TechSpot

"install" program running everytime I log on

By Verchiel
Feb 3, 2007
Topic Status:
Not open for further replies.
  1. Yea, like the thread title says, everytime I log onto my other account, it tries to install a program and MSN Antispyware shoots it down.
    But still, even after running spyware and AVG Antivirus tests in both normal mode and safe mode [and removing all infected files], it persists.
    I believe that I recieved it from a MSN Messenger message [I hate my brain lapses when I forget about viruses -.-] and yea... I really have no idea what to do.

    My HJT log is below -.-
    Pre-emptive thanks for any help I can get :)

    Edit: I forgot to mention that it also randomly tries to start the "Update.exe" application.
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Hello and welcome to Techspot.

    Your system is infected with at least one nasty trojan.

    Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

    If after reading the above, you wish to clean your system, do the following.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of Verchiel only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. Verchiel

    Verchiel TS Rookie Topic Starter

    Many thanks for the response, I followed the instructions stated in the other thread and things SEEM to be running smoothly :)

    Here are my HJT log and AVG Scan log things

    I'm not sure if I did the AVG Save Log thing right, but I think I did it correctly.

    Thanks again :)
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    That is not an AVG Antispyware log. See this pictorial guide to using AVG Antispyware. Please note: AVG Antispyware is a completely different programme to the free AVG antivirus programme. Please attach an AVG Antispyware log into your next reply.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Client IP-IPX

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    svchosts.exe<Not to be confused with svchost.exe

    Close task manager.


    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

    O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000282 (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\WINDOWS\system32\svchosts.exe<Not to be confused with svchost.exe which is a legit file.

    Reboot into normal mode and rehide your protected OS files.

    Post fresh HJT and AVG Antispyware logs.

    Regards Howard :)

    This thread is for the use of Verchiel only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. Verchiel

    Verchiel TS Rookie Topic Starter

    Seems like it's working better, here's the new HJT and AVG logs [sorry about the last mixup]
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Your HJT log is now clean. AVG Antispyware has also got rid of some nasties as well.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on.

    This will have deleted all your old restore points and anything nasty that`s in them. It will also have created a new, clean restore point.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of Verchiel only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  7. Verchiel

    Verchiel TS Rookie Topic Starter

    Many thanks for both your time and your effort.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.