need help with viruses

Viruses and worms
1

:frowning:

Can anyone help, I’ve scanned repeatedly with avast and norton, started off with 7 viruses, removed them but avast keeps saying there’s two more that it can’t remove. Here is my log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:24:16, on 16/05/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\sttray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Einstein\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZFIV1X4V\aswclnr[1].exe
C:\Users\Einstein\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZFIV1X4V\aswclnr[1].tmp
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 1993 bytes

Any ideas?

Thanks!

2

Are you using Norton at the same time as avast?
Can you say what is the infected file name, where was it found (C:\windows\system32\infected-file-name.xxx)?
What avast! version and virus database are you using? (see About dialog of avast!)

3

Apart from the fact that Tech mentions about Norton, your HJT log it pitifully short, considering it is run in windows normal mode.

Did you modify it before posting it ?
If not then you may have malware that recognises HiJackThis and is avoiding or blocking its data gathering.

Rename HiJackThis.exe to say isso1035HJT.exe and run it again and post the new log contents.