TechSpot

Trojan.Stervis.e  svcproc.exe.Vir.

By Wickee7
Aug 4, 2006
  1. I used ewido and heres the report of what it found but it couldnt clean some of it properly. Please help to get rid of the rest of them. Thanks.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Go HERE and follow the instructions exactly.

    Post a fresh HJT log as an attachment into this thread, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Wickee7

    Wickee7 TS Rookie Topic Starter

    i tried to follow them as best as i could. here's the 2 new files
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your system has some real nasties, but nothing we can`t handle.

    Download and run this tool HERE. follow the instructions exactly.

    Post a fresh HJT log after doing the above.

    Regards Howard :)

    This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. Wickee7

    Wickee7 TS Rookie Topic Starter

    heres the fresh hjt log file

    the latest ewido report didnt show the trojan this time... does the hjt file show clean now? there still seems to be a lot there but maybe the trojan's gone?
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name. See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    webHancer
    Gcczf
    Viewpoint\Viewpoint Toolbar
    AWS\weatherbug

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    whSurvey.exe
    Ehsvw.exe
    Weather.EXE

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

    R3 - Default URLSearchHook is missing

    O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll (file missing)

    O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll (file missing)

    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

    O4 - HKLM\..\Run: [Cnyzi] C:\Program Files\Gcczf\Ehsvw.exe

    O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?

    O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML

    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)

    O15 - Trusted Zone: *.mmohsix.com

    O15 - Trusted Zone: http://click.getmirar.com (HKLM)

    O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)

    O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)

    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab

    O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.com/app/ST/ActiveX.ocx

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} (Mirar_Dummy_ATS1 Class) - http://awbeta.net-nucleus.com/FIX/WinATS.cab

    O16 - DPF: {C190FF32-96D0-445F-9F60-5CF288FD3D0F} (ActiveFormX Control) - http://148.137.76.32:8080/registration/CAT/CNICAT.cab

    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/chuzzle/popcaploader_v6.cab

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\PROGRA~1\AWS
    C:\Program Files\Viewpoint
    C:\Program Files\Gcczf

    Reboot into normal mode and turn system restore back on.

    Post a fresh HJT log and let me know how your system is running.

    Regards Howard :)

    This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. Wickee7

    Wickee7 TS Rookie Topic Starter

    here's the fresh hjt log after i fixed the above. so far so good. the last ewido scan before that showed no trojan, but i've giving that another scan now too to double check.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT appears to be clean.

    However, there is one entry I`m a little suspicious/concerned about.

    O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe

    If you know this programme to be safe, then by all means keep it, othewise uninstall it.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. Wickee7

    Wickee7 TS Rookie Topic Starter

    i went ahead and got rid of it. seems to be working fine now. thanks!

    ~wickee
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...