[wowee]

Logfile of HijackThis v1.99.1
Scan saved at 12:01:27 PM, on 4/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\isrvs\desktop.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HJT\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2382079B-107D-4429-9845-DEB915E8CA77}: NameServer = 202.75.129.101,202.75.129.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{2382079B-107D-4429-9845-DEB915E8CA77}: NameServer = 202.75.129.101,202.75.129.102
O17 - HKLM\System\CS2\Services\Tcpip\..\{2382079B-107D-4429-9845-DEB915E8CA77}: NameServer = 202.75.129.101,202.75.129.102
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\l22s0cf7ef2.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

[Advertisements]

Hi wowee and welcome to the Geeks to Go Forums.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"


3. You have a BUBE infection:

• Run HijackThis. Click on "Config...", "Misc Tools", "Open process manager". Select the following files and click on "Kill process". Answer Yes to the "Are you sure..." question.
  • desktop.exe
  • edmond.exe
  • ffisearch.exe
• Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme.reg and save it on your Desktop.
  

  REGEDIT4
  
  [-HKEY_CLASSES_ROOT\clsid\{5b4ab8e2-6dc5-477a-b637-bf3c1a2e5993}]
  
  [-HKEY_CLASSES_ROOT\clsid\{950238fb-c706-4791-8674-4d429f85897e}]
  
  [-HKEY_CLASSES_ROOT\mfiltis]
  
  [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\ext\clsid\{5b4ab8e2-6dc5-477a-b637-bf3c1a2e5993}]
  
  [-HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_delprot]
  
  [-HKEY_LOCAL_MACHINE\system\currentcontrolset\services\delprot]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "desktop search"=-
  
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "ffis"=-

  Locate fixme.reg on your Desktop and double-click on it.
  You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
  Answer "Yes" and wait for a message to appear similar to "Merged Successfully".
  Restart your computer.
  
• Launch Notepad, and copy/paste the box below into a new text file. Save it as Unreg.bat and save it on your Desktop.
  
  

  regsvr32 /u C:\Windows\isrvs\msfiltis.dll
  regsvr32 /u C:\Windows\isrvs\msdbhk.dll
  regsvr32 /u C:\Windows\isrvs\sysupd.dll

  
  Locate Unreg.bat on your Desktop and double-click on it.
  
• Delete the following files/folders (if present) in C:\Windows or C:\Windows\System32
  • delprot.ini
  • delprot.log
  • desktop.exe
  • isrvs (delete the entire folder)
• Delete the following file: C:\Windows\System32\Drivers\Delprot.sys
  
• Delete the following files/folder (if present) in C:\Documents and Settings\<your user name>\Desktop
  • anal exploits.url
  • big [bleep] school for 2.95.url
  • evidence eraser.lnk
  • popup blocker stops popups.lnk
  • spyware avenger.lnk
  • virus hunter security.lnk
  • your platinum visa.lnk
• Restart your computer and post a new log from HijackThis.

Regards,

Trevuren

[Trevuren]

Hi wowee and welcome to the Geeks to Go Forums.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"


3. You have a BUBE infection:

• Run HijackThis. Click on "Config...", "Misc Tools", "Open process manager". Select the following files and click on "Kill process". Answer Yes to the "Are you sure..." question.
  • desktop.exe
  • edmond.exe
  • ffisearch.exe
• Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme.reg and save it on your Desktop.
  

  REGEDIT4
  
  [-HKEY_CLASSES_ROOT\clsid\{5b4ab8e2-6dc5-477a-b637-bf3c1a2e5993}]
  
  [-HKEY_CLASSES_ROOT\clsid\{950238fb-c706-4791-8674-4d429f85897e}]
  
  [-HKEY_CLASSES_ROOT\mfiltis]
  
  [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\ext\clsid\{5b4ab8e2-6dc5-477a-b637-bf3c1a2e5993}]
  
  [-HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_delprot]
  
  [-HKEY_LOCAL_MACHINE\system\currentcontrolset\services\delprot]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "desktop search"=-
  
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "ffis"=-

  Locate fixme.reg on your Desktop and double-click on it.
  You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
  Answer "Yes" and wait for a message to appear similar to "Merged Successfully".
  Restart your computer.
  
• Launch Notepad, and copy/paste the box below into a new text file. Save it as Unreg.bat and save it on your Desktop.
  
  

  regsvr32 /u C:\Windows\isrvs\msfiltis.dll
  regsvr32 /u C:\Windows\isrvs\msdbhk.dll
  regsvr32 /u C:\Windows\isrvs\sysupd.dll

  
  Locate Unreg.bat on your Desktop and double-click on it.
  
• Delete the following files/folders (if present) in C:\Windows or C:\Windows\System32
  • delprot.ini
  • delprot.log
  • desktop.exe
  • isrvs (delete the entire folder)
• Delete the following file: C:\Windows\System32\Drivers\Delprot.sys
  
• Delete the following files/folder (if present) in C:\Documents and Settings\<your user name>\Desktop
  • anal exploits.url
  • big [bleep] school for 2.95.url
  • evidence eraser.lnk
  • popup blocker stops popups.lnk
  • spyware avenger.lnk
  • virus hunter security.lnk
  • your platinum visa.lnk
• Restart your computer and post a new log from HijackThis.

Regards,

Trevuren

[Trevuren]

TO ADMINISTRATION

This topic is closed due to inactivity. Should the original poster need it reopened, please contact a staff member.

Trevuren