1. Show Hidden Files and Folders
• Click Start
• Open My Computer
• Click the Tools menu
• Click Folder Options
• Select the View tab
• Under the Hidden files and folders heading select Show hidden files and folders
• Uncheck the Hide protected operating system files (recommended) option
• Click Yes to confirm
• Click OK

2. Restart computer in Safe-Mode

3. Open Hijackthis then Open the MISC Tools section then Open process manager

4. Look for C:\WINDOWS\system32\nvctrl.exe then click on it and click Kill process

5. Use Windows Explorer (winkey + e) then go to C:\WINDOWS\system32\ and delete the file nvctrl.exe

Restart back in Normal-Mode and post back ur log. Thanks

x86, Thank you for taking the time to help me.

I followed your instructions but came to a halt on instruction 4.

4. Look for C:\WINDOWS\system32\nvctrl.exe then click on it and click Kill process

I cannot find this file when I open up process manager. However, if I use Hijackthis not in safe mode the file appears. I did not want to delete it without consulting you first as you said the computer should be in safe mode. Should I delete it when im not in safe mode, or can you suggest anything else. Forgive me as I am a complete novice with computers.

Thanks

I am extremely sorry for this mistake.

Download NoahDfear's smitRem.exe©. and save the file to your desktop.
Right click on the file and extract it to it's own folder on the desktop.

Download the trial version of Ewido Security Suite here:

http://www.ewido.net/en/download/

• 
  
• Read
  
  
  Ewido Setup Instructions
  
  Install it, and update the definitions to the newest files. Do NOT run
  a scan yet.
• 
  

Now go back to Safe-Mode

Using Windows Explorer, locate the following file(s), and delete them:

C:\WINDOWS\system32\nvctrl.exe

Exit Explorer

Open the smitRem.exe©. folder, then double click the RunThis.bat
file to start the tool. Follow the prompts on screen. Wait for the tool to
complete and disk cleanup to finish.



The tool will create a log named smitfiles.txt in the root of your drive, eg;
Local Disk C: or partition where your operating system is installed. Please post
that log along with all others requested in your next reply.

Run Ewido:

• 
  
• Click on scanner
• 
  
• Click on Complete System Scan and the scan will begin.
• 
  
• If Ewido detects a bad file you will hear and see an alarm, select
  REMOVE
• 
  
• AND select "Perform action on all infections"
• 
  
• When the scan is finished, click the Save report button at the
  bottom of the screen.
• 
  
• Save the report to your desktop and post in to me in your reply.
• 
  

Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop >
Web > Uncheck "Security Info" if present.



Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full
system scan.

Save the scan log and repost back your HJT log with smitRem, Ewido and Panda
ActiveScan logs. Thanks

It seems like nvctrl.exe is back again.

Open HijackThis, click "Do a system scan only", then check(tick) the following:

O2 - BHO: (no name) - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - C:\WINDOWS\system32\hp9926.tmp (file missing)

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

Download The Killbox from here: KillBox

Extract it

Run the killbox.exe file

When it loads type
C:\WINDOWS\system32\nvctrl.exe in the field and
press the Delete File button (looks like a
red circle with a white X)

It will prompt you to reboot, allow it to do so.

Looks like the smitREM, i gave you was version 2.7
Delete the previous smitREM you downloaded

Download smitREM 2.8 from here:
smitREM 2.8

reboot your computer in

SafeMode

Open the smitRem.exe©.
folder, then double click the RunThis.bat

file to start the tool. Follow the prompts on screen. Wait
for the tool to

complete and disk cleanup to finish.


The tool will create a log named smitfiles.txt in the root of your drive, eg;

Local Disk C: or partition where your operating system is installed. Please post

that log along with your next reply.

Finally, reboot your computer back to Normal-Mode and
post a HJT log along with smitREM log again.

Thanks

Message Edited by x86 on 01-16-2006 05:23 PM

x86, I just realised that I posted my origional Hijackthis log in my last post, rather than my new one. Here is the new one if you dont mind checking it.

Logfile of HijackThis v1.99.1
Scan saved at 00:49:18, on 19/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\John Sherry\My Documents\HELP\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - C:\WINDOWS\system32\hp98F4.tmp (file missing)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SUPASTATUS] C:\Program Files\Internet Explorer\Connection Wizard\Status.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133771070535
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thank you

lubo67

x86,

My computer is running fine again. A big thank you for all your help.

lubo67