Help PLEASE with Hijack this log

[cep]

Hi, Am having severe probs with pc and have resorted to using ancient laptop to browse and seek help. When I try (on the pc) to connect to the net, my internet connection works fine, but all I get on IE is 'Page cannot be displayed' no matter what i do. All settings etc seem to be correct on options tab. Virus Software and firewalls all turned off make no difference. Below is Hijack This log:

 

[momok]

Hi cep and welcome to techspot. =)

Download LSPFix from HERE.
1. Disconnect from the Internet, go to the LSPfix file and extract/unzip LSP-Fix into its own folder [C:\lspfix].
2. Open the lspfix folder and double-click on LSPFix.exe to start the program.
3. Check the "I know what I am doing" checkbox.
4. Select (highlight) all instances of 'vnvsgkxos.dll' in the left column under "Keep".
5. Click the arrow >> so it goes over to the right column under "Remove".
6. Click "Finish" and LSPfix will remove references to the file and restore the chain numbers.
7. Restart your computer

You may wish to copy and paste these instructions on notepad for easier reference later.

Boot into safe mode under your normal user name. See how HERE

Next turn on "Show all files and folders, including hidden and system". See how HERE

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

ms ownage
Browser Help Svc
Mcafee Antivirus Monitoring System8

Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

winPE.exe
BHSV.EXE
VSStatmn8.exe

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {0BFCB8C2-D10B-46EF-8507-3BD89DE22FB3} - C:\WINDOWS\system32\qsqugrls.dll
O2 - BHO: (no name) - {1F737917-06DA-44ED-8156-944619AECE3F} - blank (file missing)
O2 - BHO: (no name) - {890C7964-9320-4055-BE11-7D7B562A6417} - (no file)
O2 - BHO: (no name) - {ECCC69DE-01EB-4D16-B0EB-5566374EAA73} - blank (file missing)
O4 - HKLM\..\RunServices: [ms ownage] winPE.exe
O4 - HKLM\..\RunServices: [Browser Help Svc] BHSV.EXE
O4 - HKLM\..\RunServices: [Mcafee Antivirus Monitoring System8] VSStatmn8.exe
O4 - HKCU\..\RunServices: [Browser Help Svc] BHSV.EXE
O15 - Trusted Zone: http://secure.gestrip.com (HKLM)
O15 - Trusted Zone: http://update.randhi.com (HKLM)
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: policies - C:\WINDOWS\
O20 - Winlogon Notify: rpcc - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

Close HJT.


Navigate in Windows Explorer and delete the following files and folders in bold.

C:\WINDOWS\system32\qsqugrls.dll

Also do a search for the following files and delete them:
winPE.exe
BHSV.EXE
VSStatmn8.exe

Reboot into normal mode and rehide your protected OS files.

Now, go ahead to Viruses/Spyware/Malware, preliminary removal instructions and follow the steps given. Do follow all the instructions exactly. They will provide logs for analysis of your system so I will know how to instruct you to proceed.

Thereafter, please post fresh HijackThis, AVG Antispyware and Combofix logs as attachments into this thread. Do not copy and paste your logs if not it will be ignored and/or removed.

Also, please let me know the results of the AVG Antirootkit scan


Regards,
Your friendly momok =)

This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[cep]

Momok, Thank you SOOOOOOOOOO much for all your help.
Hopefully have completed all tasks as requested and attached reports.

Edited by Moderator: No need for a double post if there are no replies between your current post and the last post, unless bumping the thread. In that case, please wait at least 24 hours before doing so. Otherwise, simply use the "Edit post" button instead.

PS. Antirootkit found nothing. AVG found nothing either!

 

[momok]

Hi,

You may wish to copy and paste these instructions on notepad for easier reference later.

Download the attached "Combofix-Do.txt" (from my attachment) and save it to the same folder as Combofix.

Boot into safe mode under your normal user name. See how HERE

Next turn on "Show all files and folders, including hidden and system". See how HERE

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

Browser Help Svc

Go to start > Control Panel > Add and Remove Programs.
Remove anything related to the following:

NewDotNet
RegCure < this is bad.

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKCU\..\RunServices: [Browser Help Svc] BHSV.EXE
O4 - HKUS\S-1-5-18\..\RunServices: [Browser Help Svc] BHSV.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunServices: [Browser Help Svc] BHSV.EXE (User 'Default user')
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5029398-D0EE-4016-9067-D3950BDA1062}: NameServer = 62.6.40.178 194.72.0.98 < Fix this only if you do not recognise the IP

Close HJT.

Drag the Combofix-Do.txt that you downloaded earlier over on to Combofix.exe and release.

This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job. Attach the resultant log in your reply.

Reboot into normal mode and rehide your protected OS files.

Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as attachments into this thread.


Regards,
Your friendly momok =)

This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[cep]

Hi Momok,
Attached as requested.
Thanking you once again.
cep

 

[momok]

Hi,

Your logs look pretty clean. However the AVG antispyware log looks pretty weird to me. Have you managed to complete a full system scan? It should state the date, time of the scan as well as items found and the actions taken for each detection. Could you check again to see if you have the right file uploaded?


Regards,
Your friendly momok =)

This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[cep]

Hi Momok,
Is this the right one?

 

[momok]

Hi,

Yes that is definitely the right one. However I noticed that your AVG log displays 'Ignored' for all the files detected.
I require you to run AVG again and quarantine the files. Pictorial instructions HERE.

It's been sometime since you last posted. Could you also post fresh HijackThis logs and ComboFix logs? This is to ensure you did not get reinfected by any residual nasties.


Regards,
Your friendly momok =)

This thread is for the use of cep only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.