Trojan.Stervis.e svcproc.exe.Vir.

[Wickee7]

I used ewido and heres the report of what it found but it couldnt clean some of it properly. Please help to get rid of the rest of them. Thanks.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and follow the instructions exactly.

Post a fresh HJT log as an attachment into this thread, only after doing the above.

Regards Howard :wave: :wave:

This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Wickee7]

i tried to follow them as best as i could. here's the 2 new files

 

[howard_hopkinso]

Your system has some real nasties, but nothing we can`t handle.

Download and run this tool HERE. follow the instructions exactly.

Post a fresh HJT log after doing the above.

Regards Howard

This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Wickee7]

heres the fresh hjt log file

the latest ewido report didnt show the trojan this time... does the hjt file show clean now? there still seems to be a lot there but maybe the trojan's gone?

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name. See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

webHancer
Gcczf
Viewpoint\Viewpoint Toolbar
AWS\weatherbug

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

whSurvey.exe
Ehsvw.exe
Weather.EXE

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R3 - Default URLSearchHook is missing

O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll (file missing)

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll (file missing)

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

O4 - HKLM\..\Run: [Cnyzi] C:\Program Files\Gcczf\Ehsvw.exe

O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1

O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?

O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)

O15 - Trusted Zone: *.mmohsix.com

O15 - Trusted Zone: http://click.getmirar.com (HKLM)

O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)

O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)

O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab

O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.com/app/ST/ActiveX.ocx

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} (Mirar_Dummy_ATS1 Class) - http://awbeta.net-nucleus.com/FIX/WinATS.cab

O16 - DPF: {C190FF32-96D0-445F-9F60-5CF288FD3D0F} (ActiveFormX Control) - http://148.137.76.32:8080/registration/CAT/CNICAT.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/chuzzle/popcaploader_v6.cab

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\PROGRA~1\AWS
C:\Program Files\Viewpoint
C:\Program Files\Gcczf

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log and let me know how your system is running.

Regards Howard

This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Wickee7]

here's the fresh hjt log after i fixed the above. so far so good. the last ewido scan before that showed no trojan, but i've giving that another scan now too to double check.

 

[howard_hopkinso]

Your HJT appears to be clean.

However, there is one entry I`m a little suspicious/concerned about.

O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe

If you know this programme to be safe, then by all means keep it, othewise uninstall it.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of Wickee7 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Wickee7]

i went ahead and got rid of it. seems to be working fine now. thanks!

~wickee