HJT log, new here, Please Help

[makeadifferent]

Please help View attachment 13232

 

[howard_hopkinso]

Hello and welcome to Techspot.

Your system has a SmitFraud infection.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

Regards Howard :wave: :wave:

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

new log

Hi Howard ,
Thanks for your reply .
After scanning by AVG here is the logs

 

[howard_hopkinso]

Download Vundofix from HERE.

Double click the Vundofix.exe to run it.

Right click in the vundofix window and click add files.

Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

This is the filepath you need to enter into Vundofix.

C:\WINDOWS\system32\asgp32.dll

Post a fresh HJT log after doing the above.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

after running VundoFix

Hi again Howard ,

Here is log file after following your suggestion

Thanks

 

[howard_hopkinso]

Well done, your main nasty has now gone.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

ALCMTR.EXE

Close task manager.

Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: ASGP32.ASGP - {FA5B9933-1AE8-4A8D-9822-B20A6CA2B5EC} - C:\WINDOWS\system32\asgp32.dll (file missing)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

ALCMTR.EXE<Search your system for this file and delete all instances found.

Reboot your computer.

Other than the above, your HJT log is clean.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and anything nasty that`s in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

Do I have to Create Restore Points ?
or turn off and turn it back on only ?

Thanks a lot

Do I have to follow the instructure til end of all process or just turn off and turn on only ?

 

[howard_hopkinso]

Turning off system restore automatically deletes all old restore points.

Turning on system restore automatically creates a new restore point.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

Thanks a lot I think it's gone but I have a question .
Why I can not set start page to use blank Once I go to internet option to do it after re-open it alway return to use msn as my first page .
How can we do first page as blank page ?

Thanks a million for your kindly help

 

[howard_hopkinso]

Take a look at this thread HERE. Read posts #29 onwards.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

I use IE 6 not 7 .

 

[howard_hopkinso]

Ok, please post a fresh HJT log.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

here is the log
Thanks for your help and I really apreciate your efforts to solve this problem

Hi Howard ,

This might be help .
In the address at internet options at home page use this :
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

 

[howard_hopkinso]

I can see nothing in your HJT log that would account for your problem. However, I have noticed you appear to be running more than one antivirus programme. I.E Symantec/norton and NOD32. You should uninstall one of them as it`s not recommended to have more than one antivirus programme running at the same time. Apart from slowing your system down, it can also cause serious conflicts.

Let`s make sure you`ve set the homepage correctly.

Run IE and click tools/Internet options. Under Homepage, click the use blank button. Click apply/ok and close IE. Run IE again and see if you`ve now got a blank page.

Let me know the results.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[makeadifferent]

Hi Howard ,

follow your intructure but it keep going to www.msn.com as I said .
Before getting spysoldier still use blank to start page after defected can not set it back :-(
please help I don't know what to do .
It's annoying

Thanks

 

[howard_hopkinso]

Download combofix.exe. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "Y" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Regards Howard

This thread is for the use of makeadifferent only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.