Member Panel

seetheeroam

Hi! Im new here! :cheesy:
I got a virus that stops your internet connection in a snap(when they show up) even though it 'looks' like its connected you can't browse the internet

its on my activescan. its a file that runs unknowingly, well you'll know it if your connection stops. its a .tmp with alpabetic and numeric name like 5.tmp 6.tmp 2A.tmp, etc.

even though its kinda fixed i need help to completely remove this virus/spyware.

on my hijackthis, please check the stuffs there and pls. tell me what stuffs should I remove..

THANKS!!

ladygreenwitch

:grin: Hey There Seetheeroam,

Once again, welcome to PCHF.

If you would please follow the instructions for PreWork in my signature, and post back the resulting two logs. Before running HijackThis, please make sure that you are running it from it's own folder and not the desktop or a temp folder.

In the mean time I'll take a quick look and see if anything jumps out at me.

Look forward to your reply,

TTFN

LGW

seetheeroam

This is my prework, followed as directed..

:| ~bites nails~ :|

ladygreenwitch

Cool,

Thanks for that Seetheeroam, I will be back in a few.

LGW

seetheeroam

sure, np, take ur time.

ladygreenwitch

Hi Again,

OK, please download RegSupremePro from my signature.

To begin, I need you to follow these instructions to stop a bad NT service;

STOP and Disable a bad Added Service

Click Start>Run and type in: services.msc
Click OK
In the Services window find: Windows Remote Procedure Call Monitoring Service
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK
Open HJT and click config > misc tools > ?delete an NT service?
Copy and past: rpcsvc
Click OK.

Then run CCleaner again, and fix these with HijackThis;

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SU B_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchcust.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {F60E2661-292B-47EA-8D35-EE2C5E7628DF} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F60E2661-292B-47EA-8D35-EE2C5E7628DF} - (no file) (HKCU)
O23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINNT\system32\rpcsvc.exe (file missing)

Next install and run RegSupremePro. It will want to create a backup of your stash, let it. Once it has finished, click on the Registry Cleaner tab, select Aggressive. Let it run, when it is done, click on Select, and choose All. Click on Fix and let it fix everything that it found.

Reboot your PC. Run another HijackThis log, and post it back here.

Look forward to your reply,

TTFN

LGW

Member Panel

Sponsors and Ads

Live Tag Cloud