How to remove this error???

Discussion in 'QnA (read only)' started by magnet, Jan 4, 2007.

Thread Status:
Not open for further replies.
  1. magnet

    magnet New Member

    Joined:
    Aug 11, 2004
    Messages:
    725
    Likes Received:
    0
    Trophy Points:
    0
  2. Kiran.dks

    Kiran.dks New Member

    Joined:
    Apr 3, 2006
    Messages:
    2,494
    Likes Received:
    91
    Trophy Points:
    0
    Location:
    Pune, India
    Yes. Your system was infected with Backdoor.Sdbot.N virus. Although avg has cleaned the virus, but the registry entry is still existing. You should remove it manually.

    Download Ccleaner and run the registry cleaner.

    Restart system. If problem remains, then
    do the following registry editing manually.

    >Start
    >Run
    >type regedit and click ok


    Navigate to the key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    In the right pane, delete the value:

    "Windows Service Host" = "scvhost.exe"

    Navigate to the key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
    RunServices

    In the right pane, delete the value:

    "Windows Service Host" = "scvhost.exe"

    Navigate to the key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Explorer\Advanced

    In the right pane, change the value to:

    "Hidden" = "1"

    Exit the Registry Editor.


    Source of registry editing and more about the virus: Click here
     
  3. OP
    OP
    magnet

    magnet New Member

    Joined:
    Aug 11, 2004
    Messages:
    725
    Likes Received:
    0
    Trophy Points:
    0
    thks for the reply but the stuff is still there...anymore suggestions
     
  4. Kiran.dks

    Kiran.dks New Member

    Joined:
    Apr 3, 2006
    Messages:
    2,494
    Likes Received:
    91
    Trophy Points:
    0
    Location:
    Pune, India
    Stuff is still there? Did you edit the registry as I said? It should work. Do it correctly.
     
  5. OP
    OP
    magnet

    magnet New Member

    Joined:
    Aug 11, 2004
    Messages:
    725
    Likes Received:
    0
    Trophy Points:
    0
    arrey did the registry stuff twice...first did it.....2nd time checked again...its still there...ill try again once more
     
  6. Vishal Gupta

    Vishal Gupta Microsoft MVP

    Joined:
    Jul 28, 2005
    Messages:
    5,173
    Likes Received:
    121
    Trophy Points:
    0
    Location:
    AskVG.com
    Post ur HijackThis logfile and we'll be able to solve the problem! :)
     
  7. OP
    OP
    magnet

    magnet New Member

    Joined:
    Aug 11, 2004
    Messages:
    725
    Likes Received:
    0
    Trophy Points:
    0
    Code:
    Logfile of HijackThis v1.99.1
    Scan saved at 5:50:55 PM, on 1/5/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)
    
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\CallingID\CallingIDGlobal.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Documents and Settings\a\Desktop\HijackThis.exe
    
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 210.212.95.99:8080
    F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
    O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
    O2 - BHO: CallingID BHO - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CallingID\CallingIDIE.dll
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
    O3 - Toolbar: Igniteds Toolbar - {143896c6-a433-40a6-a790-77676256f1f6} - C:\Program Files\Igniteds\tbIgni.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: CallingID - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CallingID\CallingIDIE.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.6.0.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160934176234
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159977893111
    O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} - http://www.seagate.com/support/disc/asp/tools/en/bin/npseatools.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{52070802-3A65-43AA-A5E9-BB907ECD95BB}: NameServer = 208.67.222.222,208.67.220.220,202.88.130.67,202.88.130.5
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C9188953-8586-4F89-8B31-3919C84AE0E2}: NameServer = 193.113.200.200,193.113.200.201
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    
    
     
  8. Vishal Gupta

    Vishal Gupta Microsoft MVP

    Joined:
    Jul 28, 2005
    Messages:
    5,173
    Likes Received:
    121
    Trophy Points:
    0
    Location:
    AskVG.com
    Fix following entries: :)

    Code:
    C:\Program Files\CallingID\CallingIDGlobal.exe
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 210.212.95.99:8080
    F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe
    O3 - Toolbar: Igniteds Toolbar - {143896c6-a433-40a6-a790-77676256f1f6} - C:\Program Files\Igniteds\tbIgni.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-ac tivex-2.0.6.0.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{52070802-3A65-43AA-A5E9-BB907ECD95BB}: NameServer = 208.67.222.222,208.67.220.220,202.88.130.67,202.88.130.5
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C9188953-8586-4F89-8B31-3919C84AE0E2}: NameServer = 193.113.200.200,193.113.200.201
    
    
     
    magnet likes this.
  9. Kiran.dks

    Kiran.dks New Member

    Joined:
    Apr 3, 2006
    Messages:
    2,494
    Likes Received:
    91
    Trophy Points:
    0
    Location:
    Pune, India
    Analysed the log file. The virus left over entry is still existing.

    F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe

    You should remove this entry.

    Run HijackThis, checkmark
    F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe
    Click FIX CHECKED.

    Restart computer.
     
    magnet likes this.
  10. OP
    OP
    magnet

    magnet New Member

    Joined:
    Aug 11, 2004
    Messages:
    725
    Likes Received:
    0
    Trophy Points:
    0
    aaah thks its gone yup fixed it with hijack this........

    thks again reps coming to u kiran and vishal....

    btw wht do u do..u look to be an expert in windows reg stuff.....

    also after removing all startup entries how was start up showing this trace........????any light on this is really helpfull
     
  11. Vishal Gupta

    Vishal Gupta Microsoft MVP

    Joined:
    Jul 28, 2005
    Messages:
    5,173
    Likes Received:
    121
    Trophy Points:
    0
    Location:
    AskVG.com
    bcoz there was an entry of the file remaining in startup, thats why windows was giving error at startup even after the removal of virus ;)
     
  12. Kiran.dks

    Kiran.dks New Member

    Joined:
    Apr 3, 2006
    Messages:
    2,494
    Likes Received:
    91
    Trophy Points:
    0
    Location:
    Pune, India
    I appreciate your feedback and nice to hear that your problem is sorted out.. :)
    scvhost.exe is not a genuine windows process. The actual process is svchost.exe that runs in Windows\system32 folder. So the left over registry entry is creating that error msg. HijackThis report clearly says that the entry still exists. All you needed to do was to remove that entry. That is what I suggested.
     
  13. rajasekharan

    rajasekharan New Member

    Joined:
    May 11, 2006
    Messages:
    727
    Likes Received:
    4
    Trophy Points:
    0
    Location:
    Now in Palakkad :-)
    And that tells you . . . Install . . . Avast . . :). . Its another free scanner and its good :).
     
  14. shantanu

    shantanu Active Member

    Joined:
    Dec 7, 2006
    Messages:
    2,784
    Likes Received:
    24
    Trophy Points:
    38
    first clean your temp and preftech folde and then clean your registry
     
  15. rajasekharan

    rajasekharan New Member

    Joined:
    May 11, 2006
    Messages:
    727
    Likes Received:
    4
    Trophy Points:
    0
    Location:
    Now in Palakkad :-)
    I dont think he will need to do that mate . . :) he got it solved :). I just gave him a suggestion to use "avast" in future :).
     
  16. OP
    OP
    magnet

    magnet New Member

    Joined:
    Aug 11, 2004
    Messages:
    725
    Likes Received:
    0
    Trophy Points:
    0
    i have used avast...it detects avg as a virus sometimes so does nod32
     
  17. piyush gupta

    piyush gupta New Member

    Joined:
    Sep 8, 2005
    Messages:
    1,284
    Likes Received:
    2
    Trophy Points:
    0
    Location:
    never land
    why not try Kasperkey
     
  18. Kiran.dks

    Kiran.dks New Member

    Joined:
    Apr 3, 2006
    Messages:
    2,494
    Likes Received:
    91
    Trophy Points:
    0
    Location:
    Pune, India
    The problem is solved already. I don't know why are you people proviking antivirus war again. Too many threads are closed recently for same reason.

    Thread reported for closing: Reason problem solved
     
    Last edited: Jan 8, 2007
Thread Status:
Not open for further replies.

Share This Page