winlogon nvchost.exe

[sureno]

hi i noticed that in my running proccesses i had a nvchost. after doing a few counter measures, ran ad-aware se, smitfraud, hjt and deleted appropriate it still appears after reboot? how do i actually remove this item. the pc in question is not connected to the internet but i need all available proccessing power available. should i post a new log or is there a method to removal of nvchost.exe correctly.
many thanks

[Gecko]

Hi sureno,

nvchost.exe is a trojan that is hooked to the winlogon process so it cannot be removed in normal mode, safe mode must be used and even then it can be tricky to remove. Please be aware that nvchost.exe is usually accompanied by other spyware and trojans.

Your best bet would be to post a current hijackthis log of the system.

[sureno]

here goes:

Logfile of HijackThis v1.99.1
Scan saved at 10:50:15, on 24/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\explorer.exe
H:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [GBB36X Configure] H:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [iMON] H:\Program Files\SOUNDGRAPH\iMON\iMON.exe /startup
O4 - HKLM\..\Run: [FirefaceTray] fireface.exe
O4 - HKLM\..\Run: [FirefaceMixTray] firefacemix.exe
O4 - HKLM\..\Run: [DigidesignMMERefresh] H:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [StartAlphaTrackApplet] AlphaTrackApplet.exe
O4 - HKLM\..\Run: [PSDrvCheck] H:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [winlogon] H:\WINDOWS\nvchost
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - H:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - H:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - H:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - H:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - H:\Program Files\SiSoftware\SiSoftware Sandra Engineer XI.SP4\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - H:\Program Files\SiSoftware\SiSoftware Sandra Engineer XI.SP4\RpcSandraSrv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


tried the safe mode a couple of times

[Gecko]

sureno,

I need you to do two things before we can really get to cleaning up your system.

1. Hijackthis.exe need to be in it's own folder like this:
H:\Program Files\HJT\HijackThis.exe
Otherwise the restore feature in Hijackthis will not work right.

2. I need you to rename hijackthis.exe to hjt.exe
It looks like you may also have a vundo infection that is hiding thing from Hijackthis.exe.
(Spyware programmers are catching on about Hijackthis)

Please post a new hjt.exe log and we will get started on cleaning you up.

[sureno]

done as you asked here's the new log
think i got rid of the nvchost.exe

Logfile of HijackThis v1.99.1
Scan saved at 15:08:36, on 24/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\HJT\HJT.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [GBB36X Configure] H:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [iMON] H:\Program Files\SOUNDGRAPH\iMON\iMON.exe /startup
O4 - HKLM\..\Run: [FirefaceTray] fireface.exe
O4 - HKLM\..\Run: [FirefaceMixTray] firefacemix.exe
O4 - HKLM\..\Run: [DigidesignMMERefresh] H:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [StartAlphaTrackApplet] AlphaTrackApplet.exe
O4 - HKLM\..\Run: [PSDrvCheck] H:\WINDOWS\system32\PSDrvCheck.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - H:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - H:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - H:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - H:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - H:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - H:\Program Files\SiSoftware\SiSoftware Sandra Engineer XI.SP4\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - H:\Program Files\SiSoftware\SiSoftware Sandra Engineer XI.SP4\RpcSandraSrv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

[Gecko]

Your log is clean

[sureno]

thank you for your time and effort
paul