can't get rid of virus

[Kamui079]

my computer is running alot slower and the task manager is showing the cpu is being used alot more then usual, in the processes it shows a couple diff spyware or virus or wotever programs running when i close them one still remains which seems to randomly change names, right now its currnelty named, fgjcyj.exe i searched the file and it comes up with FGJCYJ.EXE-2B3011E7.pf along with the exe file in the system32 folder, i can delete the pf file but not the exe, all the virus/spyware programs i've tried doesn't detect it.

 

[aquias]

What programs have you tried? Remember to turn off system restore prior to removing any spyware.

In addition, run Hijack this and post the log up...

 

[Kamui079]

i used adaware se and AVG, i'll dl that hijack program and try it now, and i had system restore off already.

 

[Kamui079]

Logfile of HijackThis v1.99.1
Scan saved at 11:37:56 AM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Wintab32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\system32\mturukf.exe
D:\Firefox\firefox.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.games-fusion.net/

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nsb218.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINDOWS\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [ZPOINT32] C:\WINDOWS\system32\ZPOINT32.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CpuIdle] D:\program files\CpuIdle\cpuidle.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [bijkhno] c:\windows\system32\mturukf.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: Yahoo! Chat -

http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) -

http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab

O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) -

http://chat.yahoo.com/cab/yuplapp.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/msnmessengersetupdownloader.cab

O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) -

http://chat.yahoo.com/cab/yvwrctl.cab

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Wintab32 - Unknown owner - C:\WINDOWS\system32\Wintab32.exe

 

[aquias]

Remove the following...

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

Try to identify the following (I was unable to)

c:\windows\system32\mturukf.exe
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nsb218.dll
O4 - HKLM\..\Run: [bijkhno] c:\windows\system32\mturukf.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

In addition, download and run the Microsoft spyware beta and see if it picks anything up for you.

 

[Kamui079]

whenever i delte the F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe file it comes right back.

 

[pechenegs]

this is the fix for this aurora, ie, nail.exe, pvcproc.exe etc. Run the uninstaller form the makers of this pest, we've been using this now since yesterday at the TSG forum!

Mypctuneup.com performs technical support for a number of companies and we are sorry to hear that advertising software is causing you problems. We will gladly assist you in removing our partners' advertising software from your computer as expeditiously as possible.
From our website you can scan your PC and determine whether or not the software is installed on your machine, and if so, you can then choose to uninstall. To run the uninstall tool click on the link below:

http://www.mypctuneup.com/evaluate.php

Or go to

http://www.mypctuneup.com

and click on free uninstall tool and follow the steps.

We hope you find this helpful. Thanks again for your continued patience.


Download and install the Micro$oft antispyware BETA from

http://www.majorgeeks.com/downloads31.html

and let it fix anything
it finds

First press file and check for updates and then run it


Run an online antivirus check from

http://www.kaspersky.com/beta?product=161744315

you will need to input a name
and email adress but anyone will do & then acccept an active X control IT IS
SAFE to do soLET IT FIX WHATEVER IT FINDS

reboot again post a fresh HJT log

pech

 

[Kamui079]

Logfile of HijackThis v1.99.1
Scan saved at 12:19:51 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Wintab32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
D:\Firefox\firefox.exe
C:\WINDOWS\System32\msiexec.exe
D:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.com

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINDOWS\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/msnmessengersetupdownloader.cab

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Wintab32 - Unknown owner - C:\WINDOWS\system32\Wintab32.exe

Thats after i did all that stuff

 

[aquias]

Nail.exe still exists...

Try this, log into safe mode and open a command window (start/run/type "cmd")

Then type "nail.exe /FullRemove"

See if this will remove nail.exe from your system.

 

[aquias]

Yes I'm slow, after running that re-run hijack this again and see if it removes the Nail.exe entry.

 

[Kamui079]

it doesn't seem to delete it, reran hijack its still there. When i open cmd, it shows the directory C:\ Document and Settings\my name> i dunno if that doesn't mean crap or if i have to have it gotto C:\windows which is where the file is located, cause it says it can't find the file path or wotever.

 

[aquias]

I'm sorry Kamui...I'm apparently distracted as all get out today.

Yes, change your directory to C:\Windows and then run nail.exe /fullremove

 

[Kamui079]

ok.. how do i do that? lol i don't remember how to do this cp stuff, and thx alot for all the help, appreciate it.

 

[aquias]

No worries at all! I've learned more here than I can ever hand back...

Remember, boot into safe mode prior to running this.

1. Start/Run type "CMD" and press enter
2. Type cd\windows
3. Type nail.exe /fullremove

 

[Kamui079]

darn still there =/ little bugger.

 

[aquias]

Stubborn bugger...but I'm more so...

After some more digging, try this...

http://www.ewido.net/en/download/

Download and install, this is a fourteen day trial. It seems fairly straight forward, run the update (the software shuts down, you'll have to reopen it) and then run a scan. It's my first time toying with it, but it has been listed as a fix for nail.exe...

We shall prevail!!!!!!!!!

I'm currently running a scan now to see if anything pops up on me, but this is my first time utilizing this software.

 

[aquias]

One thing to do, save the log file and post it here after the scan has run.

My thoughts on this, slower than...well, anything else I've used. However, it did identify a few things on my system that MS and Spybot both missed. I'll be interested to see if what I've read about this is true or not...perhaps a new tool to use.

 

[Kamui079]

sounds good, i'm letting it run right now, i'll post the results after its finished.

 

[Kamui079]

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:33:18 PM, 4/21/2005
+ Report-Checksum: 30F9287A

+ Date of database: 4/21/2005
+ Version of scan engine: v3.0

+ Duration: 21 min
+ Scanned Files: 112119
+ Speed: 87.11 Files/Second
+ Infected files: 9
+ Removed files: 9
+ Files put in quarantine: 9
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\
D:\

+ Scan result:
C:\Documents and Settings\jay\Local Settings\Temporary Internet Files\Content.IE5\UHFC9KVE\Bolger[1].dll -> Spyware.BetterInternet -> Cleaned with backup
C:\WINDOWS\system32\nsc1F4.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsc20A.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsd1F8.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsf206.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsk1FE.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsz214.dll -> Spyware.Beginto.c -> Cleaned with backup
D:\backups\backup-20050421-115002-179.dll -> Spyware.BetterInternet -> Cleaned with backup
D:\backups\backup-20050421-115148-178.dll -> Spyware.Beginto.c -> Cleaned with backup


::Report End

 

[Kamui079]

i ran hijack again and its STILL there =/