[ksavage]

Please help I have smitfraud. c virus and cant get ridd of it. Blue screen and computer seem like its kinda getting slower. I did everything you said before coming in to post topic and still same problem. Have read other people threads on how to get of this virus but stop real quickly. About the Third instuction on the one I read stated press CTRL ALT DELETE and click on the processes tab, well dont have that tab so I stop. Did read in one topic that the person stated he was going to throw his computer to the street I bet I can throw mine further. Thanks for any assistance you help me with.



Logfile of HijackThis v1.99.1
Scan saved at 11:57:44 PM, on 05/04/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE
C:\WP.EXE
C:\QUICKENW\QWDLLS.EXE
C:\PROGRAM FILES\INTUIT\QUICKBOOKS PREMIER - ACCOUNTANT EDITION\COMPONENTS\QBAGENT\QBDAGENT2002.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/...//www.yahoo.com
O2 - BHO: YBIOCtrl Class - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: (no name) - {702117A0-736F-11D7-9207-000102298083} - (no file)
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.EXE -off
O4 - HKLM\..\Run: [SourcePath] c:\cabs\gwreg.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [Mskexe] c:\program files\mcafee\spamkiller\spamkiller.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [hahatyt] C:\WINDOWS\hahatyt.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE /0
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
O4 - Startup: Microsoft Office.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{911A0409-6000-11D3-8CFE-0050048383C9}\misc.exe
O4 - Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Premier - Accountant Edition\Components\QBAgent\QBDAgent2002.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)
O12 - Plugin for .quake2: C:\PROGRA~1\INTERN~1\PLUGINS\npq2plug.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://www.wildtange...ybad/wtinst.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.co...76/mcinsctl.cab
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.co...22/ComCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcaf...ed/MGBrwFld.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1) -
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} (FVLiteLoad Class) - http://flipbrowser.c...ite/fvliteY.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzill...ller/dwnldr.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.co...,16/mcgdmgr.cab
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://content.ances...ll/MFImgVwr.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/potc_x.cab
O16 - DPF: Yahoo! Blackjack - http://download.game...nts/y/jt0_x.cab
O16 - DPF: JT's Blocks - http://download.game...ts/y/blt1_x.cab
O16 - DPF: {59D04288-805E-4D43-BE09-83B1083E9E1E} (IUpdateAutoLaunch Control) - http://idenphones.mo...eAutoLaunch.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab

[Advertisements]

Hi ksavage

Please read through the instructions before you start (you may want to print this out).

Download CWShredder (there is a link in my signature), unzip it, and save it on the Desktop. Please do not run it yet, though.
Run CWShredder to fix your CWS problem.

Please set your system to show all files; please see here if you're unsure how to do this.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
O3 - Toolbar: (no name) - {702117A0-736F-11D7-9207-000102298083} - (no file)
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [hahatyt] C:\WINDOWS\hahatyt.exe
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F6441660-BC16-11D9-9207-000102298083} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} (FVLiteLoad Class) - http://flipbrowser.c...ite/fvliteY.cab
Click on Fix Checked when finished and exit HijackThis.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\WP.EXE
C:\WINDOWS\hahatyt.exe
Exit Explorer.

If you were unable to find any of the files then please follow these additional instructions:
Download Pocket Killbox and unzip it; save it to your Desktop.
Run killbox and click the radio button that says Delete a file on reboot. For each of the files you could not delete, paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes. Let the system reboot.
C:\WP.EXE
C:\WINDOWS\hahatyt.exe

Reboot as normal.

Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp
Please post the logs From Panda virus scan and HJT.logWe will need them to remove previous infections that have left files on your system.

Kc

[ksavage]

Thanks Thatman,

For your time and knowledge. I did everything you told me and created a log for you with panda software but I could not figure a way to create a log for you with HJT so I wrote down the three things that HJT found and there path. Hope this will help you help me find a way to clean my computer.


Thanks.....Ksavage


HJT report:

JOKE CRAZYICONS. A NON-CLEANABLE
C:\windows\temp\crazyicons

TROJ DLOADER.KV
C:\windows\msxmidi.EXE

TROJ HIJACK.A
c:\recycled\dc8.EXE

PANDA LOG:
Incident Status Location

Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/MyWay No disinfected C:\WINDOWS\SYSTEM\Xcite.dll
Adware:Adware/nCase No disinfected C:\WINDOWS\SYSTEM\FLEOK
Adware:Adware/BrowserAid No disinfected C:\WINDOWS\SYSTEM\stlbupdt.dll
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\TEMP\SAHUpdate
Adware:Adware/Superbar No disinfected Windows Registry
Adware:Adware/SideSearch No disinfected C:\WINDOWS\Application Data\Lycos
Adware:Adware/MSView No disinfected C:\WINDOWS\TEMP\msview.inf
Spyware:Spyware/Altnet No disinfected C:\WINDOWS\TEMP\asmfiles.cab
Adware:Adware/SuperSpider No disinfected C:\WINDOWS\msxmidi.exe
Spyware:Spyware/Whazit No disinfected C:\WINDOWS\SYSTEM\kyf.dat
Adware:Adware/BlueScreenWarningNo disinfected Windows Registry
Possible Virus. No disinfected C:\WINDOWS\SYSTEM\wb.dll
Adware:Adware/Comet No disinfected C:\WINDOWS\SYSTEM\CometTB.dll
Adware:Adware/Comet No disinfected C:\WINDOWS\SYSTEM\CometTB.exe
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\SYSTEM\Agent.dll
Adware:Adware/MSView No disinfected C:\WINDOWS\SYSTEM\nostalgia.dll
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM\OMsetup.exe
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM\cm1.dll
Adware:Adware/BrowserAid No disinfected C:\WINDOWS\SYSTEM\stlbupdt.dll
Adware:Adware/nCase No disinfected C:\WINDOWS\SYSTEM\Xcite.exe
Adware:Adware/MyWay No disinfected C:\WINDOWS\SYSTEM\Xcite.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\msss.exe
Spyware:Spyware/Whazit No disinfected C:\WINDOWS\SYSTEM\kyf.dat
Adware:Adware/SaveNow No disinfected C:\WINDOWS\TEMP\saveinstwm.exe
Adware:Adware/MSView No disinfected C:\WINDOWS\TEMP\MSView.inf
Spyware:Spyware/Altnet No disinfected C:\WINDOWS\TEMP\asmfiles.cab
Spyware:Spyware/Altnet No disinfected C:\WINDOWS\TEMP\asmfiles.cab[asm.exe]
Spyware:Spyware/Altnet No disinfected C:\WINDOWS\TEMP\__unin__.exe
Adware:Adware/SuperSpider No disinfected C:\WINDOWS\msxmidi.exe
Adware:Adware/WinActive No disinfected C:\RECYCLED\DC1\unbzip2s.dll
Adware:Adware/BlueScreenWarningNo disinfected C:\RECYCLED\DC8.EXE
Adware:Adware/BlueScreenWarningNo disinfected C:\wp.bmp

[ksavage]

Thanks agian Wouldnt know what to do without the help of you and this site.

I think we are going in the right direction.
Nothing showed up on HJT.log and I will paste panda log for you .


Thanks again and my computer thanks u.
cident Status Location

Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/nCase No disinfected C:\WINDOWS\SYSTEM\FLEOK
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\TEMP\SAHUpdate
Adware:Adware/Superbar No disinfected Windows Registry
Adware:Adware/SideSearch No disinfected C:\WINDOWS\Application Data\Lycos
Adware:Adware/BlueScreenWarningNo disinfected Windows Registry

[ksavage]

Hey Thatman,


Ran panda and still have six things showing up but nothing on HJT.
Will paste panda log for you. System is running good am having a problem
starting up sometimes it locks up and I have to restart a couple of times.


Thanks agian.......Ksavage
Incident Status Location

Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/nCase No disinfected C:\WINDOWS\SYSTEM\FLEOK
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\TEMP\SAHUpdate
Adware:Adware/Superbar No disinfected Windows Registry
Adware:Adware/SideSearch No disinfected C:\WINDOWS\Application Data\Lycos
Adware:Adware/BlueScreenWarningNo disinfected Windows Registry

Edited by ksavage, 08 May 2005 - 10:15 PM.

[ksavage]

Hey agian,


Hope what im writing you make sense. Did a file find on pc for c:\windows\system\fleok. and c:\windows\application data\lycos cound not find either. But did find c:\windows\temp\sahupdate and I think its gone panda did not find it. Think I messed up on adware super bar going to retry removing it and running another panda scan will tell you on later post on that.Steve gould web site would not let me in under address you posted so I did find and found it under HTTP://cleanup.stevengould.org. It did clean some out about 88.2mb but im still having a bad boot problem takes me anywere from 3 to 9 times to get computer back up and running. It gets all the way to desk top and freezes shows me icon and all but mouse either wont move or if it does I cant click on anything. Have to manuely shut it down with the off button and turn it back on. Just a question do you think mcfee antivirse could be causeing this problem at startup. Hey one good thing im down to 5 viruses. Thanks for all your help.

dware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/nCase No disinfected C:\WINDOWS\SYSTEM\FLEOK
Adware:Adware/Superbar No disinfected Windows Registry
Adware:Adware/SideSearch No disinfected C:\WINDOWS\Application Data\Lycos
Adware:Adware/BlueScreenWarningNo disinfected Windows Registry

[ksavage]

Hey Thatman.


Did a couple of things right and got virus down to 1. Still having a boot problem.
but did run another panda check and heres the log. Still nothing on HJT.

Thanks agian..... Ksavage



Incident Status Location

Adware:Adware/SaveNow No disinfected Windows Registry

[ksavage]

Hey, Thatman


Didnt find anything under hkey_local_machine\software\microsoft\windows\currentversion\run

On activex couldnt find anything there in "downloaded program files".

Now on the bottom part of your post you listed different hives did you want me to
enter them into killbox and remove them? I did learn how to back up my registry.

Sorry for being so stupid just dont know alot about computers.


Thanks for the help!.... Ksavage