TechSpot

Help PLEASE with Hijack this log

By cep
Jun 21, 2007
  1. Hi, Am having severe probs with pc and have resorted to using ancient laptop to browse and seek help. When I try (on the pc) to connect to the net, my internet connection works fine, but all I get on IE is 'Page cannot be displayed' no matter what i do. All settings etc seem to be correct on options tab. Virus Software and firewalls all turned off make no difference. Below is Hijack This log:
     
  2. momok

    momok TS Rookie Posts: 2,265

    Hi cep and welcome to techspot. =)

    Download LSPFix from HERE.
    1. Disconnect from the Internet, go to the LSPfix file and extract/unzip LSP-Fix into its own folder [C:\lspfix].
    2. Open the lspfix folder and double-click on LSPFix.exe to start the program.
    3. Check the "I know what I am doing" checkbox.
    4. Select (highlight) all instances of 'vnvsgkxos.dll' in the left column under "Keep".
    5. Click the arrow >> so it goes over to the right column under "Remove".
    6. Click "Finish" and LSPfix will remove references to the file and restore the chain numbers.
    7. Restart your computer

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Boot into safe mode under your normal user name. See how HERE

    Next turn on "Show all files and folders, including hidden and system". See how HERE

    Go to start > run and type services.msc. Press the enter key.
    Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    ms ownage
    Browser Help Svc
    Mcafee Antivirus Monitoring System8


    Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

    winPE.exe
    BHSV.EXE
    VSStatmn8.exe


    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {0BFCB8C2-D10B-46EF-8507-3BD89DE22FB3} - C:\WINDOWS\system32\qsqugrls.dll
    O2 - BHO: (no name) - {1F737917-06DA-44ED-8156-944619AECE3F} - blank (file missing)
    O2 - BHO: (no name) - {890C7964-9320-4055-BE11-7D7B562A6417} - (no file)
    O2 - BHO: (no name) - {ECCC69DE-01EB-4D16-B0EB-5566374EAA73} - blank (file missing)
    O4 - HKLM\..\RunServices: [ms ownage] winPE.exe
    O4 - HKLM\..\RunServices: [Browser Help Svc] BHSV.EXE
    O4 - HKLM\..\RunServices: [Mcafee Antivirus Monitoring System8] VSStatmn8.exe
    O4 - HKCU\..\RunServices: [Browser Help Svc] BHSV.EXE
    O15 - Trusted Zone: http://secure.gestrip.com (HKLM)
    O15 - Trusted Zone: http://update.randhi.com (HKLM)
    O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
    O20 - Winlogon Notify: policies - C:\WINDOWS\
    O20 - Winlogon Notify: rpcc - C:\WINDOWS\
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    Close HJT.


    Navigate in Windows Explorer and delete the following files and folders in bold.

    C:\WINDOWS\system32\qsqugrls.dll

    Also do a search for the following files and delete them:
    winPE.exe
    BHSV.EXE
    VSStatmn8.exe


    Reboot into normal mode and rehide your protected OS files.

    Now, go ahead to Viruses/Spyware/Malware, preliminary removal instructions and follow the steps given. Do follow all the instructions exactly. They will provide logs for analysis of your system so I will know how to instruct you to proceed.

    Thereafter, please post fresh HijackThis, AVG Antispyware and Combofix logs as attachments into this thread. Do not copy and paste your logs if not it will be ignored and/or removed.

    Also, please let me know the results of the AVG Antirootkit scan


    Regards,
    Your friendly momok =)

    This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. cep

    cep TS Rookie Topic Starter

    Momok, Thank you SOOOOOOOOOO much for all your help.
    Hopefully have completed all tasks as requested and attached reports.

    Edited by Moderator: No need for a double post if there are no replies between your current post and the last post, unless bumping the thread. In that case, please wait at least 24 hours before doing so. Otherwise, simply use the "Edit post" button instead.

    PS. Antirootkit found nothing. AVG found nothing either!
     
  4. momok

    momok TS Rookie Posts: 2,265

    Hi,

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Download the attached "Combofix-Do.txt" (from my attachment) and save it to the same folder as Combofix.

    Boot into safe mode under your normal user name. See how HERE

    Next turn on "Show all files and folders, including hidden and system". See how HERE

    Go to start > run and type services.msc. Press the enter key.
    Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Browser Help Svc

    Go to start > Control Panel > Add and Remove Programs.
    Remove anything related to the following:

    NewDotNet
    RegCure
    < this is bad.

    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    O4 - HKCU\..\RunServices: [Browser Help Svc] BHSV.EXE
    O4 - HKUS\S-1-5-18\..\RunServices: [Browser Help Svc] BHSV.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunServices: [Browser Help Svc] BHSV.EXE (User 'Default user')
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D5029398-D0EE-4016-9067-D3950BDA1062}: NameServer = 62.6.40.178 194.72.0.98 < Fix this only if you do not recognise the IP

    Close HJT.

    Drag the Combofix-Do.txt that you downloaded earlier over on to Combofix.exe and release.

    This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job. Attach the resultant log in your reply.

    Reboot into normal mode and rehide your protected OS files.

    Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as attachments into this thread.


    Regards,
    Your friendly momok =)

    This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. cep

    cep TS Rookie Topic Starter

    Hi Momok,
    Attached as requested.
    Thanking you once again.
    cep
     
  6. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Your logs look pretty clean. However the AVG antispyware log looks pretty weird to me. Have you managed to complete a full system scan? It should state the date, time of the scan as well as items found and the actions taken for each detection. Could you check again to see if you have the right file uploaded?


    Regards,
    Your friendly momok =)

    This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. cep

    cep TS Rookie Topic Starter

    Hi Momok,
    Is this the right one?
     
  8. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Yes that is definitely the right one. However I noticed that your AVG log displays 'Ignored' for all the files detected.
    I require you to run AVG again and quarantine the files. Pictorial instructions HERE.

    It's been sometime since you last posted. Could you also post fresh HijackThis logs and ComboFix logs? This is to ensure you did not get reinfected by any residual nasties.


    Regards,
    Your friendly momok =)

    This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...