I have never really had a problem with viruses as I always keep Norton Internet security up-to-date and regularly scan with Ad-Aware and pest patrol but recently my net connection has become really slow.I recently upgraded to a Pentium D chip and the ASUS motherboard has the Intel integrated graphic card thingy..I at first thought that the lack of graphics memory may have been slowing streaming video and the loading of pics on web pages,but having a look a round I got quite a shock.firstly, I couldn't open IE6 Internetoptions and after reading forums on the web, discovered the browser hijack info.Opening the registry however, I found that the WHOLE internet explorer program was not in the registry in the software/microsoft entry.Needless to say it is not in Control Panel either.I was running System Mechanic 6 and I have a feeling that program has buggered up the registry (however it has been uninstalled and I can't change it). Norton comes up clean,PP comes up clean.Spybot comes up clean,Adawre comes up clean and so does Ewido. But something IS wrong. Now norton live update gives an error message!
Hijackthis' startup log shows a stack of missing registry keys too.
I decided to run also from prevx.com/hijack.this.asp
results of scan
Worm.Alacra-B %WINDIR%\EXPLORER.EXE
Trojan.SystemPoser %WINDIR%\SYSTEM32\LSASS.EXE
Adware.JWord %PROGRAMFILES%\MESSENGER\MSMSGS.EXE
Trojan.SystemPoser %WINDIR%\SYSTEM32\SERVICES.EXE
w32.Adware.NewDotNet %WINDIR%\SYSTEM32\SVCHOST.EXE
Trojan.SystemPoser %WINDIR%\SYSTEM32\WINLOGON.EXE
W32.PassMail %PROGRAMFILES%\REAL\REALPLAYER\REALPLAY.EXE
Spyware.EliteToolBar %WINDIR%\SYSTEM32\SPOOLSV.EXE
CWS.Paytime-Hijacker %COMMONFILES%\SYMANTEC SHARED\CCAPP.EXE
Spyware.Lineage %WINDIR%\SYSTEM32\NEROCHECK.EXE
Dropper.Payload %WINDIR%\SYSTEM32\PSDRVCHECK.EXE
what are your thoughts?? sorry about the long-winded intro but here is the log:
Logfile of HijackThis v1.99.1
Scan saved at 11:16:50, on 2006/09/17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
J:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
J:\Program Files\Common Files\Symantec Shared\ccProxy.exe
J:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
J:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
J:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
J:\WINDOWS\system32\brsvc01a.exe
J:\WINDOWS\system32\brss01a.exe
J:\WINDOWS\system32\spoolsv.exe
j:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
J:\WINDOWS\Explorer.EXE
J:\Program Files\B's Recorder GOLD8\bgsvc.exe
J:\WINDOWS\system32\Brmfrmps.exe
J:\Program Files\Digidesign\Drivers\MMERefresh.exe
J:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
J:\Program Files\ewido anti-spyware 4.0\guard.exe
J:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
J:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
J:\WINDOWS\System32\svchost.exe
J:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
J:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
J:\Program Files\I-O DATA\HDDロック\IoSecShadow.exe
J:\Program Files\Common Files\Symantec Shared\ccApp.exe
J:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
J:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
J:\Program Files\WinFast\WFTVFM\WFWIZ.exe
J:\WINDOWS\system32\DeltTray.exe
J:\Program Files\ewido anti-spyware 4.0\ewido.exe
J:\WINDOWS\system32\ctfmon.exe
J:\Program Files\Messenger\msmsgs.exe
J:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
J:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Aladdin Systems\StuffIt\stuffit.exe
J:\Program Files\hijack this\HijackThis.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - J:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - J:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - J:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - J:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - J:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - J:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - J:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - J:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [PSDrvCheck] J:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EM_EXEC] J:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SetDefPrt] J:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [IoSecShadow] J:\Program Files\I-O DATA\HDDロック\IoSecShadow.exe
O4 - HKLM\..\Run: [ccApp] "J:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Ad-watch] "J:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [H2O] J:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [DigidesignMMERefresh] J:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [SystemGuardAlerter] SystemGuardAlerter.exe
O4 - HKLM\..\Run: [ioloDelayModule] J:\Program Files\iolo\System Mechanic Professional 6\delay.exe
O4 - HKLM\..\Run: [WinFast Schedule] J:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [QuickTime Task] "J:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] "J:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "J:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [MSConfig] J:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [!ewido] "J:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] J:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "J:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [MSMSGS] "J:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RealPlayer] "J:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [updateMgr] J:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint プレビュー - res://J:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint 印刷 - res://J:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint 印刷リストに追加 - res://J:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint 高速印刷 - res://J:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun の Java コンソール - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - J:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - J:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Yahoo!メッセンジャー - {CEBF73C0-BA2E-11d4-A73A-00508B33FB82} - J:\PROGRA~1\Yahoo!J\MESSEN~1\YPagerj.exe
O9 - Extra 'Tools' menuitem: Yahoo!メッセンジャー - {CEBF73C0-BA2E-11d4-A73A-00508B33FB82} - J:\PROGRA~1\Yahoo!J\MESSEN~1\YPagerj.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...rl/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1119148863437
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {64DE24D8-001D-4E36-8C86-36AF88005D4A} (YbbSecDiagMain Control) - http://bbsecu.jp/bbs...SecDiagMain.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155467952687
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O16 - DPF: {CEDDF50D-9FA7-41A8-BCD0-6350D1ED2306} (SecurityManager Class) - https://ptsbcw.trial...wActiveXCab.CAB
O16 - DPF: {ED670769-9022-4D11-B915-0FB69E4D44C3} (SBPlayer Control) - http://ybb.yimg.jp/h...tivex/sbacx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - J:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Adobe Systems - J:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: B's Recorder GOLD Service (bgsvc) - B.H.A Corporation - J:\Program Files\B's Recorder GOLD8\bgsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - J:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - J:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - J:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - J:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - J:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - J:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - J:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Intel® Active Monitor (imonNT) - Unknown owner - J:\Program Files\Intel\Intel® Active Monitor\imonnt.exe (file missing)
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - J:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe (file missing)
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - j:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - J:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect サービス (navapsvc) - Symantec Corporation - J:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - J:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - J:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - J:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - J:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Sign In
Create Account
