Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Help Me Fix? My HiJackThis is Here

Started by sandman423 , Aug 09 2008 05:15 PM

  • This topic is locked This topic is locked

#1
sandman423
Posted 09 August 2008 - 05:15 PM

sandman423

    Member

  • Member
  • PipPip
  • 19 posts
I got a bad infection I believe due to my brother...

I have no System Restore Points and I am constantly Freezing online...I Ran VundoFix and VirtumundoBeGone.exe

So I ran Vundo Fix and It can't remove this...VirtumundoBeGone.exe and VundoFix.exe..Nothing is Working I ran Malware Bytes, Spybot, Vundofix, and still nothing...Still giving issues please help me fix this issue.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:12:04 PM, on 8/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: {9d53a554-e31e-b749-1564-fd2a463a3ab0} - {0ba3a364-a2df-4651-947b-e13e455a35d9} - C:\WINDOWS\system32\tpirqn.dll (file missing)
O2 - BHO: (no name) - {0EA0BBB3-AFD2-4035-B2B4-D2B70EA564DB} - C:\WINDOWS\system32\jkkLFxyX.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A651AD5D-66EF-440A-B6A1-BD5C36D234D6} - C:\WINDOWS\system32\rqRLDurr.dll (file missing)
O2 - BHO: (no name) - {E525B124-28E1-4D57-B784-B2AABFBBFA66} - C:\WINDOWS\system32\hgGxUoom.dll (file missing)
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RAMBoosterPro] "C:\Program Files\RAM Booster Pro\RAMBoosterPro.exe" auto
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [9831db6c] rundll32.exe "C:\WINDOWS\system32\vsquulgn.dll",b
O4 - HKLM\..\Run: [BM9b02e8f0] Rundll32.exe "C:\WINDOWS\system32\xkuqpwbh.dll",s
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA3605] command /c del "C:\WINDOWS\system32\28463\JRDE.001"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4429] cmd /c del "C:\WINDOWS\system32\28463\JRDE.001"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2060] command /c del "C:\WINDOWS\system32\28463\JRDE.002"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6995] cmd /c del "C:\WINDOWS\system32\28463\JRDE.002"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5310] command /c del "C:\WINDOWS\system32\28463\JRDE.005"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3732] cmd /c del "C:\WINDOWS\system32\28463\JRDE.005"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4564] command /c del "C:\WINDOWS\system32\28463\JRDE.006"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9797] cmd /c del "C:\WINDOWS\system32\28463\JRDE.006"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3929] command /c del "C:\WINDOWS\system32\28463\JRDE.007"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3232] cmd /c del "C:\WINDOWS\system32\28463\JRDE.007"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3366] command /c del "C:\WINDOWS\system32\28463\JRDE.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2823] cmd /c del "C:\WINDOWS\system32\28463\JRDE.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2251] command /c del "C:\WINDOWS\system32\xkuqpwbh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7494] cmd /c del "C:\WINDOWS\system32\xkuqpwbh.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8447] command /c del "C:\WINDOWS\system32\28463\JRDE.001"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7] cmd /c del "C:\WINDOWS\system32\28463\JRDE.001"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5711] command /c del "C:\WINDOWS\system32\28463\JRDE.002"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8115] cmd /c del "C:\WINDOWS\system32\28463\JRDE.002"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5392] command /c del "C:\WINDOWS\system32\28463\JRDE.005"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4225] cmd /c del "C:\WINDOWS\system32\28463\JRDE.005"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6052] command /c del "C:\WINDOWS\system32\28463\JRDE.006"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2487] cmd /c del "C:\WINDOWS\system32\28463\JRDE.006"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2258] command /c del "C:\WINDOWS\system32\28463\JRDE.007"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1679] cmd /c del "C:\WINDOWS\system32\28463\JRDE.007"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6899] command /c del "C:\WINDOWS\system32\28463\JRDE.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4569] cmd /c del "C:\WINDOWS\system32\28463\JRDE.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5911] command /c del "C:\WINDOWS\system32\xkuqpwbh.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4402] cmd /c del "C:\WINDOWS\system32\xkuqpwbh.dll_old"
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1194639717687
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.on...e/en/crlocx.ocx
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Windows CardSpace (idsvc) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 10408 bytes



Please help me fix this VundoFix isn't letting me remove it in Safe Mode or Normal Mode.

Please do not double post.

Your original post is here.

Topic Closed.

Edited by Octagonal, 10 August 2008 - 05:41 AM.

  • 0

Advertisements

Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP