Tom,

On the same screen you get when you tap the f8 key to safe mode there should also be a selection to restart to an earlier configuration (or something like that).
That should return your computer to the last "stable" state before you made the changes with malwarebytes.

Terry

Hi Terry,

That did the trick. I should have noticed that, but at the time I was panic stricken. I've had a PC since 1983 and never had to resort to that previously. They say, there's a first time for everything.

What do you supposed happened?

Also, does that restore the Trojans, also? I'll check that shortly.

Many thanks for a quick fix for what I envisioned was a major diaster.

Best Wishes,

Tom

Tom if you do still show the trojans you would be better off going to this support forum where they can lead you step by step on how to get cleaned up, trojan agent can be hard to deal with. Just go to the forum and register then go to this hijackthis area and start a thread, if you would please add a link back to this thread so the team knows what has happened thus far, the team will get to you as soon as possible, and be sure to let them know your Operating system.
HijackThis Logs
if you can find that log please also post that in your thread.
R-C

Tom,

Basically, you restored the Windows Registry to an earlier time when the system was operating correctly. The trojans themselves are still on your harddrive but only the registry entries "pointing to" them are gone.

I did some Googling and it appears that viaagpl.sys has something to do with either a video or chipset driver for a Via chipset or onboard video. Updating your motherboard drivers may take care of that problem. Why it popped up after running Malwarebytes is unknown.

Heed Ravencajun's post to ensure that you return your system to a clean state.

The only suggestion I have is to get the Firefox browser and use it for all browsing except when going to trusted sites. In the long run, your system will be more secure and you will have less of a hassle when browsing the internet. Internet Explorer uses active-x which allows malware to be installed.

Terry

Hi Ravencajun and Terry,

After I sent my prior post at 01:13, I ran another Malwarebytes scan which came up clean. But, you're saying those critters are still hiding in there somewhere. OK, I go to
HijackThis Logs as I don't need excess baggage.

As to using IE, I use it rather infrequently, primarily to see how something I've done on one of our sites looks in IE.

I've been a FireFox proponent ever since FireFox 1.0. However, each new edition has expanded and consequently slows this ole box down even more. Remember, this is an 8 year old machine with 256 mb of RAM. So, I've gone to Opera in self-defense because of its using less resources, etc.

Again, many thanks for all you help.

And, a Happy Mother's Day to all,

Tom

Tom,

Maybe I was premature in my assumption that the malware files were still on your computer. Malwarebytes probably removed them, but along the way it may have removed something else that was critical to the operation of your computer.

I have also been using Firefox since the beginning. Presently, I still use Firefox 2.0 as I have a triple-boot system (Windows 98SE, Windows 2000, Windows XP) so I like to keep all my OS's standardized. And all Firefox versions have an encrypted cache that cannot be accessed by anything other than Firefox. Even on a bad day, Firefox 2 is still more secure than Internet Explorer of any flavor due to it's lack of active-x.

I don't even use an active antivirus as I use a small, freeware program that protects the Windows Registry from being written to by malware.
The only protection I have is a firewall, Firefox, and a registry protector and have never had any problems with spyware/adware/malware/trojans or viruses on any of my three Operating Systems.

Terry

Pardon my delay in getting back with you all. After getting a clean bill of health from Malwarebytes from my scan after cleaning up the prior mess, and getting Terry's most recent message, I have not done a HiJack This Log.

Maybe, I'm lazy but do you all feel it still should be done?

Again, many thanks for all fo your input.

Tom

Feel free to post here I'll look at it and we can also run an online scan,

Click Here to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
 Doubleclick on the HJTInstall.exe icon on your desktop.
 By default it will install to C:\Program Files\Trend Micro\HijackThis .
 Click on Install.
 It will create a HijackThis icon on the desktop.
 Once installed, it will launch Hijackthis.
 Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
 Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System, a spyware fighter will guide you.

Here it is. I don't understand one iota of what's in this log file.

Thanks,

Tom

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:20:54 PM, on 5/14/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Plextor2000\AFSSVC.EXE
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\WINNT\System32\svchost.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\devldr32.exe
C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\system32\LVCOMSX.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: HelperObject Class - (00C6482D-C502-44C8-8409-FCE54AD9C208) - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Yahoo! Companion BHO - (02478D38-C3F9-4efb-9B51-7695ECA05670) - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - (8E718888-423F-11D2-876E-00A0C9082467) - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: SnagIt - (8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3) - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINNT\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe
O16 - DPF: (156BF4B7-AE3A-4365-BD88-95A75AF8F09D) (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: (2BC66F54-93A8-11D3-BEB6-00105AA9B6AE) (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: (644E432F-49D3-41A1-8DD5-E099162EEEC5) (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL mizkjs.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: afssvc - Plextor Corp. - C:\Program Files\Plextor2000\AFSSVC.EXE
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINNT\System32\HPHipm11.exe

--
End of file - 5854 bytes

Looks good there is no Malware showing just 2 Items to fix.

Close all browser windows including this one only have hijackthis open DO A SYSTEM SCAN ONLY place a check mark in the following entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
This is harmless, but should be fixed.

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit

Nvidia system tray applet. Not necessary. Removing this entry will free up a small amount of system resources.

Now clicked FIXED CHECKED.

Reboot the computer.

Do a SYSTEM SCAN & SAFE A LOG FILE review the NEW log an those entries should be gone.

You have a clean machine there!!

One thing I don't see is a Firewall program?

Hi Zep,

Those items are now history. You mentioned a Firewall.

I'm behind a cable modem and a Linksys router, so do I need an additional firewall?

Thanks for all your advice.

Best Wishes,

Tom

I would consider a software firewall not sure what to recommend lets see what others say in the mean time I'll look around there are several free ones available.

It probably wouldn't hurt to also have a software firewall. I'm using a router with a firewall built in, but I also use a software firewall.

You may have to search for one that will work with Win 2K.

Here is one that works with 2000, try it out outpost.