[chipakid]

Hey im just really mad at this spyware infection i've try norton antivirus,adaware spybot,and many more. sometimes i'd try to run all my spyware,adware,antivirus with its new definitions update to see if that would make it stop ,but still no use,by the way the spyware only shows up a few seconds after i open internet explorer.Please help---------------------------------------------------------------------------------------------------------


Logfile of HijackThis v1.99.1
Scan saved at 8:00:09 AM, on 9/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\GWHotKey.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0D31A3D1-6F6B-9B12-0A90-0457EFD52299} - C:\WINDOWS\system32\kqbamml.dll
O2 - BHO: (no name) - {4BD6500B-EDF2-E322-C7E2-007C6EFBDAAD} - C:\WINDOWS\system32\egxayol.dll
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [vicrxxm.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vicrxxm.dll,fcjchff
O4 - HKLM\..\Run: [vfqogt.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vfqogt.dll,qocgun
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\HijackThis.exe /startupscan
O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.s...trl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.s...trl/tgctlsr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1152418390359
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.c...rt/IbmEgath.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{47C3753D-B1DA-42E0-9AB7-EC711225F006}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Edited by chipakid, 21 September 2006 - 02:37 PM.

[Advertisements]

Hello.

Please open HijackThis, click Do a system scan only, and then place a checkmark beside each of these entries:

O2 - BHO: (no name) - {0D31A3D1-6F6B-9B12-0A90-0457EFD52299} - C:\WINDOWS\system32\kqbamml.dll
O2 - BHO: (no name) - {4BD6500B-EDF2-E322-C7E2-007C6EFBDAAD} - C:\WINDOWS\system32\egxayol.dll

After placing all the checkmarks, close all windows (except HJT), and then hit Fix Checked. When it finishes, exit HJT.

=====================================

Locate and delete the following file(s), if present : C:\WINDOWS\system32\kqbamml.dll
C:\WINDOWS\system32\egxayol.dll
=====================================

Download ATF Cleaner

• Double-click ATF-Cleaner.exe to run the program.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Run an online scan at Panda's ActiveScan

• Please go here using Internet Explorer.
• Once you are on the Panda site click the Scan your PC button.
• A new window will open, click the big Check Now button.
  • Enter your Country.
  • Enter your State/Province.
  • Enter your e-mail address and click send.
  • Select either Home User or Company.
  • Click the big Scan Now button.
• If it wants to install an ActiveX component allow it.
• It will start downloading the files it requires for the scan.
• When the download is complete, click on My Computer to start the scan.
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
• Post the Panda report along with a new Hijackthis log.

[Jag11]

Hello.

Please open HijackThis, click Do a system scan only, and then place a checkmark beside each of these entries:

O2 - BHO: (no name) - {0D31A3D1-6F6B-9B12-0A90-0457EFD52299} - C:\WINDOWS\system32\kqbamml.dll
O2 - BHO: (no name) - {4BD6500B-EDF2-E322-C7E2-007C6EFBDAAD} - C:\WINDOWS\system32\egxayol.dll

After placing all the checkmarks, close all windows (except HJT), and then hit Fix Checked. When it finishes, exit HJT.

=====================================

Locate and delete the following file(s), if present : C:\WINDOWS\system32\kqbamml.dll
C:\WINDOWS\system32\egxayol.dll
=====================================

Download ATF Cleaner

• Double-click ATF-Cleaner.exe to run the program.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
• Click the Empty Selected button.
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Run an online scan at Panda's ActiveScan

• Please go here using Internet Explorer.
• Once you are on the Panda site click the Scan your PC button.
• A new window will open, click the big Check Now button.
  • Enter your Country.
  • Enter your State/Province.
  • Enter your e-mail address and click send.
  • Select either Home User or Company.
  • Click the big Scan Now button.
• If it wants to install an ActiveX component allow it.
• It will start downloading the files it requires for the scan.
• When the download is complete, click on My Computer to start the scan.
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
• Post the Panda report along with a new Hijackthis log.

[chipakid]

thanks t for showing the way, that infection is gone now .

[Jag11]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.