Log into the Admin account.
Open HijackThis
Click on Config > Misc Tools
Click on 'Delete an NT Sevice' and enter the following bold text into the address box: Network Security Service
Click OK.
Please update your virus definitions to the latest at this point.
TDS Anti-Trojan 1.Download and install the trial version of TDS-3 Anti-Trojan from here. Don't start the program yet. Update the trojan database by right clicking the link below and selecting 'save as' and save it to the directory where you installed TDS-3, overwriting the previous radius.td3.
2.Reboot in safe mode and launch TDS-3. In the top bar of the TDS window click System Testing > Full System Scan.
3. Detections will appear in the lower pane of the TDS window. When the scan has eventually finished, right click the lower pane and select 'save as txt' to save the 'scandump.txt'. Leaving the program open, copy and paste the contents of scandump.txt into your next reply.
4. After posting the scanlog, right click the lower TDS pane again and select 'delete' to remove everything labelled 'positive identification'.
5. Reboot the machine in Safe Mode again and run a full system scan with your anti-virus program. Copy & paste a summary of it's findings in your next reply if it detects anything.
6. Reboot in normal mode and post the TDS log, anti-virus summary and a fresh HijackThis log for inspection.
When I entered "Network Security Service" into HJT Delete an NT service, I get the error message...."Service 'Network Security Service' was not found in the Registry. Make sure you entered the short name of the service."
So I copied the name in brackets as it suggest from the HJT scan, which is ( 6Q'8).
Now this worked, but it replied saying the service is running/enabled. Disable it using HJT or services.msc.
When I 'fix' using HJT, it just returns immediately in the next scan and can't then delete it through HJT.
And according to services.msc it is already stopped. I can't do anything with the service - I get a general internal error, due the file being missing.
I guess the problem comes back to when I deleted it but forgot to 'unload' it on reboot as per your instructions. Now the file is missing but the PC thinks it is running. Not sure if that's right or not.
I feel like we're mighty close, but no cigar at the moment.
Any more ideas would be extremely well appreciated. Many thanks again.
Click Start > Run > type services.msc, then click OK
Scroll down and right click on 'Network Security Services'
Select 'Properties' and set the "Service Status" option to "Stop"
Set "Startup type" to "Disabled", click Apply, then OK.
Can you post the TDS log, anti-virus summary and a fresh HijackThis log please.
Ahead of you already. Have tried all of that but the service is effectively dead. Can do nothing with it.
Clicking on properties gives the error "Configuration manager. General Internal error occured"
The properties window does then come up, and the service is stopped. But when you press start another error "Could not start the NSS on the local computer. Error 2. The system could not find the specified file."
Can't seem to do anything at all with it !!
Here is latest HJT log though. Let me know if you still want the TDS & Antivirus logs too.
Logfile of HijackThis v1.99.1
Scan saved at 21:55:51, on 02/03/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
The service isn't doing any harm now but best to remove it.
Go to Start | Run and type Regedit then click Ok.
Before you edit the registry, you should make a backup.
Click 'FILE\Export Registry File'.
Call it REGBACKUP and save it on your desktop.
Then navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es and expand 'Services' in the left pane. Look for any entries named as:
( 6Q'8) or Network Security Service
If either are listed, right-click them and choose Delete.
Then navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot and expand Root in the Left Pane. Look for any entries like this:
LEGACY ( 6Q'8) or LEGACY Network Security Service
If listed, right-click them and choose Delete.
If you have trouble deleting a key. Then click once on the key name to highlight it and click on the Permission menu option under Security or Edit. Then Uncheck "Allow inheritible permissions" and press copy. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.
Reboot and post the TDS log, anti-virus summary and a fresh HijackThis log please.
Can you shed any light on whether this proxy is something you've set yourself? If not it may be a good idea to remove with HijackThis. If you do remove it and run into connection problems, restore it by using the backup feature of HJT in Misc. Tools.
Download unzip and run Hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.
Reboot and POST (not attach) a fresh log please. It's easier for me to analyse the log if posted on the forum.
Thanks for the info. Please run Hoster.zip, it will take care of the 01 Host entry present in your log and restore the host file to it's original state. Then post a fresh HJT log please.
What Anti-Virus product would you recommend me purchasing - Norton?
Here is the HJT log. A million thanks again.
Logfile of HijackThis v1.99.1
Scan saved at 1259, on 03/03/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
59, on 03/03/2005