PCTech Forums

Hi guys!I recently took 2000 off my puter and am now running xp!I beleive I got a bug!
It keeps shutting down my fire wall and clearing my paswords to BB's like this one I'm posting a log file is there anything here a miss?
Iv'e hilited three I don't trust.
Please shead some light.

Thanx
Fred

Logfile of HijackThis v1.99.1
Scan saved at 3:47:40 PM, on 12/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AZZ Cardfile\AZZ Cardfile.exe
C:\WINDOWS\tool2.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Fred\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe

Your post only had a partial hjack file, you need to post the whole file--Gecko's The Man on this, I'm just helping speed things up

You have at least two trojans running, one of them could be stopping HijackThis from finishing its scan.

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
tool2.exe
spoolsrv32.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe


Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\WINDOWS\tool2.exe
C:\WINDOWS\System32\spoolsrv32.exe

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

Gecko
No luck this puppy is not giving up.
There is nothing in the recycle bin ever even thou I deleted stuff!
Hjt log file woun't give me a current log file it keeps bringing up an old file!
What next!?
Update the comuter just crashed after the reboot ran HJT log file current here it is.
Should i be deleting the 04's

Logfile of HijackThis v1.99.1
Scan saved at 8:52:46 AM, on 12/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Fred\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Restart Windows in Safe mode
After you see the BIOS screen and before Windowes starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.


Press Ctrl/Alt/Del and"End Task"or"End Process"on each of the following:
(They may or may not be there)
winstall.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\winstall.exe

If you cannot delete this file then start HijackThis and click the Open the misc tools section now click Delete a file on reboot
Select the following file to be deleted on reboot:
C:\winstall.exe

Click open but click no to reboot close HijackThis

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

I tryed safe mode yesterday to get into things!I have no internet conection from there nor could I make one? Is that normal?The other question I have ,Do you consider the desk top a window!Sorry for the dense question I'm not a good computer nerd.! Not good at anything at the moment .

Trend micro Identified these viruses yesterday .You are corect about there being two
It said the one changes its name and avoids getting caut.
Win install is not in task manager at this moment.

Althou I followed all the steps in your not Except the temp file thing I could not find the temp folders or files recycle bin had sipo in it!

Heres the latest log after boot up.

Heres the wall paper that this thing has installed on my desk top!

WARNING!
YOU'RE IN DANGER!



ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK. WHEN YOU VISIT SITES, SEND EMAILS... ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.

Every site you or somebody or even something, like spyware, opened in your browser, with all images, and all downloaded and maybe later removed movies or mp3 songs - ARE STILL THERE and could broke your life!


SECURE YOURSELF RIGHT NOW!
REMOVE ALL SPYWARE FROM YOUR PC!

Removal instructions