Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations derfloh on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

can't get rid of virus

Status
Not open for further replies.
Kamui079

Kamui079

Technical User
Joined
Jan 27, 2005
Messages
16
Location
US
my computer is running alot slower and the task manager is showing the cpu is being used alot more then usual, in the processes it shows a couple diff spyware or virus or wotever programs running when i close them one still remains which seems to randomly change names, right now its currnelty named, fgjcyj.exe i searched the file and it comes up with FGJCYJ.EXE-2B3011E7.pf along with the exe file in the system32 folder, i can delete the pf file but not the exe, all the virus/spyware programs i've tried doesn't detect it.
 
Sort by date Sort by votes
What programs have you tried? Remember to turn off system restore prior to removing any spyware.

In addition, run Hijack this and post the log up...
 
Upvote 0 Downvote
i used adaware se and AVG, i'll dl that hijack program and try it now, and i had system restore off already.
 
Upvote 0 Downvote
Logfile of HijackThis v1.99.1
Scan saved at 11:37:56 AM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Wintab32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\system32\mturukf.exe
D:\Firefox\firefox.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nsb218.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINDOWS\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [ZPOINT32] C:\WINDOWS\system32\ZPOINT32.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CpuIdle] D:\program files\CpuIdle\cpuidle.exe
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [bijkhno] c:\windows\system32\mturukf.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: Yahoo! Chat - O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Wintab32 - Unknown owner - C:\WINDOWS\system32\Wintab32.exe
 
Upvote 0 Downvote
Remove the following...

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

Try to identify the following (I was unable to)

c:\windows\system32\mturukf.exe
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nsb218.dll
O4 - HKLM\..\Run: [bijkhno] c:\windows\system32\mturukf.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

In addition, download and run the Microsoft spyware beta and see if it picks anything up for you.
 
Upvote 0 Downvote
whenever i delte the F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe file it comes right back.
 
Upvote 0 Downvote
this is the fix for this aurora, ie, nail.exe, pvcproc.exe etc. Run the uninstaller form the makers of this pest, we've been using this now since yesterday at the TSG forum!

Mypctuneup.com performs technical support for a number of companies and we are sorry to hear that advertising software is causing you problems. We will gladly assist you in removing our partners' advertising software from your computer as expeditiously as possible.
From our website you can scan your PC and determine whether or not the software is installed on your machine, and if so, you can then choose to uninstall. To run the uninstall tool click on the link below:
Or go to and click on free uninstall tool and follow the steps.

We hope you find this helpful. Thanks again for your continued patience.


Download and install the Micro$oft antispyware BETA from
and let it fix anything
it finds

First press file and check for updates and then run it


Run an online antivirus check from


you will need to input a name
and email adress but anyone will do & then acccept an active X control IT IS
SAFE to do soLET IT FIX WHATEVER IT FINDS

reboot again post a fresh HJT log

pech
 
Upvote 0 Downvote
Logfile of HijackThis v1.99.1
Scan saved at 12:19:51 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Wintab32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
D:\Firefox\firefox.exe
C:\WINDOWS\System32\msiexec.exe
D:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Acecad.Wtxpload] C:\WINDOWS\Acecad\Wtxpload.exe Acecad
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Wintab32 - Unknown owner - C:\WINDOWS\system32\Wintab32.exe

Thats after i did all that stuff
 
Upvote 0 Downvote
Nail.exe still exists...

Try this, log into safe mode and open a command window (start/run/type "cmd")

Then type "nail.exe /FullRemove"

See if this will remove nail.exe from your system.
 
Upvote 0 Downvote
Yes I'm slow, after running that re-run hijack this again and see if it removes the Nail.exe entry.
 
Upvote 0 Downvote
it doesn't seem to delete it, reran hijack its still there. When i open cmd, it shows the directory C:\ Document and Settings\my name> i dunno if that doesn't mean crap or if i have to have it gotto C:\windows which is where the file is located, cause it says it can't find the file path or wotever.
 
Upvote 0 Downvote
I'm sorry Kamui...I'm apparently distracted as all get out today.

Yes, change your directory to C:\Windows and then run nail.exe /fullremove
 
Upvote 0 Downvote
ok.. how do i do that? lol i don't remember how to do this cp stuff, and thx alot for all the help, appreciate it.
 
Upvote 0 Downvote
No worries at all! I've learned more here than I can ever hand back...

Remember, boot into safe mode prior to running this.

1. Start/Run type "CMD" and press enter
2. Type cd\windows
3. Type nail.exe /fullremove
 
Upvote 0 Downvote
darn still there =/ little bugger.
 
Upvote 0 Downvote
Stubborn bugger...but I'm more so...

After some more digging, try this...


Download and install, this is a fourteen day trial. It seems fairly straight forward, run the update (the software shuts down, you'll have to reopen it) and then run a scan. It's my first time toying with it, but it has been listed as a fix for nail.exe...

We shall prevail!!!!!!!!!

I'm currently running a scan now to see if anything pops up on me, but this is my first time utilizing this software.
 
Upvote 0 Downvote
One thing to do, save the log file and post it here after the scan has run.

My thoughts on this, slower than...well, anything else I've used. However, it did identify a few things on my system that MS and Spybot both missed. I'll be interested to see if what I've read about this is true or not...perhaps a new tool to use.
 
Upvote 0 Downvote
sounds good, i'm letting it run right now, i'll post the results after its finished.
 
Upvote 0 Downvote
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:33:18 PM, 4/21/2005
+ Report-Checksum: 30F9287A

+ Date of database: 4/21/2005
+ Version of scan engine: v3.0

+ Duration: 21 min
+ Scanned Files: 112119
+ Speed: 87.11 Files/Second
+ Infected files: 9
+ Removed files: 9
+ Files put in quarantine: 9
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\
D:\

+ Scan result:
C:\Documents and Settings\jay\Local Settings\Temporary Internet Files\Content.IE5\UHFC9KVE\Bolger[1].dll -> Spyware.BetterInternet -> Cleaned with backup
C:\WINDOWS\system32\nsc1F4.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsc20A.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsd1F8.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsf206.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsk1FE.dll -> Spyware.Beginto.c -> Cleaned with backup
C:\WINDOWS\system32\nsz214.dll -> Spyware.Beginto.c -> Cleaned with backup
D:\backups\backup-20050421-115002-179.dll -> Spyware.BetterInternet -> Cleaned with backup
D:\backups\backup-20050421-115148-178.dll -> Spyware.Beginto.c -> Cleaned with backup


::Report End
 
Upvote 0 Downvote
i ran hijack again and its STILL there =/
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

iambob
  • Locked
  • Question Question
Avast Anti-Virus is.. a virus?!
Replies
5
Views
862
Oorde
Oorde
shivajiboss
  • Locked
  • Question Question
I am getting a problem while opening up my windows
Replies
1
Views
704
2ffat
2ffat
andyv2011
  • Locked
  • Question Question
Looking at Virus Actions
Replies
0
Views
356
andyv2011
andyv2011
Tiffc0922
  • Locked
  • Question Question
Virus / Malware Scans on Local PCs
Replies
5
Views
643
goombawaho
goombawaho
kharrison70
  • Locked
  • Question Question
Meskisift Visaal Studie Virus?
Replies
6
Views
630
goombawaho
goombawaho

Part and Inventory Search

Sponsor

Back
Top