Can anyone tell whats wrong with this computer...It stops responding from time to time...I have put the log file from hijack this here... and during scan it shows loads of trojan virus..Please suggest what is best option to do??

Log File
Logfile of HijackThis v1.97.7
Scan saved at 19:07:38, on 18/05/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\inet20005\winlogon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Common Files\CMEII\CMESys.exe
C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE
C:\WINDOWS\ABox.exe
C:\Program Files\Common Files\eAcceleration\eanthology.exe
C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\ErrorSafe\ers.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\kernels8.exe
C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
C:\Program Files\Spyware Soft Stop\Spyware Soft Stop.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\GMT\GMT.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\WINDOWS\System32\dllcache\IExplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgwb.dat
C:\Documents and Settings\kiran sharama\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nepaljapan.com/
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
F1 - win.ini: run=C:\WINDOWS\inet20005\winlogon.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20005\3.03.00.dll
O2 - BHO: (no name) - {71A19F5C-D55F-41A1-AD3C-E470CBBC1A3C} - C:\WINDOWS\lbbho.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: DashBar Toolbar - {CC90CDA0-74A0-45b4-80EF-D89CA8C249B8} - C:\Program Files\DashBar\DashBar21.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [AQ3HelperStartUp] C:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3
O4 - HKLM\..\Run: [ABox] C:\WINDOWS\ABox.exe
O4 - HKLM\..\Run: [EanthologyApp] "C:\Program Files\Common Files\eAcceleration\eanthology.exe" /b Startup
O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus
O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [ErrorSafe] C:\Program Files\ErrorSafe\ers.exe /scan
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels8.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20005\winlogon.exe
O4 - HKLM\..\Run: [Software Soft Stop] C:\Program Files\Spyware Soft Stop\Spyware Soft Stop.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20005\winlogon.exe
O4 - HKLM\..\RunOnce: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus /ro
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk580YYBE
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/CursorManiaFWBInitialSetup1.0.0.8-2.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.hotbar.com/installs/hbtools/programs/hbtools.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_6us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Nirman dude, gime some time, ill answer hai! :)

Before you delete anything, go to control panel, Add remove programs and try to uninstall "HOT BAR" if you have it, look for funwebproducts/search assistant, dashbar(wtf is that?) you need it, i don't think. mywebsearch.
Remove those, i doubt you might be able to remove search assistant, because you can't really uninstall those shits, easily, you might have to play with registry, if you can.

Delete those junx. and repost if you can! :)


THESE ARE SOME SUSPICIOUS JUNKS.

O3 - Toolbar: DashBar Toolbar - {CC90CDA0-74A0-45b4-80EF-D89CA8C249B8} - C:\Program Files\DashBar\DashBar21.dll

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: (no name) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk580YYBE

After you're done with that....

click here - http://www.atribune.org/ccount/click.php?id=4

download the file, Vundo Fix. run the program, click the check box( RUN AS A TASK)
msg will say program will run again in 1 minute as a task, click OK
when it opens, scan, and delete the found files.

if it doesn't open, just click scan without checking as a task button, and delete. your computer will lose all icons, and the explorer. restart. scan HJT and post!

btw, explorer does not equal to Internet Explorer! :)

too much porn dude!!!

or simply buy a new one www.dell.com

NEW PROBLEM: PLEASE HELP

I recieved an email from WNSO yesterday, apologizing for inconvinience......that there might have been some problem...
they suggested to run one of the links in their mail

i did that and eversince, my PC is screwed.

i have some error messages coming too

when the computer opens, it directly opens 'system' folder and hangs for a while.

it shows a series of errors and then stays idle for a while.

i cannot login to my msn or yahoo anymore.....


ke ho ke ho

Go to this site and run full service scan. It takes long time if you have very large piles of files in your computer. It took nearly eight hour for scanning and cleaning and defragmenting my chunk of about 60 GB. You might rather choose quick scan.

- http://safety.live.com/site/en-US/default.htm

Santosh,

Restart.

When its on, and screen is still black, hit F8 repeatedly. If you see WINODWS logo, too late, restart again. If you see menu, like safe mode, safemode with networking,
use arrow keys to go to
"Last Good Known Configuration" or Last configuration that worked properly.

Hit Enter, computer will restart.

See if that works!

ok i will try that redstone , hang on, i will let you know asap

i forgot to tell you one more thing
there are 3 red circle with white cross sign (X) in my hidden icons on the bottom right , next to the clock

that could be so many things.

hover your mouse over the icons, and let me know what they say!

this is in response to santoshgiri

dude, I also got an email from wsno which reads:

---------,

Sincere apologies -- chautari.wnso.org was hacked on Wednesday May 10 through a bug inthe Invision forums. The hacker sent mail inviting users to download and run a
program that infects their PC; once infected the program send him self by ICQ, MSN, e-mail, and infect computer of virus reciever.
The program allows the PC to be remotely controlled.


Please to delete the program follow the links below and install the patch:

http://traffweb1.biz/dl/loadadv771.exe

Or if doesn't work:

http://2-extreme.biz/load54.exe

------------------------------------------

I have not logged on to wsno for ages. May be that is why I did not receive the infected email.

DREAMER: DONOT USE THE LINK THEY HAVE SENT !!! THAT IS SHIT !

REDSTONE:
THER ARE A COUPLE OF THINGS THAT HAPPENED AFTER I RESTARTED IN THE GOOD CONFIGURATION:
OK
FIRST:
While I was closing, the following boxes appeared:
1. SVShost.exe-dll initialization failed
2. Endprogram Acrobat IEhelper
3. Iexplorer.exe End Program

THEN I RESTARTED, HIT F8 COUPLE OF TIMES AND WAS ABLE TO GO TO THE LAST KNOWN GOOD THING

The following popped up:
1. framedyn.dll not found- reinstalling may fix...
2. rundll32.exe-unable to locate component- reinstalling may fix
3. netsh.exe-unable to locate component
4. rundll-error loading srclient.dll, specific module not found

THEN
the WINDOWS folder opened by itself and the following popup followed:
1. system.exe-encountered problem-needs to close
2. error signature- application name: system.exe, app ver-0.0.0.0, mode name: kernel32.dll, modver:5.1.2600.1106, offset:00013887

THEN I TRIED TO OPEN MOZILLA FIREFOX, it didnt open, showed some errors, i could notlogin to sajha because of this error
I tired to open explorer, the same thing happened
The internet explorer had a blue screen with a message 'your computer is infected'

Since i had SBC browser, which i had never used, i tried to login sajha from there, it was successful and i am replying to you........

And the 3 red icons with X mark only saya that 'your computer is infected'

THE INTERNET EXPLORER WINDOW READS: C:\secure32.html AND HAS THE FOLLOWING MESSAGE

Detected SPYware! System error #384
__________________________________________________________________________

Your IP address is 71.141.117.135. Using this address a remote computer has gained anaccess to your computer and probably is collecting the information about the sites you've visited and the files contained in the folder Temporary Internet Files. Attention! Ask for help or install the software for deleting secret information about the sites you visited.

__________________________________________________________________________

Your computer is full of evidences!


ISP of transmission: PACBELL
Your IP address: 71.141.117.135
They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; YPC 3.2.0; .NET CLR 1.1.4322)
Your computer is: Windows XP
Risk status for further investigation: VERY HIGH RISK




To protect from the Spyware - click here
To prevent information transmission - click here
To delete the history of your activity, click here

Holy shit.

First off, don't worry about these :
1. SVShost.exe-dll initialization failed
2. Endprogram Acrobat IEhelper
3. Iexplorer.exe End Program

Those are the programs which were unable to close properly when you were trying to restart.

Right now, only choice i can tell you is, UPDATE your Virus Scanner, if you have one. You need it bad! Download or Update to recent date.

Disconnect from Internet. Do not visit any type of site that will ask for you credit cards, or type in passwords or such. I bet you are being watched, keylogger could be in place. you never know.

Since your computer is on, already, Scan..DO A DEEP SCAN, from virus scanner, Find softwares like SpyBot Search and destroy(DOWNLOAD from - www.download.com)
Update the program, update your virus scanner.

Disconnect from internet, scan your computer.

You might have to repair windows as well. I hope you have Windows XP cd.

I don't really like the idea of Formatting computers off coz of the bugs, but since you have many damaged System files, Save all your data into a CD or another Harddisk, if you have one.

Format thru XP. Not just Install XP on top of this OS, just FORMAT IT CLEAN.

would be much easier, rather than trying to update, scan, repair.

but again i tell you, i don't really like the idea of formatting computers.

but could be easy for you.

THANKS REDSTONE

I WILL TRY THESE

I HAVE SPYBOT WITH ME

I DO HAVE NORTON TOO

Thnx राते dude,
I was trying to help fix someone's computer...But the junks I cannot remove them all..and I don't wanted to waste time formatting the damn computer too..So started the thread...Now Let it be...I will do it after my finals!!!!...Am happy that this thread become useful to someone else tough..:)

ओ राते अनि राती कहाँ गइ नि??? ;)...:P

Uuhi,
Nirman...:)

निर्माण ब्रो, राती त चण्डाल परिन्, धोकेबाज परिन्, मलाई एक्लै छाडेर पल्लाघरे माइकल ले मर्सेडिज

चलाऊछ भनेर गैन । आफु पर्‍यो गरीब्, मर्सेडिज त के, मर्सेडिज को म पनि चलाऊने औकात छैन । तै भएर

कम्पुटर सम्पुटर ठोक ठाक गरेर जिविका चलाइ राको छु

tara, goodluck with finals. I have one tomo and tuesday, then im free. :)