[tristonsmy]

Hi, my machine picked up a virus , the O.S is 2000pro, it managed to get past Outpost, Norton, Adaware se and Spy bot, none of these could find anything wrong so I installed Spyware Dr which did find problems and a mate installed Trojan Hunter which found several more problems. After trying to fix these, none of these programmes now find anything wrong, however I've been left with a couple of problems: The files for Outlook Express are damaged and I can't use it, but more importantly, the machine still seems to be displaying some 'virus-like' traits. I can't retreive any updates for Norton antivirus, if I try to download them manually, the machine won't install them, if I go to the Symantec site I can't get to any links, I just get an error msg 'Error! the requested page does not exist'. I even tried the online scan at Trend micro, but I get the same error msg when I try to click the icon to perform that. Any ideas much appreciated, and I'll warn you I'm a novice who knows nothing about registry etc !!!!!!!!

[Relic]

Have you run your AVP in safe mode? Have you tried booting into "safe mode with networking", and then updating your AVP files?

Doesn't matter what you are doing, a virus scan, spyware scan, disk defrag, it should always be done in safe mode. Any virus/adware/spyware/Trojan that starts with Windoze, will be running when you scan if you're not in "safe mode".

Hit "F8" when booting up, choose "Safe Mode With Networking", update your AVP files, then scan.

[tristonsmy]

Cheers will give it a try and see what happens

[Relic]

Let us know how it turns out, one way or the other, what helps one person, may help many.

[Cormac]

Triston,
Also don't forget to turn off system restore when you do the scan. If you don't, then system restore just ends up keeping a copy of it.

From the sounds of the problems you had with Norton and Trend, your HOST file may be corrupted. You can go here and get more info on HOST files and also download the HOST file this site has. I have used it for a year so far and have had no problems and it updates every month.
http://www.mvps.org/winhelp2002/hosts.htm

[tristonsmy]

Hi again, thanks for the replies, progress so far, some good some bad, booting in to safemode with networking and safemode, I don't have the use of my mouse, so I cant execute any scans, can't even navigate my way past the evaluation page of Trojan hunter! I did however manage to download the lastest Norton updates. Booting and scanning in the normal O.S Norton found two problems, avAw6.sys and Symsvcsa.exe and Spyware Dr found Trojan downloader.VB.RI and VX2.Look2me, i forgot to say before, when I boot I get a warning from Outpost firewall pro of Internet explorer components change New Jav1c.tmp and Jav11.tmp. This still happens now. Also to add insult to injury, I thought I could resolve the damaged Outlook Express and mouse issues by doing a repair install, wasn't sure about the message warning SP2 cannot be installed over SP4. Then I got to the serial no. and found that in our recent house move I've lost it ! Never rains but pours. Has 2000 pro got a System restore ? Not sure where to go from here.

[tristonsmy]

Sorry forgot to say, the virus removal didn't resolve the initial probs, but then I couldn't do it in 'safe mode'

[Cormac]

Actually it mayn't have system restore. I assumed it did because of the pro aspect of the OS.

[Cormac]

Triston,
go to this link and download the program. Then post the results of the scan in this thread.
http://www.majorgeeks.com/download.php?det=3155

[tristonsmy]

Hi again, right what I did in the end was download a copy of the anti vir from free av to a recovery partition which was put in place on my machine by the guy who built it for me, ran the scan, and low and behold it discovered 4 trojans and a worm, (not bad for a free programme, when all the paid for stuff couldn't do it). After the repairs, the problems I had noticed disappeared, even Outlook Express was reinstalled,that was o.k though I managed to import all the old messages etc. But I would like you to check the hijack this log as every time I boot Outpost warns me of a change of component to Internet explorer, the file is always named Jav.tmp there is a number or a letter after the Jav which changes at every boot. I haven't got a clue what it is or if it's o.k, it's filepath is c:\tmp
Logfile of HijackThis v1.99.1
Scan saved at 15:38:59, on 27/01/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\WINNT\system32\CTsvcCDA.EXE
D:\WINNT\System32\svchost.exe
D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\Program Files\Agnitum\Outpost Firewall\outpost.exe
D:\WINNT\system32\pctspk.exe
D:\WINNT\system32\MSTask.exe
D:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
D:\WINNT\system32\stisvc.exe
D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\Program Files\Common Files\Symantec Shared\SymTray.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINNT\system32\taskmgr.exe
D:\WINNT\system32\LSASS.EXE
D:\Program Files\iPod\bin\iPodService.exe
D:\PROGRA~1\WinZip\winzip32.exe
C:\Tmp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program

Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton

SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] D:\Program Files\Common Files\Symantec

Shared\Symtray.exe SetReg
O4 - HKLM\..\Run: [SSC_UserPrompt] D:\Program Files\Common Files\Symantec Shared\Security

Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"

-osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Office] D:\WINNT\system32\msoff.exe
O4 - HKLM\..\Run: [ntdll.dll] D:\WINNT\system32\msoff.exe
O4 - HKLM\..\Run: [Outpost Firewall] D:\Program Files\Agnitum\Outpost Firewall\outpost.exe

/waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] D:\Program Files\Agnitum\Outpost Firewall\feedback.exe

/dump:os_startup
O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] D:\Program Files\Common Files\Symantec

Shared\Symtrdr.exe
O4 - HKCU\..\Run: [Creative Detector] D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

/R
O4 - HKCU\..\Run: [ntdll.dll] C:\winstall.exe
O4 - HKCU\..\Run: [Spyware Cleaner] "D:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
O4 - Startup: Task Manager.lnk = D:\WINNT\system32\taskmgr.exe
O4 - Global Startup: Task Manager.lnk = D:\WINNT\system32\taskmgr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - D:\Program

Files\Agnitum\Outpost Firewall 1.0\trash.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - D:\Program

Files\Agnitum\Outpost Firewall 1.0\trash.exe (file missing) (HKCU)
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -

http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -

http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -

http://www.installengine.com/engine/isetup.cab
O16 - DPF: {A5C76BEB-C8A9-4F59-BB90-52A821EAB9C9} (Desktop Object) -

http://sib1.od2.com/common/cman/cman.dll
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) -

http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) -

http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -

http://fdl.msn.com/public/chat/msnchat45.cab
O20 - AppInit_DLLs: D:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O20 - Winlogon Notify: MS-DOS Emulation - D:\WINNT\system32\fp6q03j5e.dll (file missing)
O20 - Winlogon Notify: printpn2 - printpn2.dll (file missing)
O20 - Winlogon Notify: ShellCompatibility - D:\WINNT\system32\mjclus.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common

Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program

Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

D:\WINNT\system32\CTsvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. -

D:\WINNT\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation -

D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - D:\Program

Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - D:\Program

Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - D:\WINNT\system32\pctspk.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -

D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program

Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - D:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common

Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - D:\Program

Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Look forward to hearing your comments cheers for now, Triston

[Wilhelmus]

You got nasty sob called spysheriff.

O4 - HKLM\..\Run: [ntdll.dll] D:\WINNT\system32\msoff.exe
O4 - HKCU\..\Run: [ntdll.dll] C:\winstall.exe
O20 - Winlogon Notify: MS-DOS Emulation - D:\WINNT\system32\fp6q03j5e.dll (file missing)
O20 - Winlogon Notify: printpn2 - printpn2.dll (file missing)
020 - Winlogon Notify: ShellCompatibility - D:\WINNT\system32\mjclus.dll (file missing)

And see this:
http://www.bleepingcomputer.com/forums/H...exe-t22402.html

[tristonsmy]

sorry, another question, will i be able to use the automatic removal method they talk about from safe mode without the use of a mouse, as i still haven't found my 2000pro serial key to be able to repair install and fix the mouse to work in safe mode ?