Jump to content


Photo

Adware malware removal from laptop


  • This topic is locked This topic is locked
3 replies to this topic

#1 sriram

sriram

    Member

  • New Member
  • Pip
  • 1 posts

Posted 01 June 2007 - 07:14 PM

My laptop is infected with adware. Problems are:
a. New browsers (IE) opens randomly with different advertisements, sometimes context sensitive ads.
b. Lots of new processes seems to run at startups.

Please help. Thanks in advance,
Sriram.

HijackThis log:- (Updated with the latest log)
Logfile of HijackThis v1.99.1
Scan saved at 10:13:18 AM, on 6/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Intel\Wireless\Bin\EvtEng.exe
F:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
F:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\ehome\ehtray.exe
F:\WINDOWS\system32\rundll32.exe
F:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
F:\Program Files\Dell\QuickSet\quickset.exe
F:\Program Files\Apoint\Apoint.exe
F:\WINDOWS\wlegvunA.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\system32\PPATCH~1\mshta.exe
F:\Documents and Settings\Sriram\Application Data\?icrosoft.NET\c?rss.exe
F:\Program Files\Apoint\Apntex.exe
F:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
F:\WINDOWS\eHome\ehRecvr.exe
F:\WINDOWS\eHome\ehSched.exe
F:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
F:\WINDOWS\system32\dllhost.exe
F:\WINDOWS\system32\wscntfy.exe
F:\WINDOWS\eHome\ehmsas.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\downloads\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [ehTray] F:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelZeroConfig] F:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] F:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Dell QuickSet] F:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Apoint] F:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [wlegvunA] F:\WINDOWS\wlegvunA.exe
O4 - HKLM\..\Run: [ExploreUpdSched] F:\WINDOWS\system32\swinqqdt.exe CHD003
O4 - HKLM\..\Run: [Genuine] rundll32.exe "F:\WINDOWS\system32\aofknvbi.dll",realset
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Uaol] "F:\WINDOWS\system32\PPATCH~1\mshta.exe" -vt yazb
O4 - HKCU\..\Run: [Eews] "F:\Documents and Settings\Sriram\Application Data\?icrosoft.NET\c?rss.exe"
O4 - Startup: TA_Start.lnk = F:\WINDOWS\system32\dwdsregt.exe
O4 - Startup: Think-Adz.lnk = F:\WINDOWS\system32\swinqqdt.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.kumudam.c...er/tdserver.cab
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadc...easeInstall.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.driveclea...leanerstart.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O23 - Service: EvtEng - Intel Corporation - F:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - F:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - F:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - F:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - F:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Edited by sriram, 03 June 2007 - 09:15 AM.


#2 SWI Support Robot

SWI Support Robot

    Helper robot

  • SWI Bot
  • PipPipPipPipPip
  • 23,520 posts

Posted 04 June 2007 - 06:30 AM

Welcome to SWI. We apologize for the delay; our helpers have been very busy.
If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Thank you for your patience.

[this is an automated reply]
This is an automated message. It does not count as help.

#3 miekiemoes

miekiemoes

    Malware Expert

  • Global Moderator
  • PipPipPipPipPip
  • 20,026 posts

Posted 19 June 2007 - 03:55 PM

Hello,

I notice that you do not seem to be running Antivirus software and a Firewall. This is somewhat suicidal in today's digital world.
That's why I want you to install them first!!

Avira, AVG OR Active Virus Shield (uncheck the Security Toolbar during install) are good FREE antivirus.
Never install more than one antivirusscanner or firewall on your system! Several together can give problems and decrease the reliability of it seriously!
Comodo OR Kerio are FREE firewalls.

Understanding and using firewalls

Reboot your computer afterwards.
After reboot, perform a full scan with your Antivirus and let it remove anything it is finding. Then reboot once again in order to delete files that were in use previously.

Post a new HijackThislog in your next reply - then we'll start from there, because it really makes no sense otherwise that we clean this up manually if an Antivirusscan is not present which should be able to deal with most and prevent further reinfection.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow!---My Blog---Follow me on Twitter.
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

My help is free, but if you wish to help keep these forums running please consider a donation, see this topic for details.

#4 miekiemoes

miekiemoes

    Malware Expert

  • Global Moderator
  • PipPipPipPipPip
  • 20,026 posts

Posted 29 June 2007 - 09:13 AM

Due to the lack of feedback, this Topic is closed.

If you need this topic reopened for continuations of existing problems, please tell the moderating team by replying here
This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow!---My Blog---Follow me on Twitter.
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

My help is free, but if you wish to help keep these forums running please consider a donation, see this topic for details.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button