trial\AdsCleaner.exe /MIN
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\msnmsgr.exe"
/background
O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: NPF Messenger.lnk = ?
O8 - Extra context menu item: Add banner url(s) to AdsCleaner -
C:\Programfiler\SoftInform\AdsCleaner Trial\System\Scripts\off_banner.htm
O8 - Extra context menu item: Add selected links to Link Container -
C:\Programfiler\SoftInform\AdsCleaner
Trial\System\Scripts\off_collector_sel.htm
O8 - Extra context menu item: Bookmark all links in AdsCleaner -
C:\Programfiler\SoftInform\AdsCleaner Trial\System\Scripts\off_all.htm
O8 - Extra context menu item: Bookmark selected link(s) in AdsCleaner -
C:\Programfiler\SoftInform\AdsCleaner Trial\System\Scripts\off_sel.htm
O8 - Extra context menu item: Open all links in new windows -
C:\Programfiler\SoftInform\AdsCleaner Trial\System\Scripts\off_open_all.htm
O8 - Extra context menu item: Open selected link(s) in new windows -
C:\Programfiler\SoftInform\AdsCleaner Trial\System\Scripts\off_open_sel.htm
O8 - Extra context menu item: Say to AdsCleaner Team about banner -
C:\Programfiler\SoftInform\AdsCleaner Trial\System\Scripts\off_report_ad.htm
O8 - Extra context menu item: Show domain links -
C:\Programfiler\SoftInform\AdsCleaner
Trial\System\Scripts\off_domain_links.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: PD - {1B17C147-B98E-46CC-BB71-3C3820FF5D4E} -
C:\Programfiler\Pop up Blocker\pd.exe
O9 - Extra button: AdsCleaner Bar - {B5D8F853-BEC9-4F9C-B3C9-0F744B6869D1} -

C:\PROGRA~1\SOFTIN~1\ADSCLE~1\PAKIEGUI.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programfiler\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\nor.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.imgfarm.com/images/nocache...entralInitialS
etup1.0.0.8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binary...t.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner -
C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1 1\Intel
32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner -
C:\Programfiler\Fellesfiler\Macromedia Shared\Service\Macromedia
Licensing.exe
O23 - Service: Norman Type-R - Unknown owner -
C:\Programfiler\Norman\NPF\NPFSVICE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Hi,

Ok, following these instructions very carfully, this takes some time but needs to be done im afraid

Please print out or copy this page to Notepad.

Make sure to work through the fixes in the exact order it is mentioned below.

If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

You should 'not' have any open browsers when you are following the procedures below.

Also if you have any programs that may prevent system changes (like Spybot's TeaTimer program, Ad-aware's Ad-Watch, and others), make sure you disable them before doing any of the fixes (or accept the changes for the fix we give you when asked by the programs).

Go to My Computer->Tools (or View)->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders (it's Show all files for Windows 98).
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm and then click OK.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Before you do anything else, please create a folder for HijackThis and put it in a permanent folder (like C:\HJT) instead of the Temp folder. This is required because HijackThis will create backups and we don't want them to be deleted.



================================================== =============

Restart your computer and boot into Safe Mode , (If your not sure just press the F8 key before windows starts loading, and choose safe mode from the menu, still not sure then come back to me :-)) Make sure to close any open browsers.


Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if found:

Messenger Plus - this program contains a 'sponsor' program. If you installed this 'sponsor' program, please uninstall Messenger Plus and reinstall it back but without the sponsor.

spywareFighterGuard It is an uknown program of dubious reputation.

================================================== =============

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

R3 - Default URLSearchHook is missing
O2 - BHO: Poly HTML Filter BHO - {0140DF95-9128-4053-AE72-F43F0CFCA062} - C:\WINDOWS\system32\SiKernel.dll
O2 - BHO: Offliner AdFilter Helper - {DC9377A2-2E8D-44A1-99DB-F8A821DF254D}
- C:\WINDOWS\system32\SiPlugins.dll
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programfiler\MessengerPlus!
3\MsgPlus.exe"
O4 - HKLM\..\Run: [WinProfile] sndcfg16.exe
O4 - HKLM\..\Run: [w017d3ab.dll] RUNDLL32.EXE w017d3ab.dll,I2 0006dfba0017d3ab
O4 - HKLM\..\Run: [delcab] C:\drivers\deltreew.exe C:\cabs
O4 - HKLM\..\Run: [spywarefighterguard] C:\Programfiler\SPYWAREfighter\spfprc.exe
-boot
O4 - HKLM\..\RunServices: [RDLL] RunDll16.exe
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programfiler\MessengerPlus!3\MsgPlus.exe" /WinStart

================================================== =============

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\WINDOWS\system32\SiPlu
sndcfg16.exe
w017d3ab.dll
C:\drivers\deltreew.exe
C:\Programfiler\SPYWAREfighter
RunDll16.exe<<<<<<<<Do a search for and delete
sndcfg16.exe<<<<<<<<Do a search for and delete
C:\Programfiler\MessengerPlus!3

================================================== =============


Reboot your system in Normal Mode.


Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner

1. Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on See report then click Save report

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan

Paste the Panda Scan report here together with a new HiJack This log.

thanks