Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

hijacked by webbuying please help [Resolved]

Started by marcw , Oct 12 2007 01:44 PM

This topic is locked

#16
kahdah

Posted 13 October 2007 - 09:05 PM

GeekU Teacher

Retired Staff
15,822 posts

You have a very badly infected machine.
It might be diffucult to undo some of the damage that has been caused.
Proceed at your own risk.
On that note let's begin.
===================
See if this will run:
Download ComboFix from Here or Here to your Desktop.
To run it type in this at the command prompt. -> "%userprofile%\desktop\ComboFix.exe" quotes included.

follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

In case you have used Combofix before, please delete the version you are having and redownload it again, because Combofix is being updated everyday.

In case your Antivirus or any other realtime scanner is displaying an alert after you downloaded Combofix or while you use Combofix, please disable your scanner and redownload Combofix again. Because some scanners may see some combofix related components as suspicious and block or delete them while there's nothing wrong with them.

#17
marcw

Posted 13 October 2007 - 09:47 PM

Member

Topic Starter
Member
101 posts

ComboFix 07-10-12.4 - jonathan levene 10/13/2007 23:31:36.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.298 [GMT -4:00]
Running from: C:\Documents and Settings\jonathan levene\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\3721
C:\Program Files\3721\assist\asbar.dll
C:\Program Files\3721\helper.dll
C:\Program Files\Accoona
C:\Program Files\Accoona\ASearchAssist.dll
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\guid.dat
C:\Program Files\amsys\ijl15.dll
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\Common Files\{3CDF9~1
C:\Program Files\Common Files\{3CDF9~1\toolbardll.lzma
C:\Program Files\Common Files\{DCDF9~1
C:\Program Files\Common Files\{DCDF9~1\system.dll
C:\Program Files\Common Files\labutu.dll
C:\Program Files\Common Files\prokyjo.html
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\Internet Explorer\hope4444.dll
C:\Program Files\Internet Explorer\hope83122.dll
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
C:\Program Files\network monitor
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\Program Files\SoftPortal
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part02.rar
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part03.rar
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part04.rar
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part05.rar
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part06.rar
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part07.rar
C:\Program Files\SoftPortal\Soft\ATGE\ATGE.part08.rar
C:\Program Files\SoftPortal\Soft\ATGE\info.txt
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part01.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part02.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part03.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part04.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part05.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part06.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part07.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part08.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\ATHtBt.part09.rar
C:\Program Files\SoftPortal\Soft\ATHtBt\info.txt
C:\Program Files\SoftPortal\Soft\ATHtBt\ui.uim
C:\Program Files\SoftPortal\Soft\Auswise\ui.uim
C:\Program Files\SoftPortal\Soft\LuxorEn\info.txt
C:\Program Files\SoftPortal\Soft\RTNKa\ui.uim
C:\Program Files\SoftPortal\Soft\XBS\info.txt
C:\Program Files\SoftPortal\Soft\XBS\ui.uim
C:\Program Files\SoftPortal\Soft\XBS\XBS.exe
C:\Program Files\SoftPortal\Soft\XBS\XBS.part001.rar
C:\Program Files\SoftPortal\Soft\XBS\XBS.part002.rar
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINNT\764.exe
C:\WINNT\7search.dll
C:\WINNT\aconti.exe
C:\WINNT\adbar.dll
C:\WINNT\am9uYXRoYW4gbGV2ZW5l\asappsrv.dll
C:\WINNT\avp.exe
C:\WINNT\b122.exe
C:\WINNT\Casino.ico
C:\WINNT\cbinst$.exe
C:\WINNT\curity~1
C:\WINNT\curity~1\??curity\
C:\WINNT\daxtime.dll
C:\WINNT\Downloaded Program Files.\xpreload.ocx
C:\WINNT\dp0.dll
C:\WINNT\eventlowg.dll
C:\WINNT\fhfmm-Uninstaller.exe
C:\WINNT\fhfmm.exe
C:\WINNT\flt.dll
C:\WINNT\Free Online Dating.ico
C:\WINNT\hcwprn.exe
C:\WINNT\hotporn.exe
C:\WINNT\ie_32.exe
C:\WINNT\iexplorr23.dll
C:\WINNT\jd2002.dll
C:\WINNT\kkcomp$.exe
C:\WINNT\kkcomp.dll
C:\WINNT\kkcomp.exe
C:\WINNT\kvnab$.exe
C:\WINNT\kvnab.dll
C:\WINNT\kvnab.exe
C:\WINNT\liqad$.exe
C:\WINNT\liqad.dll
C:\WINNT\liqad.exe
C:\WINNT\liqui-Uninstaller.exe
C:\WINNT\liqui.dll
C:\WINNT\liqui.exe
C:\WINNT\mgrs.exe
C:\WINNT\ngd.dll
C:\WINNT\pbar.dll
C:\WINNT\pbsysie.dll
C:\WINNT\settn.dll
C:\WINNT\spredirect.dll
C:\WINNT\Spyware Remover.ico
C:\WINNT\system32\__c00A268C.dat
C:\WINNT\system32\atmtd.dll
C:\WINNT\system32\atmtd.dll._
C:\WINNT\system32\awtsp.dll
C:\WINNT\system32\dcbabaceacdafcdb.dll
C:\WINNT\system32\drivers\4_stars.gif
C:\WINNT\system32\drivers\5_stars.gif
C:\WINNT\system32\drivers\alert_icon.gif
C:\WINNT\system32\drivers\arrow.gif
C:\WINNT\system32\drivers\buy_btn.gif
C:\WINNT\system32\drivers\close_icon.gif
C:\WINNT\system32\drivers\detect.htm
C:\WINNT\system32\drivers\download_btn.gif
C:\WINNT\system32\drivers\features.gif
C:\WINNT\system32\drivers\header_bg.gif
C:\WINNT\system32\drivers\icon_warning.gif
C:\WINNT\system32\drivers\logo_bg.gif
C:\WINNT\system32\drivers\perfect_cleaner_box.jpg
C:\WINNT\system32\drivers\protect.gif
C:\WINNT\system32\drivers\pt.htm
C:\WINNT\system32\drivers\s_detect.htm
C:\WINNT\system32\drivers\secuity_center_logo.gif
C:\WINNT\system32\drivers\spy_away_box.jpg
C:\WINNT\system32\drivers\spy_away_box_small.jpg
C:\WINNT\system32\drivers\spy_away_header.gif
C:\WINNT\system32\drivers\users_rating.gif
C:\WINNT\system32\drivers\v.gif
C:\WINNT\system32\drivers\x.gif
C:\WINNT\system32\ESHOPEE.exe
C:\WINNT\system32\gln.dll
C:\WINNT\system32\gtv_sd.bin
C:\WINNT\system32\iwcwcnd.dll
C:\WINNT\system32\khfghig.dll
C:\WINNT\system32\msole32.exe
C:\WINNT\system32\nnnmjki.dll
C:\WINNT\system32\pmnlkkj.dll
C:\WINNT\system32\rtnka.dat
C:\WINNT\system32\rtnka.dll
C:\WINNT\system32\SoUI.dll
C:\WINNT\system32\ssqpo.dll
C:\WINNT\system32\vxddsk.exe
C:\WINNT\system32\wml.exe
C:\WINNT\system32\wsnpoem
C:\WINNT\system32\wsnpoem\audio.dll
C:\WINNT\system32\wsnpoem\video.dll
C:\WINNT\system32\wsnpoem\video.dll.cla
C:\WINNT\tk58.exe
C:\WINNT\tsitra572.exe
C:\WINNT\TTC-4444.exe
C:\WINNT\uninstall_nmon.vbs
C:\WINNT\wbeCheck.exe
C:\WINNT\wbeInst$.exe
C:\WINNT\xadbrk.dll
C:\WINNT\xadbrk.exe
C:\WINNT\xadbrk_.exe
C:\WINNT\xxxvideo.exe
C:\xcrashdump.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CMDSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\Network Monitor
-------\nm

((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 )))))))))))))))))))))))))))))))
.

2007-10-13 23:30 51,200 --a------ C:\WINNT\NirCmd.exe
2007-10-13 23:04 22 --a------ C:\WINNT\filelist.dat
2007-10-13 22:39 <DIR> d-------- C:\WINNT\Cookies
2007-10-13 22:12 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Netscape
2007-10-13 20:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
2007-10-12 17:16 9,728 --a------ C:\Program Files\hlpsrv.exe
2007-10-12 14:43 1,596,416 --a------ C:\WINNT\SYSTEM32\HtBt.dll
2007-10-12 14:32 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-12 14:23 4 --a------ C:\WINNT\SYSTEM32\stfv.bin
2007-10-12 14:17 <DIR> d-------- C:\WINNT\SYSTEM32\acespy
2007-10-12 14:17 11,520 --a------ C:\WINNT\SYSTEM32\ace16win.dll
2007-10-12 13:57 21,504 --a------ C:\WINNT\SYSTEM32\qiawpbjj.dll
2007-10-12 13:55 76,800 --a------ C:\WINNT\SYSTEM32\unrar.dll
2007-10-12 13:53 75,339 --a------ C:\Documents and Settings\jonathan levene\ie_update3r.exe
2007-10-12 13:25 <DIR> d-------- C:\Program Files\Temporary
2007-10-12 13:22 35,840 --a------ C:\WINNT\tsitra1000106.exe
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\vMW02a
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\que1
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\kat1
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\ipd2
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\hap1
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\comms2
2007-10-12 13:21 <DIR> d--hs---- C:\WINNT\am9uYXRoYW4gbGV2ZW5l
2007-10-12 13:21 <DIR> d-------- C:\Temp\xOe
2007-10-12 13:21 <DIR> d-------- C:\Documents and Settings\Default User\Application Data\NetMon
2007-10-12 13:21 <DIR> d-------- C:\Documents and Settings\Default User\Application Data\NetMon
2007-10-03 13:11 <DIR> d-------- C:\Documents and Settings\jonathan levene\Application Data\Viewpoint
2007-09-16 13:34 <DIR> d-------- C:\Program Files\Snood

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-14 02:27 --------- d-----w C:\Program Files\PC Tools AntiVirus
2007-10-14 01:31 246 ----a-w C:\Program Files\Common Files\labutu
2007-10-14 00:58 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Upromise__RemindU
2007-10-14 00:56 --------- d-----w C:\Documents and Settings\jonathan levene\Application Data\Upromise__RemindU
2007-10-12 17:56 841 ----a-w C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif
2007-10-12 17:56 579 ----a-w C:\WINNT\system32\drivers\spy_away_header_small.gif
2007-10-12 17:56 4,557 ----a-w C:\WINNT\system32\drivers\perfect_cleaner_box_small.jpg
2007-10-12 17:56 1,804 ----a-w C:\WINNT\system32\drivers\perfect_cleaner_header.gif
2007-10-12 15:43 --------- d-----w C:\Program Files\MSN Messenger
2007-10-03 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-09-16 17:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-08-31 22:59 430,296 ----a-w C:\WINNT\SYSTEM32\rtcrtp.dll
2007-08-31 22:59 1,011,928 ----a-w C:\WINNT\SYSTEM32\rtclib.dll
2005-12-19 16:34 630,784 ----a-w C:\Documents and Settings\jonathan levene\chatlnk.exe
2004-10-31 18:18 192 ----a-w C:\Program Files\1NB4I5N3.bat
2000-12-20 14:55 524,288 ----a-w C:\Program Files\HitmanSp1a.exe
2000-12-19 20:07 2,193,652 ----a-w C:\Program Files\HitmanSP1a.zip
2000-09-01 01:06 271 ---ha-w C:\Program Files\DESKTOP.INI
2000-09-01 01:06 21,952 ---ha-w C:\Program Files\FOLDER.HTT
2000-07-26 18:00 32,528 ----a-w C:\WINNT\INF\WBFIRDMA.SYS
2005-07-29 20:24:26 472 --sha-r C:\WINNT\am9uYXRoYW4gbGV2ZW5l\uA6RsrlCsqb0v3pZtqc5.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{026B5895-3E8E-49A9-8EEE-B52A326DA962}]
07-10-12 13:57 21504 --a------ C:\WINNT\System32\qiawpbjj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [00-07-26 14:00 C:\WINNT\SYSTEM32\MOBSYNC.EXE]
"SoundFusion"="cwcprops.cpl" [00-03-23 18:44 C:\WINNT\SYSTEM32\cwcprops.cpl]
"TCASUTIEXE"="TCAUDIAG -off" []
"Adaptec DirectCD"="C:\PROGRA~1\Adaptec\DirectCD\directcd.exe" [00-06-29 05:01 ]
"HPAIO_PrintFolderMgr"="C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe" []
"QuickTime Task"="C:\WINNT\System32\qttask.exe" []
"LoadQM"="loadqm.exe" [00-05-03 18:23 C:\WINNT\loadqm.exe]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [02-04-26 13:53 ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04-08-30 17:10 ]
"uprom"="C:\Program Files\Upromise__RemindU\UpromiseRemindUv.exe" [07-05-22 13:49 ]
"Matrox Powerdesk"="C:\WINNT\System32\PDesk\PDesk.exe" [06-03-02 11:32 ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [06-11-09 16:07 ]
"Logitech Utility"="Logi_MwX.Exe" [03-12-17 09:50 C:\WINNT\LOGI_MWX.EXE]
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [07-01-02 09:17 ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="C:\Program Files\Netscape\Netscape\Netscp.exe" [03-06-24 12:09 ]
"RMC"="C:\Program Files\Reuters\RMC\RunRM.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\msrr.exe" [05-06-14 10:05 ]
"ProxyWay"="C:\Program Files\ProxyWay\proxyway.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - C:\DELL\discfix.cmd [2001-03-23 15:36:24]

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - C:\DELL\discfix.cmd [2001-03-23 15:36:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
HPAiODevice.lnk - C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe [2001-05-09 10:24:59]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 04:15:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A268C]
C:\WINNT\System32\__c00A268C.dat

R0 aaatimeo;aaatimeo;C:\WINNT\System32\DRIVERS\aaatimeo.sys
R0 fasttrak;fasttrak;C:\WINNT\System32\DRIVERS\fasttrak.sys
R0 Fd16_700;Fd16_700;C:\WINNT\System32\DRIVERS\fd16_700.sys
R0 PowerSwitch;PowerSwitch;C:\WINNT\System32\drivers\psdvr.sys
R1 Cdudf;Cdudf;C:\WINNT\System32\drivers\Cdudf.sys
R1 pwd_2K;pwd_2K;C:\WINNT\System32\drivers\pwd_2K.sys
R1 UdfReadr;UdfReadr;C:\WINNT\System32\drivers\UdfReadr.sys
R2 3ComDMIService;3Com DMI Agent;C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
R2 AutoShutdown;AutoShutdown;C:\WINNT\System32\PSSVC.EXE
R2 BCAITDI;3Com BCAITDI DMI TDI;C:\WINNT\System32\DRIVERS\BCAItdi.sys
R2 tcaicchg;tcaicchg;\??\C:\WINNT\System32\tcaicchg.sys
R2 TCAITDI;TCAITDI Protocol;C:\WINNT\System32\DRIVERS\TCAITDI.sys
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;C:\WINNT\System32\DRIVERS\el90xbc5.sys
R3 G400DH;G400DH;C:\WINNT\System32\DRIVERS\g400dhm.sys
R3 mmc_2K;mmc_2K;C:\WINNT\System32\drivers\mmc_2K.sys
R3 Winacpci;Winacpci;C:\WINNT\System32\DRIVERS\winacpci.sys
S0 cda1000;cda1000;C:\WINNT\System32\DRIVERS\cda1000.sys
S3 hpoid407;IEEE-1284.4 Driver;C:\WINNT\System32\DRIVERS\hpoid407.sys
S3 mgabg;mgabg;\??\C:\WINNT\system32\drivers\mgabg.sys

*Newly Created Service* - IPNAT
*Newly Created Service* - RASAUTO
*Newly Created Service* - SHAREDACCESS
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-13 23:35:48
Windows 5.0.2195 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-13 23:36:16 - machine was rebooted
.

#18
marcw

Posted 13 October 2007 - 09:48 PM

Member

Topic Starter
Member
101 posts

istill can't run hijackthis

#19
marcw

Posted 13 October 2007 - 09:58 PM

Member

Topic Starter
Member
101 posts

should i try to uninstall explorer?

#20
kahdah

Posted 13 October 2007 - 10:06 PM

GeekU Teacher

Retired Staff
15,822 posts

It is okay about Hijackthis for now.

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINNT\SYSTEM32\ace16win.dll
C:\WINNT\SYSTEM32\qiawpbjj.dll
C:\Documents and Settings\jonathan levene\ie_update3r.exe
C:\WINNT\tsitra1000106.exe
C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif
C:\WINNT\system32\drivers\spy_away_header_small.gif
C:\WINNT\system32\drivers\perfect_cleaner_header.gif
C:\Program Files\1NB4I5N3.bat

Folder::
C:\WINNT\SYSTEM32\acespy
C:\Program Files\Temporary
C:\WINNT\SYSTEM32\vMW02a
C:\WINNT\am9uYXRoYW4gbGV2ZW5l
C:\Temp\xOe
C:\Documents and Settings\All Users\Application Data\Viewpoint

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A268C]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

Combofix.txt .

#21
marcw

Posted 13 October 2007 - 10:32 PM

Member

Topic Starter
Member
101 posts

File::
C:\WINNT\SYSTEM32\ace16win.dll
C:\WINNT\SYSTEM32\qiawpbjj.dll
C:\Documents and Settings\jonathan levene\ie_update3r.exe
C:\WINNT\tsitra1000106.exe
C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif
C:\WINNT\system32\drivers\spy_away_header_small.gif
C:\WINNT\system32\drivers\perfect_cleaner_header.gif
C:\Program Files\1NB4I5N3.bat

Folder::
C:\WINNT\SYSTEM32\acespy
C:\Program Files\Temporary
C:\WINNT\SYSTEM32\vMW02a
C:\WINNT\am9uYXRoYW4gbGV2ZW5l
C:\Temp\xOe
C:\Documents and Settings\All Users\Application Data\Viewpoint

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A268C]

#22
marcw

Posted 13 October 2007 - 10:33 PM

Member

Topic Starter
Member
101 posts

#23
marcw

Posted 13 October 2007 - 10:35 PM

Member

Topic Starter
Member
101 posts

The first one was cfsript.txt...10-14-2007 the second was combofix2

#24
kahdah

Posted 13 October 2007 - 10:41 PM

GeekU Teacher

Retired Staff
15,822 posts

I didnt need the cf script I posted that for you to drag and drop into combofix.
Please redo the steps those files need to be deleted before we can move on.

Make sure to drag the cf script into combofix this will make it run and delete those files.

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINNT\SYSTEM32\ace16win.dll
C:\WINNT\SYSTEM32\qiawpbjj.dll
C:\Documents and Settings\jonathan levene\ie_update3r.exe
C:\WINNT\tsitra1000106.exe
C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif
C:\WINNT\system32\drivers\spy_away_header_small.gif
C:\WINNT\system32\drivers\perfect_cleaner_header.gif
C:\Program Files\1NB4I5N3.bat

Folder::
C:\WINNT\SYSTEM32\acespy
C:\Program Files\Temporary
C:\WINNT\SYSTEM32\vMW02a
C:\WINNT\am9uYXRoYW4gbGV2ZW5l
C:\Temp\xOe
C:\Documents and Settings\All Users\Application Data\Viewpoint

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00A268C]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt .

Make sure to post the log that Combofix gives you this time it will popup after running it.

#25
marcw

Posted 13 October 2007 - 11:06 PM

Member

Topic Starter
Member
101 posts

ComboFix 07-10-12.4 - jonathan levene 10/14/2007 0:58:28.3 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.2.1252.1.1033.18.292 [GMT -4:00]
Running from: C:\Documents and Settings\jonathan levene\DESKTOP\ComboFix.exe
Command switches used :: C:\CFScript.txt.txt

FILE::
C:\Documents and Settings\jonathan levene\ie_update3r.exe
C:\Program Files\1NB4I5N3.bat
C:\WINNT\SYSTEM32\ace16win.dll
C:\WINNT\system32\drivers\perfect_cleaner_header.gif
C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif
C:\WINNT\system32\drivers\spy_away_header_small.gif
C:\WINNT\SYSTEM32\qiawpbjj.dll
C:\WINNT\tsitra1000106.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\system32\gtv_sd.bin
C:\WINNT\SYSTEM32\qiawpbjj.dll

.
((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 )))))))))))))))))))))))))))))))
.

2007-10-13 23:30 51,200 --a------ C:\WINNT\NirCmd.exe
2007-10-13 23:04 22 --a------ C:\WINNT\filelist.dat
2007-10-13 22:39 <DIR> d-------- C:\WINNT\Cookies
2007-10-13 22:12 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Netscape
2007-10-13 20:57 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
2007-10-12 17:16 9,728 --a------ C:\Program Files\hlpsrv.exe
2007-10-12 14:43 1,596,416 --a------ C:\WINNT\SYSTEM32\HtBt.dll
2007-10-12 14:32 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-12 14:23 4 --a------ C:\WINNT\SYSTEM32\stfv.bin
2007-10-12 13:55 76,800 --a------ C:\WINNT\SYSTEM32\unrar.dll
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\que1
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\kat1
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\ipd2
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\hap1
2007-10-12 13:21 <DIR> d-------- C:\WINNT\SYSTEM32\comms2
2007-10-12 13:21 <DIR> d-------- C:\Documents and Settings\Default User\Application Data\NetMon
2007-10-12 13:21 <DIR> d-------- C:\Documents and Settings\Default User\Application Data\NetMon
2007-10-03 13:11 <DIR> d-------- C:\Documents and Settings\jonathan levene\Application Data\Viewpoint
2007-09-16 13:34 <DIR> d-------- C:\Program Files\Snood

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-14 04:53 --------- d-----w C:\Documents and Settings\jonathan levene\Application Data\Upromise__RemindU
2007-10-14 04:52 --------- d-----w C:\Program Files\PC Tools AntiVirus
2007-10-14 04:29 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Upromise__RemindU
2007-10-14 01:31 246 ----a-w C:\Program Files\Common Files\labutu
2007-10-12 17:56 4,557 ----a-w C:\WINNT\system32\drivers\perfect_cleaner_box_small.jpg
2007-10-12 15:43 --------- d-----w C:\Program Files\MSN Messenger
2007-09-16 17:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2005-12-19 16:34 630,784 ----a-w C:\Documents and Settings\jonathan levene\chatlnk.exe
2000-12-20 14:55 524,288 ----a-w C:\Program Files\HitmanSp1a.exe
2000-12-19 20:07 2,193,652 ----a-w C:\Program Files\HitmanSP1a.zip
2000-09-01 01:06 271 ---ha-w C:\Program Files\DESKTOP.INI
2000-09-01 01:06 21,952 ---ha-w C:\Program Files\FOLDER.HTT
2000-07-26 18:00 32,528 ----a-w C:\WINNT\INF\WBFIRDMA.SYS
.

((((((((((((((((((((((((((((( snapshot@Sat 2007-10-13_23.35.54.81 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-07 20:38:46 500,120 ----a-w C:\WINNT\Downloaded Program Files\daas_s.dll
+ 2007-05-07 20:39:00 192,920 ----a-w C:\WINNT\Downloaded Program Files\fsauc.dll
+ 2007-05-07 20:39:24 254,360 ----a-w C:\WINNT\Downloaded Program Files\fscax.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [00-07-26 14:00 C:\WINNT\SYSTEM32\MOBSYNC.EXE]
"SoundFusion"="cwcprops.cpl" [00-03-23 18:44 C:\WINNT\SYSTEM32\cwcprops.cpl]
"TCASUTIEXE"="TCAUDIAG -off" []
"Adaptec DirectCD"="C:\PROGRA~1\Adaptec\DirectCD\directcd.exe" [00-06-29 05:01 ]
"HPAIO_PrintFolderMgr"="C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe" []
"QuickTime Task"="C:\WINNT\System32\qttask.exe" []
"LoadQM"="loadqm.exe" [00-05-03 18:23 C:\WINNT\loadqm.exe]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [02-04-26 13:53 ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04-08-30 17:10 ]
"uprom"="C:\Program Files\Upromise__RemindU\UpromiseRemindUv.exe" [07-05-22 13:49 ]
"Matrox Powerdesk"="C:\WINNT\System32\PDesk\PDesk.exe" [06-03-02 11:32 ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [06-11-09 16:07 ]
"Logitech Utility"="Logi_MwX.Exe" [03-12-17 09:50 C:\WINNT\LOGI_MWX.EXE]
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [07-01-02 09:17 ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="C:\Program Files\Netscape\Netscape\Netscp.exe" [03-06-24 12:09 ]
"RMC"="C:\Program Files\Reuters\RMC\RunRM.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\msrr.exe" [05-06-14 10:05 ]
"ProxyWay"="C:\Program Files\ProxyWay\proxyway.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - C:\DELL\discfix.cmd [2001-03-23 15:36:24]

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
discfix.lnk - C:\DELL\discfix.cmd [2001-03-23 15:36:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
HPAiODevice.lnk - C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe [2001-05-09 10:24:59]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 04:15:54]

R0 aaatimeo;aaatimeo;C:\WINNT\System32\DRIVERS\aaatimeo.sys
R0 fasttrak;fasttrak;C:\WINNT\System32\DRIVERS\fasttrak.sys
R0 Fd16_700;Fd16_700;C:\WINNT\System32\DRIVERS\fd16_700.sys
R0 PowerSwitch;PowerSwitch;C:\WINNT\System32\drivers\psdvr.sys
R1 Cdudf;Cdudf;C:\WINNT\System32\drivers\Cdudf.sys
R1 pwd_2K;pwd_2K;C:\WINNT\System32\drivers\pwd_2K.sys
R1 UdfReadr;UdfReadr;C:\WINNT\System32\drivers\UdfReadr.sys
R2 3ComDMIService;3Com DMI Agent;C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
R2 AutoShutdown;AutoShutdown;C:\WINNT\System32\PSSVC.EXE
R2 BCAITDI;3Com BCAITDI DMI TDI;C:\WINNT\System32\DRIVERS\BCAItdi.sys
R2 tcaicchg;tcaicchg;\??\C:\WINNT\System32\tcaicchg.sys
R2 TCAITDI;TCAITDI Protocol;C:\WINNT\System32\DRIVERS\TCAITDI.sys
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;C:\WINNT\System32\DRIVERS\el90xbc5.sys
R3 G400DH;G400DH;C:\WINNT\System32\DRIVERS\g400dhm.sys
R3 mmc_2K;mmc_2K;C:\WINNT\System32\drivers\mmc_2K.sys
R3 Winacpci;Winacpci;C:\WINNT\System32\DRIVERS\winacpci.sys
S0 cda1000;cda1000;C:\WINNT\System32\DRIVERS\cda1000.sys
S3 hpoid407;IEEE-1284.4 Driver;C:\WINNT\System32\DRIVERS\hpoid407.sys
S3 mgabg;mgabg;\??\C:\WINNT\system32\drivers\mgabg.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-10-14 04:23:41 C:\WINNT\Tasks\At1.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-14 01:01:21
Windows 5.0.2195 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-14 1:01:48 - machine was rebooted
.
--- E O F ---

#26
marcw

Posted 13 October 2007 - 11:07 PM

Member

Topic Starter
Member
101 posts

also I can now open an explorer window

#27
marcw

Posted 13 October 2007 - 11:10 PM

Member

Topic Starter
Member
101 posts

finally manged to run hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:09:20 AM, on 10/14/2007
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\WINNT\System32\PSSVC.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mgabg.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\WINNT\loadqm.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Upromise__RemindU\UpromiseRemindUv.exe
C:\WINNT\System32\PDesk\PDesk.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\PC Tools AntiVirus\PCTAV.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\HEWLET~1\HPOFFI~1\bin\hpoevm07.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Upromise__RemindU\up.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\WINNT\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://dailynews.yahoo.com
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundFusion] RunDll32 cwcprops.cpl,CrystalControlWnd
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [uprom] "C:\Program Files\Upromise__RemindU\UpromiseRemindUv.exe"
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\Run: [RMC] "C:\Program Files\Reuters\RMC\\RunRM.exe"
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - .DEFAULT Startup: discfix.lnk = C:\DELL\discfix.cmd (User 'Default user')
O4 - .DEFAULT User Startup: discfix.lnk = C:\DELL\discfix.cmd (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: RemindU - file://C:\Documents and Settings\Administrator\Application Data\Upromise__RemindU\uprot\uproC5.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: RemindU - {B48798CE-A2E0-4918-BC00-0F72FBA708E2} - file://C:\Documents and Settings\Administrator\Application Data\Upromise__RemindU\uprot\uproC5.htm (HKCU)
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-sec...m/ols/fscax.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxrnet.net/c...::/xpreload.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,26/mcgdmgr.cab
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: AutoShutdown - Dell Computer Corporation - C:\WINNT\System32\PSSVC.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\System32\mgabg.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe

--
End of file - 7429 bytes

#28
marcw

Posted 14 October 2007 - 03:37 AM

Member

Topic Starter
Member
101 posts

right now the only problem seems to be that something is currupting explorer and causes it to use all available resources, forcing t to shut down and restart, and its an unending cycle

#29
kahdah

Posted 14 October 2007 - 06:13 AM

GeekU Teacher

Retired Staff
15,822 posts

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
===============================================================
Please download SUPERAntiSpyware Home Edition (free version).
–Install it and double-click the icon on your desktop to run it.

It will ask if you want to update the program definitions, click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:
Close browsers before scanning
Scan for tracking cookies
Scan for Alternate Data streams
Terminate memory threats before quarantining.
Please leave the others unchecked.
Click the Close button to leave the control center screen.

=============================================
After that please re-open Hijackthis and place a check mark next to these entries listed below:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)
O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file)
O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file)
O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file)
O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file)
O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file)
O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file)
O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file)
O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file)
O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file)
O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)

Now click on Fix checked and then close Hijackthis.
======================================
After that Please download the OTMoveIt by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINNT\SYSTEM32\acespy
C:\Program Files\Temporary
C:\WINNT\SYSTEM32\vMW02a
C:\WINNT\am9uYXRoYW4gbGV2ZW5l
C:\Temp\xOe
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\WINNT\SYSTEM32\ace16win.dll
C:\Documents and Settings\jonathan levene\ie_update3r.exe
C:\Program Files\1NB4I5N3.bat
C:\WINNT\system32\drivers\perfect_cleaner_header.gif
C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif
C:\WINNT\system32\drivers\spy_away_header_small.gif
C:\WINNT\tsitra1000106.exe
C:\WINNT\system32\drivers\perfect_cleaner_box_small.jpg
Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Click "Exit" to close OTMoveIt.

**When ready to Reply on the forum, please Paste the content of the latest log which is located at the root of the drive where the OTMoveIt folder is:
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
=====================================
*Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

Then run Superantispyware.

Double click on the icon to start Superantispyware.
On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.

1. To retrieve the removal information for me please do the following:
2. After reboot, double-click the SUPERAntispyware icon on your desktop.
3. Click Preferences. Click the Statistics/Logs tab.
4. Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
5. It will open in your default text editor (such as Notepad/Wordpad).
6. Please highlight everything in the notepad, then right-click and choose copy.
7. Click close and close again to exit the program.
Save the log information. If needed (still infected) paste this info along with your HijackThis log.
================================================================
Please post back with these logs:
New Hijackthis
Superantispyware log
OTMoveit log

#30
marcw

Posted 14 October 2007 - 09:07 AM

Member

Topic Starter
Member
101 posts

when i do hijackthis is it ok if i fix just one at a time. i just don't think its humanly possible to click all of them and run hijack before explorer sucks up all the cpu and frces hijack to shut down