Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

trojan spy smitfraud [CLOSED]

Started by 17Roush , May 26 2005 04:57 PM

This topic is locked

#1
17Roush

Posted 26 May 2005 - 04:57 PM

Member

Member
11 posts

I have a blue desktop screen that says that I have trojanspy.smitfraud.

#2
greyknight17

Posted 26 May 2005 - 06:36 PM

Malware Expert

Visiting Consultant
16,560 posts

Welcome to GTG.

Read the first link in my signature below and follow the steps outlined there. When ready, post your HijackThis log here for review.

#3
17Roush

Posted 26 May 2005 - 07:15 PM

Member

Topic Starter
Member
11 posts

Thank you so much for helping me. Here is the log. -Jeff

Logfile of HijackThis v1.99.1
Scan saved at 8:12:19 PM, on 5/26/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SOINTGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ESOFT\EBOARD\EBOARD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\SDKLJ32.EXE
C:\PROGRAM FILES\REAL\REALJUKEBOX\TSYSTRAY.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\WP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\WINGP.EXE
C:\WINDOWS\SYSTEM\WINGP.EXE
C:\WINDOWS\SYSTEM\WINGP.EXE
C:\WINDOWS\APPVH.EXE
C:\PROGRAM FILES\AMERICA ONLINE 8.0\WAOL.EXE
C:\PROGRAM FILES\AMERICA ONLINE 8.0\SHELLMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\AMERICA ONLINE 8.0\AOLWBSPD.EXE
C:\PROGRAM FILES\AOL COMPANION\COMPANION.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\owrck.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.ne...ch?r=minisearch
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.netzero.net"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
O2 - BHO: Class - {F8205AB7-394C-C8D3-A452-ED6CBA5E5E8A} - C:\WINDOWS\SYSTEM\NTAM.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP5_1_2_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [eMachine eBoard] C:\PROGRA~1\ESOFT\EBOARD\eBoard.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SDKLJ32.EXE] C:\WINDOWS\SYSTEM\SDKLJ32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SO5 Integrator Pass One] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [CRJJ32.EXE] C:\WINDOWS\SYSTEM\CRJJ32.EXE /s
O4 - HKLM\..\RunServices: [NTYA.EXE] C:\WINDOWS\SYSTEM\NTYA.EXE /s
O4 - HKLM\..\RunServices: [MSWX.EXE] C:\WINDOWS\SYSTEM\MSWX.EXE /s
O4 - HKLM\..\RunServices: [APISS.EXE] C:\WINDOWS\SYSTEM\APISS.EXE /s
O4 - HKLM\..\RunServices: [WINRP.EXE] C:\WINDOWS\WINRP.EXE /s
O4 - HKLM\..\RunServices: [WINGP.EXE] C:\WINDOWS\SYSTEM\WINGP.EXE /s
O4 - HKLM\..\RunServices: [NTFM32.EXE] C:\WINDOWS\SYSTEM\NTFM32.EXE /s
O4 - HKLM\..\RunServices: [APIBG32.EXE] C:\WINDOWS\APIBG32.EXE /s
O4 - HKLM\..\RunServices: [ATLOS.EXE] C:\WINDOWS\ATLOS.EXE /s
O4 - HKLM\..\RunServices: [SYSMY.EXE] C:\WINDOWS\SYSTEM\SYSMY.EXE /s
O4 - HKLM\..\RunServices: [SYSNC32.EXE] C:\WINDOWS\SYSNC32.EXE /s
O4 - HKLM\..\RunServices: [CRMP32.EXE] C:\WINDOWS\SYSTEM\CRMP32.EXE /s
O4 - HKLM\..\RunServices: [NTNM32.EXE] C:\WINDOWS\NTNM32.EXE /s
O4 - HKLM\..\RunServices: [APPHJ32.EXE] C:\WINDOWS\SYSTEM\APPHJ32.EXE /s
O4 - HKLM\..\RunServices: [MSTE32.EXE] C:\WINDOWS\SYSTEM\MSTE32.EXE /s
O4 - HKLM\..\RunServices: [APISY32.EXE] C:\WINDOWS\SYSTEM\APISY32.EXE /s
O4 - HKLM\..\RunServices: [D3BU.EXE] C:\WINDOWS\SYSTEM\D3BU.EXE /s
O4 - HKLM\..\RunServices: [APPSV.EXE] C:\WINDOWS\SYSTEM\APPSV.EXE /s
O4 - HKLM\..\RunServices: [D3YN32.EXE] C:\WINDOWS\SYSTEM\D3YN32.EXE /s
O4 - HKLM\..\RunServices: [JAVAJK.EXE] C:\WINDOWS\SYSTEM\JAVAJK.EXE /s
O4 - HKLM\..\RunServices: [SDKAW.EXE] C:\WINDOWS\SDKAW.EXE /s
O4 - HKLM\..\RunServices: [D3MS.EXE] C:\WINDOWS\D3MS.EXE /s
O4 - HKLM\..\RunServices: [WINBN.EXE] C:\WINDOWS\SYSTEM\WINBN.EXE /s
O4 - HKLM\..\RunServices: [APIHG32.EXE] C:\WINDOWS\APIHG32.EXE /s
O4 - HKLM\..\RunServices: [NETYW.EXE] C:\WINDOWS\NETYW.EXE /s
O4 - HKLM\..\RunServices: [APIWX.EXE] C:\WINDOWS\SYSTEM\APIWX.EXE /s
O4 - HKLM\..\RunServices: [NETSP.EXE] C:\WINDOWS\NETSP.EXE /s
O4 - HKLM\..\RunServices: [SDKKG.EXE] C:\WINDOWS\SYSTEM\SDKKG.EXE /s
O4 - HKLM\..\RunServices: [ADDDG32.EXE] C:\WINDOWS\SYSTEM\ADDDG32.EXE /s
O4 - HKLM\..\RunServices: [SDKUM.EXE] C:\WINDOWS\SDKUM.EXE /s
O4 - HKLM\..\RunServices: [MSAX.EXE] C:\WINDOWS\SYSTEM\MSAX.EXE /s
O4 - HKLM\..\RunServices: [SYSWS32.EXE] C:\WINDOWS\SYSTEM\SYSWS32.EXE /s
O4 - HKLM\..\RunServices: [JAVACO32.EXE] C:\WINDOWS\SYSTEM\JAVACO32.EXE /s
O4 - HKLM\..\RunServices: [NETNH32.EXE] C:\WINDOWS\SYSTEM\NETNH32.EXE /s
O4 - HKLM\..\RunServices: [IPZG32.EXE] C:\WINDOWS\IPZG32.EXE /s
O4 - HKLM\..\RunServices: [CRCT32.EXE] C:\WINDOWS\CRCT32.EXE /s
O4 - HKLM\..\RunServices: [WINUP.EXE] C:\WINDOWS\SYSTEM\WINUP.EXE /s
O4 - HKLM\..\RunServices: [SDKAG.EXE] C:\WINDOWS\SYSTEM\SDKAG.EXE /s
O4 - HKLM\..\RunServices: [IPDH.EXE] C:\WINDOWS\SYSTEM\IPDH.EXE /s
O4 - HKLM\..\RunServices: [APIOA32.EXE] C:\WINDOWS\SYSTEM\APIOA32.EXE /s
O4 - HKLM\..\RunServices: [APPVH.EXE] C:\WINDOWS\APPVH.EXE /s
O4 - HKCU\..\Run: [RealJukeboxSystray] "C:\PROGRAM FILES\REAL\REALJUKEBOX\tsystray.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NetZero_uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Microsoft AntiSpyware helper - {BAA9F301-4A4B-4DB8-BDB8-E44835B7F641} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BAA9F301-4A4B-4DB8-BDB8-E44835B7F641} - (no file) (HKCU)
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .wav: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.c...ebio5_1_2_0.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab
O16 - DPF: {11111111-1111-1111-1111-111111111111} - file://C:\Recycled\Q166352.exe
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

#4
17Roush

Posted 26 May 2005 - 07:20 PM

Member

Topic Starter
Member
11 posts

I ran a scan with Ad-Aware SE Personal and it found 209 files that were corrupt or whatever, but when I had it delete them, it stopped midway through and never completed the process. -Jeff

#5
greyknight17

Posted 26 May 2005 - 07:37 PM

Malware Expert

Visiting Consultant
16,560 posts

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Download AboutBuster http://www.greyknigh...AboutBuster.zip and unzip it to a folder on your the Desktop. Run AboutBuster and click OK. Click Update and then Check For Update to see if there are any updates. Click Start->OK and then follow the rest of the prompts to scan (choose Yes/OK for all). It will ask you if you want a second scan, choose Yes. Save the log file and post it here.

Right click on this link -> http://www.bleepingc...g/smitfraud.reg and save that file. Double click on it and click on Yes when it asks you if you want to merge it into the registry. Once that's done, right click on your Desktop and go to Properties. Next go to Desktop tab->Customize Desktop button->Web tab. Uncheck everything listed there. Then delete all the entries listed except for 'My Current Home Page'. Click OK and OK.

Go to Start->-Control Panel->Add or Remove Programs and remove/uninstall the following programs, if found:

Security iGuard
Virtual Maid
Search Maid

Exit Add/Remove Programs.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy the below files and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with red circle with a white X. Confirm to delete and when asked if you want to reboot now, say no:

C:\wp.exe
C:\wp.bmp
C:\bsw.exe
C:\Windows\sites.ini
C:\Windows\popuper.exe
C:\Windows\system32\hhk.dll
C:\Windows\System32\wldr.dll
C:\Windows\System32\helper.exe
C:\Windows\System32\intmon.exe
C:\Windows\System32\shnlog.exe
C:\Windows\System32\intmonp.exe
C:\Windows\System32\msmsgs.exe
C:\Windows\system32\msole32.exe
C:\Windows\system32\ole32vbs.exe
C:\WINDOWS\SOINTGR.EXE
C:\WINDOWS\SYSTEM\SDKLJ32.EXE
C:\WINDOWS\SYSTEM\WINGP.EXE
C:\WINDOWS\APPVH.EXE
C:\WINDOWS\owrck.dll
C:\WINDOWS\SYSTEM\NTAM.DLL
C:\WINDOWS\SOINTGR.EXE
C:\WINDOWS\SYSTEM\SDKLJ32.EXE
C:\WINDOWS\SOINTGR.EXE
C:\WINDOWS\SYSTEM\CRJJ32.EXE
C:\WINDOWS\SYSTEM\NTYA.EXE
C:\WINDOWS\SYSTEM\MSWX.EXE
C:\WINDOWS\SYSTEM\APISS.EXE
C:\WINDOWS\WINRP.EXE
C:\WINDOWS\SYSTEM\WINGP.EXE
C:\WINDOWS\SYSTEM\NTFM32.EXE
C:\WINDOWS\APIBG32.EXE
C:\WINDOWS\ATLOS.EXE
C:\WINDOWS\SYSTEM\SYSMY.EXE
C:\WINDOWS\SYSNC32.EXE
C:\WINDOWS\SYSTEM\CRMP32.EXE
C:\WINDOWS\NTNM32.EXE
C:\WINDOWS\SYSTEM\APPHJ32.EXE
C:\WINDOWS\SYSTEM\MSTE32.EXE
C:\WINDOWS\SYSTEM\APISY32.EXE
C:\WINDOWS\SYSTEM\D3BU.EXE
C:\WINDOWS\SYSTEM\APPSV.EXE
C:\WINDOWS\SYSTEM\D3YN32.EXE
C:\WINDOWS\SYSTEM\JAVAJK.EXE
C:\WINDOWS\SDKAW.EXE
C:\WINDOWS\D3MS.EXE
C:\WINDOWS\SYSTEM\WINBN.EXE
C:\WINDOWS\APIHG32.EXE
C:\WINDOWS\NETYW.EXE
C:\WINDOWS\SYSTEM\APIWX.EXE
C:\WINDOWS\NETSP.EXE
C:\WINDOWS\SYSTEM\SDKKG.EXE
C:\WINDOWS\SYSTEM\ADDDG32.EXE
C:\WINDOWS\SDKUM.EXE
C:\WINDOWS\SYSTEM\MSAX.EXE
C:\WINDOWS\SYSTEM\SYSWS32.EXE
C:\WINDOWS\SYSTEM\JAVACO32.EXE
C:\WINDOWS\SYSTEM\NETNH32.EXE
C:\WINDOWS\IPZG32.EXE
C:\WINDOWS\CRCT32.EXE
C:\WINDOWS\SYSTEM\WINUP.EXE
C:\WINDOWS\SYSTEM\SDKAG.EXE
C:\WINDOWS\SYSTEM\IPDH.EXE
C:\WINDOWS\SYSTEM\APIOA32.EXE
C:\Recycled\Q166352.exe

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Delete these folders if they exist:

C:\Program Files\Search Maid\
C:\Program Files\Virtual Maid\
C:\Windows\System32\Log Files\
C:\Program Files\Security iGuard\

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\owrck.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\owrck.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\owrck.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F8205AB7-394C-C8D3-A452-ED6CBA5E5E8A} - C:\WINDOWS\SYSTEM\NTAM.DLL
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [SDKLJ32.EXE] C:\WINDOWS\SYSTEM\SDKLJ32.EXE
O4 - HKLM\..\RunServices: [SO5 Integrator Pass One] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\RunServices: [CRJJ32.EXE] C:\WINDOWS\SYSTEM\CRJJ32.EXE /s
O4 - HKLM\..\RunServices: [NTYA.EXE] C:\WINDOWS\SYSTEM\NTYA.EXE /s
O4 - HKLM\..\RunServices: [MSWX.EXE] C:\WINDOWS\SYSTEM\MSWX.EXE /s
O4 - HKLM\..\RunServices: [APISS.EXE] C:\WINDOWS\SYSTEM\APISS.EXE /s
O4 - HKLM\..\RunServices: [WINRP.EXE] C:\WINDOWS\WINRP.EXE /s
O4 - HKLM\..\RunServices: [WINGP.EXE] C:\WINDOWS\SYSTEM\WINGP.EXE /s
O4 - HKLM\..\RunServices: [NTFM32.EXE] C:\WINDOWS\SYSTEM\NTFM32.EXE /s
O4 - HKLM\..\RunServices: [APIBG32.EXE] C:\WINDOWS\APIBG32.EXE /s
O4 - HKLM\..\RunServices: [ATLOS.EXE] C:\WINDOWS\ATLOS.EXE /s
O4 - HKLM\..\RunServices: [SYSMY.EXE] C:\WINDOWS\SYSTEM\SYSMY.EXE /s
O4 - HKLM\..\RunServices: [SYSNC32.EXE] C:\WINDOWS\SYSNC32.EXE /s
O4 - HKLM\..\RunServices: [CRMP32.EXE] C:\WINDOWS\SYSTEM\CRMP32.EXE /s
O4 - HKLM\..\RunServices: [NTNM32.EXE] C:\WINDOWS\NTNM32.EXE /s
O4 - HKLM\..\RunServices: [APPHJ32.EXE] C:\WINDOWS\SYSTEM\APPHJ32.EXE /s
O4 - HKLM\..\RunServices: [MSTE32.EXE] C:\WINDOWS\SYSTEM\MSTE32.EXE /s
O4 - HKLM\..\RunServices: [APISY32.EXE] C:\WINDOWS\SYSTEM\APISY32.EXE /s
O4 - HKLM\..\RunServices: [D3BU.EXE] C:\WINDOWS\SYSTEM\D3BU.EXE /s
O4 - HKLM\..\RunServices: [APPSV.EXE] C:\WINDOWS\SYSTEM\APPSV.EXE /s
O4 - HKLM\..\RunServices: [D3YN32.EXE] C:\WINDOWS\SYSTEM\D3YN32.EXE /s
O4 - HKLM\..\RunServices: [JAVAJK.EXE] C:\WINDOWS\SYSTEM\JAVAJK.EXE /s
O4 - HKLM\..\RunServices: [SDKAW.EXE] C:\WINDOWS\SDKAW.EXE /s
O4 - HKLM\..\RunServices: [D3MS.EXE] C:\WINDOWS\D3MS.EXE /s
O4 - HKLM\..\RunServices: [WINBN.EXE] C:\WINDOWS\SYSTEM\WINBN.EXE /s
O4 - HKLM\..\RunServices: [APIHG32.EXE] C:\WINDOWS\APIHG32.EXE /s
O4 - HKLM\..\RunServices: [NETYW.EXE] C:\WINDOWS\NETYW.EXE /s
O4 - HKLM\..\RunServices: [APIWX.EXE] C:\WINDOWS\SYSTEM\APIWX.EXE /s
O4 - HKLM\..\RunServices: [NETSP.EXE] C:\WINDOWS\NETSP.EXE /s
O4 - HKLM\..\RunServices: [SDKKG.EXE] C:\WINDOWS\SYSTEM\SDKKG.EXE /s
O4 - HKLM\..\RunServices: [ADDDG32.EXE] C:\WINDOWS\SYSTEM\ADDDG32.EXE /s
O4 - HKLM\..\RunServices: [SDKUM.EXE] C:\WINDOWS\SDKUM.EXE /s
O4 - HKLM\..\RunServices: [MSAX.EXE] C:\WINDOWS\SYSTEM\MSAX.EXE /s
O4 - HKLM\..\RunServices: [SYSWS32.EXE] C:\WINDOWS\SYSTEM\SYSWS32.EXE /s
O4 - HKLM\..\RunServices: [JAVACO32.EXE] C:\WINDOWS\SYSTEM\JAVACO32.EXE /s
O4 - HKLM\..\RunServices: [NETNH32.EXE] C:\WINDOWS\SYSTEM\NETNH32.EXE /s
O4 - HKLM\..\RunServices: [IPZG32.EXE] C:\WINDOWS\IPZG32.EXE /s
O4 - HKLM\..\RunServices: [CRCT32.EXE] C:\WINDOWS\CRCT32.EXE /s
O4 - HKLM\..\RunServices: [WINUP.EXE] C:\WINDOWS\SYSTEM\WINUP.EXE /s
O4 - HKLM\..\RunServices: [SDKAG.EXE] C:\WINDOWS\SYSTEM\SDKAG.EXE /s
O4 - HKLM\..\RunServices: [IPDH.EXE] C:\WINDOWS\SYSTEM\IPDH.EXE /s
O4 - HKLM\..\RunServices: [APIOA32.EXE] C:\WINDOWS\SYSTEM\APIOA32.EXE /s
O4 - HKLM\..\RunServices: [APPVH.EXE] C:\WINDOWS\APPVH.EXE /s
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Microsoft AntiSpyware helper - {BAA9F301-4A4B-4DB8-BDB8-E44835B7F641} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BAA9F301-4A4B-4DB8-BDB8-E44835B7F641} - (no file) (HKCU)
O16 - DPF: {11111111-1111-1111-1111-111111111111} - file://C:\Recycled\Q166352.exe

Close HijackThis.

Restart your computer.

1. Download Hoster http://www.greyknigh.../spy/Hoster.exe and run it. Choose the 'Restore Original Hosts' button and press OK. Close the program.

2. Right click on this link -> http://mvps.org/winh.../DelDomains.inf and select Save As to download WinHelp2002's DelDomains.inf. Save the file to the Desktop. To run the inf file, right click on it and select Install. Note: This will remove all entries in the 'Trusted Zone' and 'Ranges' also.

3. The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

4. Run an online scan at http://www.pandasoft...com/activescan/ and save the results from the scan!

Restart and post a new HijackThis log along with the results from ActiveScan.

#6
17Roush

Posted 30 May 2005 - 06:03 PM

Member

Topic Starter
Member
11 posts

Here's the AboutBuster scan log:

-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 26

ADS not scanned System(FAT)
Removed! : C:\WINDOWS\fvgdx.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 26

ADS not scanned System(FAT)
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

I tried right clicking on the next file, downloaded it, but I can't get it to merge. -Jeff

#7
greyknight17

Posted 30 May 2005 - 06:45 PM

Malware Expert

Visiting Consultant
16,560 posts

You mean the smitfraud.reg file? You just need to double click on it and it will ask you if you want to merge it. Say yes.

Did you do the rest of the fixes yet? If so, restart and give me those logs I requested.

#8
17Roush

Posted 31 May 2005 - 05:22 PM

Member

Topic Starter
Member
11 posts

Yeah, the smitfraud.reg file. It downloaded, then I went into my computer and double clicked it and it opened this page with our replys and stuff. Can I skip ahead and go to killbox and so on before I merge those files? -Jeff

#9
17Roush

Posted 31 May 2005 - 08:35 PM

Member

Topic Starter
Member
11 posts

Ignore the last post. I got it downloaded using my aol browser, then it merged. I went through all the other steps and I'm running the ActiveScan now. I'll post the results as soon as it finishes. How do I get my desktop picture back? -Jeff

#10
17Roush

Posted 01 June 2005 - 03:16 PM

Member

Topic Starter
Member
11 posts

I gave up on the ActiceScan. I waited 3 hours and it wasn't even half done, so is there another scan I can do that won't take so long? Here's the 2nd hijackThis scan though. -Jeff

Logfile of HijackThis v1.99.1
Scan saved at 4:09:59 PM, on 6/1/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\CRJS32.EXE
C:\WINDOWS\CRDE.EXE
C:\WINDOWS\SYSTEM\D3HM32.EXE
C:\WINDOWS\SYSTEM\MSHU32.EXE
C:\WINDOWS\SYSTEM\NETRB32.EXE
C:\WINDOWS\SYSEQ.EXE
C:\WINDOWS\SYSTEM\MSKZ32.EXE
C:\WINDOWS\SYSTEM\JAVAWY.EXE
C:\WINDOWS\SYSTEM\NTSI.EXE
C:\WINDOWS\SYSTEM\NETNI.EXE
C:\WINDOWS\APPLN.EXE
C:\WINDOWS\WINLL32.EXE
C:\WINDOWS\D3MF.EXE
C:\WINDOWS\MSSE.EXE
C:\WINDOWS\NTNE32.EXE
C:\WINDOWS\SYSTEM\NETJO.EXE
C:\WINDOWS\SYSTEM\NTAL.EXE
C:\WINDOWS\SYSTEM\SDKCW32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ESOFT\EBOARD\EBOARD.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\IPER32.EXE
C:\PROGRAM FILES\REAL\REALJUKEBOX\TSYSTRAY.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\SYSEQ.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\AOL COMPANION\COMPANION.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE
C:\WINDOWS\CRCX.EXE
C:\WINDOWS\EXPLORER.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pglbd.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pglbd.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pglbd.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pglbd.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pglbd.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pglbd.dll/sp.html#28129
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.netzero.net"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
O2 - BHO: Class - {72BF83B6-F009-0936-0062-743F038DEC1F} - C:\WINDOWS\ATLYV.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP5_1_2_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [eMachine eBoard] C:\PROGRA~1\ESOFT\EBOARD\eBoard.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [IPER32.EXE] C:\WINDOWS\SYSTEM\IPER32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [CRHP.EXE] C:\WINDOWS\SYSTEM\CRHP.EXE /s
O4 - HKLM\..\RunServices: [CRJS32.EXE] C:\WINDOWS\CRJS32.EXE /s
O4 - HKLM\..\RunServices: [CRDE.EXE] C:\WINDOWS\CRDE.EXE /s
O4 - HKLM\..\RunServices: [D3HM32.EXE] C:\WINDOWS\SYSTEM\D3HM32.EXE /s
O4 - HKLM\..\RunServices: [MSHU32.EXE] C:\WINDOWS\SYSTEM\MSHU32.EXE /s
O4 - HKLM\..\RunServices: [NETRB32.EXE] C:\WINDOWS\SYSTEM\NETRB32.EXE /s
O4 - HKLM\..\RunServices: [SYSEQ.EXE] C:\WINDOWS\SYSEQ.EXE /s
O4 - HKLM\..\RunServices: [MSKZ32.EXE] C:\WINDOWS\SYSTEM\MSKZ32.EXE /s
O4 - HKLM\..\RunServices: [JAVAWY.EXE] C:\WINDOWS\SYSTEM\JAVAWY.EXE /s
O4 - HKLM\..\RunServices: [NTSI.EXE] C:\WINDOWS\SYSTEM\NTSI.EXE /s
O4 - HKLM\..\RunServices: [NETNI.EXE] C:\WINDOWS\SYSTEM\NETNI.EXE /s
O4 - HKLM\..\RunServices: [APPLN.EXE] C:\WINDOWS\APPLN.EXE /s
O4 - HKLM\..\RunServices: [WINLL32.EXE] C:\WINDOWS\WINLL32.EXE /s
O4 - HKLM\..\RunServices: [D3MF.EXE] C:\WINDOWS\D3MF.EXE /s
O4 - HKLM\..\RunServices: [MSSE.EXE] C:\WINDOWS\MSSE.EXE /s
O4 - HKLM\..\RunServices: [NTNE32.EXE] C:\WINDOWS\NTNE32.EXE /s
O4 - HKLM\..\RunServices: [NETJO.EXE] C:\WINDOWS\SYSTEM\NETJO.EXE /s
O4 - HKLM\..\RunServices: [NTAL.EXE] C:\WINDOWS\SYSTEM\NTAL.EXE /s
O4 - HKLM\..\RunServices: [SDKCW32.EXE] C:\WINDOWS\SYSTEM\SDKCW32.EXE /s
O4 - HKLM\..\RunServices: [CRCX.EXE] C:\WINDOWS\CRCX.EXE /s
O4 - HKCU\..\Run: [RealJukeboxSystray] "C:\PROGRAM FILES\REAL\REALJUKEBOX\tsystray.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NetZero_uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .wav: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.c...ebio5_1_2_0.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

#11
greyknight17

Posted 02 June 2005 - 06:37 PM

Malware Expert

Visiting Consultant
16,560 posts

#12
17Roush

Posted 04 June 2005 - 11:46 AM

Member

Topic Starter
Member
11 posts

Here are the logs:

Logfile of HijackThis v1.99.1
Scan saved at 12:37:50 PM, on 6/4/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\CRJS32.EXE
C:\WINDOWS\CRDE.EXE
C:\WINDOWS\SYSTEM\D3HM32.EXE
C:\WINDOWS\SYSTEM\MSHU32.EXE
C:\WINDOWS\SYSTEM\NETRB32.EXE
C:\WINDOWS\SYSEQ.EXE
C:\WINDOWS\SYSTEM\MSKZ32.EXE
C:\WINDOWS\SYSTEM\JAVAWY.EXE
C:\WINDOWS\SYSTEM\NTSI.EXE
C:\WINDOWS\SYSTEM\NETNI.EXE
C:\WINDOWS\APPLN.EXE
C:\WINDOWS\WINLL32.EXE
C:\WINDOWS\D3MF.EXE
C:\WINDOWS\MSSE.EXE
C:\WINDOWS\NTNE32.EXE
C:\WINDOWS\SYSTEM\NETJO.EXE
C:\WINDOWS\SYSTEM\NTAL.EXE
C:\WINDOWS\SYSTEM\SDKCW32.EXE
C:\WINDOWS\CRCX.EXE
C:\WINDOWS\SYSTEM\MSLZ32.EXE
C:\WINDOWS\ATLFY.EXE
C:\WINDOWS\D3UX.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\APPSK32.EXE
C:\WINDOWS\SYSTEM\ATLAW.EXE
C:\WINDOWS\WINLT.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ESOFT\EBOARD\EBOARD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\IPER32.EXE
C:\PROGRAM FILES\REAL\REALJUKEBOX\TSYSTRAY.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\SYSTEM\NETRB32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\AOL COMPANION\COMPANION.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\SYSTEM\IPEH.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\CRQJ.EXE
C:\WINDOWS\CRQJ.EXE
C:\WINDOWS\SYSTEM\D3UW32.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\IPZI.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\szapd.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.ne...ch?r=minisearch
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.netzero.net"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
O2 - BHO: Class - {D92B11D4-74D5-F043-84CE-D7DC94E095D0} - C:\WINDOWS\SYSTEM\ADDET32.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP5_1_2_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [eMachine eBoard] C:\PROGRA~1\ESOFT\EBOARD\eBoard.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [IPER32.EXE] C:\WINDOWS\SYSTEM\IPER32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [CRHP.EXE] C:\WINDOWS\SYSTEM\CRHP.EXE /s
O4 - HKLM\..\RunServices: [CRJS32.EXE] C:\WINDOWS\CRJS32.EXE /s
O4 - HKLM\..\RunServices: [CRDE.EXE] C:\WINDOWS\CRDE.EXE /s
O4 - HKLM\..\RunServices: [D3HM32.EXE] C:\WINDOWS\SYSTEM\D3HM32.EXE /s
O4 - HKLM\..\RunServices: [MSHU32.EXE] C:\WINDOWS\SYSTEM\MSHU32.EXE /s
O4 - HKLM\..\RunServices: [NETRB32.EXE] C:\WINDOWS\SYSTEM\NETRB32.EXE /s
O4 - HKLM\..\RunServices: [SYSEQ.EXE] C:\WINDOWS\SYSEQ.EXE /s
O4 - HKLM\..\RunServices: [MSKZ32.EXE] C:\WINDOWS\SYSTEM\MSKZ32.EXE /s
O4 - HKLM\..\RunServices: [JAVAWY.EXE] C:\WINDOWS\SYSTEM\JAVAWY.EXE /s
O4 - HKLM\..\RunServices: [NTSI.EXE] C:\WINDOWS\SYSTEM\NTSI.EXE /s
O4 - HKLM\..\RunServices: [NETNI.EXE] C:\WINDOWS\SYSTEM\NETNI.EXE /s
O4 - HKLM\..\RunServices: [APPLN.EXE] C:\WINDOWS\APPLN.EXE /s
O4 - HKLM\..\RunServices: [WINLL32.EXE] C:\WINDOWS\WINLL32.EXE /s
O4 - HKLM\..\RunServices: [D3MF.EXE] C:\WINDOWS\D3MF.EXE /s
O4 - HKLM\..\RunServices: [MSSE.EXE] C:\WINDOWS\MSSE.EXE /s
O4 - HKLM\..\RunServices: [NTNE32.EXE] C:\WINDOWS\NTNE32.EXE /s
O4 - HKLM\..\RunServices: [NETJO.EXE] C:\WINDOWS\SYSTEM\NETJO.EXE /s
O4 - HKLM\..\RunServices: [NTAL.EXE] C:\WINDOWS\SYSTEM\NTAL.EXE /s
O4 - HKLM\..\RunServices: [SDKCW32.EXE] C:\WINDOWS\SYSTEM\SDKCW32.EXE /s
O4 - HKLM\..\RunServices: [CRCX.EXE] C:\WINDOWS\CRCX.EXE /s
O4 - HKLM\..\RunServices: [MSLZ32.EXE] C:\WINDOWS\SYSTEM\MSLZ32.EXE /s
O4 - HKLM\..\RunServices: [ATLFY.EXE] C:\WINDOWS\ATLFY.EXE /s
O4 - HKLM\..\RunServices: [D3UX.EXE] C:\WINDOWS\D3UX.EXE /s
O4 - HKLM\..\RunServices: [APPSK32.EXE] C:\WINDOWS\SYSTEM\APPSK32.EXE /s
O4 - HKLM\..\RunServices: [ATLAW.EXE] C:\WINDOWS\SYSTEM\ATLAW.EXE /s
O4 - HKLM\..\RunServices: [WINLT.EXE] C:\WINDOWS\WINLT.EXE /s
O4 - HKLM\..\RunServices: [IPEH.EXE] C:\WINDOWS\SYSTEM\IPEH.EXE /s
O4 - HKLM\..\RunServices: [CRQJ.EXE] C:\WINDOWS\CRQJ.EXE /s
O4 - HKLM\..\RunServices: [D3UW32.EXE] C:\WINDOWS\SYSTEM\D3UW32.EXE /s
O4 - HKLM\..\RunServices: [IPZI.EXE] C:\WINDOWS\IPZI.EXE /s
O4 - HKCU\..\Run: [RealJukeboxSystray] "C:\PROGRAM FILES\REAL\REALJUKEBOX\tsystray.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NetZero_uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .wav: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.c...ebio5_1_2_0.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab

Scanned at: 11:22:22 AM on: 6/4/2005

-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 26

ADS not scanned System(FAT)
Removed! : C:\WINDOWS\lwmxoe.dat
Removed! : C:\WINDOWS\rweqax.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 26

ADS not scanned System(FAT)
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

These two keep coming up after I reboot and HiJackThis again:
R3 - Default URLSearchHook is missing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

They're gone now, but will probably be back the next time I turn my computer on.

#13
greyknight17

Posted 04 June 2005 - 03:35 PM

Malware Expert

Visiting Consultant
16,560 posts

OK, let's try doing this in Normal Mode then:

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Don't run it yet.

Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\szapd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\szapd.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\szapd.dll/sp.html#37049
O2 - BHO: Class - {D92B11D4-74D5-F043-84CE-D7DC94E095D0} - C:\WINDOWS\SYSTEM\ADDET32.DLL
O4 - HKLM\..\Run: [IPER32.EXE] C:\WINDOWS\SYSTEM\IPER32.EXE
O4 - HKLM\..\RunServices: [CRHP.EXE] C:\WINDOWS\SYSTEM\CRHP.EXE /s
O4 - HKLM\..\RunServices: [CRJS32.EXE] C:\WINDOWS\CRJS32.EXE /s
O4 - HKLM\..\RunServices: [CRDE.EXE] C:\WINDOWS\CRDE.EXE /s
O4 - HKLM\..\RunServices: [D3HM32.EXE] C:\WINDOWS\SYSTEM\D3HM32.EXE /s
O4 - HKLM\..\RunServices: [MSHU32.EXE] C:\WINDOWS\SYSTEM\MSHU32.EXE /s
O4 - HKLM\..\RunServices: [NETRB32.EXE] C:\WINDOWS\SYSTEM\NETRB32.EXE /s
O4 - HKLM\..\RunServices: [SYSEQ.EXE] C:\WINDOWS\SYSEQ.EXE /s
O4 - HKLM\..\RunServices: [MSKZ32.EXE] C:\WINDOWS\SYSTEM\MSKZ32.EXE /s
O4 - HKLM\..\RunServices: [JAVAWY.EXE] C:\WINDOWS\SYSTEM\JAVAWY.EXE /s
O4 - HKLM\..\RunServices: [NTSI.EXE] C:\WINDOWS\SYSTEM\NTSI.EXE /s
O4 - HKLM\..\RunServices: [NETNI.EXE] C:\WINDOWS\SYSTEM\NETNI.EXE /s
O4 - HKLM\..\RunServices: [APPLN.EXE] C:\WINDOWS\APPLN.EXE /s
O4 - HKLM\..\RunServices: [WINLL32.EXE] C:\WINDOWS\WINLL32.EXE /s
O4 - HKLM\..\RunServices: [D3MF.EXE] C:\WINDOWS\D3MF.EXE /s
O4 - HKLM\..\RunServices: [MSSE.EXE] C:\WINDOWS\MSSE.EXE /s
O4 - HKLM\..\RunServices: [NTNE32.EXE] C:\WINDOWS\NTNE32.EXE /s
O4 - HKLM\..\RunServices: [NETJO.EXE] C:\WINDOWS\SYSTEM\NETJO.EXE /s
O4 - HKLM\..\RunServices: [NTAL.EXE] C:\WINDOWS\SYSTEM\NTAL.EXE /s
O4 - HKLM\..\RunServices: [SDKCW32.EXE] C:\WINDOWS\SYSTEM\SDKCW32.EXE /s
O4 - HKLM\..\RunServices: [CRCX.EXE] C:\WINDOWS\CRCX.EXE /s
O4 - HKLM\..\RunServices: [MSLZ32.EXE] C:\WINDOWS\SYSTEM\MSLZ32.EXE /s
O4 - HKLM\..\RunServices: [ATLFY.EXE] C:\WINDOWS\ATLFY.EXE /s
O4 - HKLM\..\RunServices: [D3UX.EXE] C:\WINDOWS\D3UX.EXE /s
O4 - HKLM\..\RunServices: [APPSK32.EXE] C:\WINDOWS\SYSTEM\APPSK32.EXE /s
O4 - HKLM\..\RunServices: [ATLAW.EXE] C:\WINDOWS\SYSTEM\ATLAW.EXE /s
O4 - HKLM\..\RunServices: [WINLT.EXE] C:\WINDOWS\WINLT.EXE /s
O4 - HKLM\..\RunServices: [IPEH.EXE] C:\WINDOWS\SYSTEM\IPEH.EXE /s
O4 - HKLM\..\RunServices: [CRQJ.EXE] C:\WINDOWS\CRQJ.EXE /s
O4 - HKLM\..\RunServices: [D3UW32.EXE] C:\WINDOWS\SYSTEM\D3UW32.EXE /s
O4 - HKLM\..\RunServices: [IPZI.EXE] C:\WINDOWS\IPZI.EXE /s

Run AboutBuster and click Begin Removal button. Once that's done, just hit the OK button. Click Exit once you are done. Click the OK button and it should exit. Open up the 'Ab LogFile.txt' (which was created in the same folder as AboutBuster) and post the log here.

Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy the below files and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with red circle with a white X. Confirm to delete and when asked if you want to reboot now, say no:

C:\WINDOWS\APPLN.EXE
C:\WINDOWS\ATLFY.EXE
C:\WINDOWS\CRCX.EXE
C:\WINDOWS\CRDE.EXE
C:\WINDOWS\CRJS32.EXE
C:\WINDOWS\CRQJ.EXE
C:\WINDOWS\D3MF.EXE
C:\WINDOWS\D3UX.EXE
C:\WINDOWS\IPZI.EXE
C:\WINDOWS\MSSE.EXE
C:\WINDOWS\NTNE32.EXE
C:\WINDOWS\SYSEQ.EXE
C:\WINDOWS\SYSTEM\ADDET32.DLL
C:\WINDOWS\SYSTEM\APPSK32.EXE
C:\WINDOWS\SYSTEM\ATLAW.EXE
C:\WINDOWS\SYSTEM\CRHP.EXE
C:\WINDOWS\SYSTEM\D3HM32.EXE
C:\WINDOWS\SYSTEM\D3UW32.EXE
C:\WINDOWS\SYSTEM\IPEH.EXE
C:\WINDOWS\SYSTEM\IPER32.EXE
C:\WINDOWS\SYSTEM\JAVAWY.EXE
C:\WINDOWS\SYSTEM\MSHU32.EXE
C:\WINDOWS\SYSTEM\MSKZ32.EXE
C:\WINDOWS\SYSTEM\MSLZ32.EXE
C:\WINDOWS\SYSTEM\NETJO.EXE
C:\WINDOWS\SYSTEM\NETNI.EXE
C:\WINDOWS\SYSTEM\NETRB32.EXE
C:\WINDOWS\SYSTEM\NTAL.EXE
C:\WINDOWS\SYSTEM\NTSI.EXE
C:\WINDOWS\SYSTEM\SDKCW32.EXE
C:\WINDOWS\WINLL32.EXE
C:\WINDOWS\WINLT.EXE

Run CleanUp! and click on CleanUp! button. Once it's done, you may click the Close button. When asked if you want to logoff, choose Yes.

Restart and run a new HijackThis scan. Save the log file and post it here.

#14
17Roush

Posted 07 June 2005 - 07:15 PM

Member

Topic Starter
Member
11 posts

Here ya go:

Logfile of HijackThis v1.99.1
Scan saved at 8:05:26 PM, on 6/7/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SYSMC.EXE
C:\WINDOWS\SYSSO32.EXE
C:\WINDOWS\SYSTEM\WINAM32.EXE
C:\WINDOWS\APILD32.EXE
C:\WINDOWS\IEVZ.EXE
C:\WINDOWS\JAVAGS32.EXE
C:\WINDOWS\NETHV.EXE
C:\WINDOWS\SYSTEM\WINOB32.EXE
C:\WINDOWS\SYSTEM\IECS32.EXE
C:\WINDOWS\SYSTEM\NTGD.EXE
C:\WINDOWS\SYSTEM\JAVAYX.EXE
C:\WINDOWS\NTBJ32.EXE
C:\WINDOWS\SYSHX.EXE
C:\WINDOWS\SYSTEM\ADDLW32.EXE
C:\WINDOWS\SYSTEM\IPYS32.EXE
C:\WINDOWS\APITY32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\APPAR.EXE
C:\WINDOWS\SYSTEM\APPNQ32.EXE
C:\WINDOWS\IEVZ.EXE
C:\WINDOWS\IEVZ.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ESOFT\EBOARD\EBOARD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\REAL\REALJUKEBOX\TSYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NZSEARCH\NZSPC.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\AOL COMPANION\COMPANION.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\IPYS32.EXE
C:\WINDOWS\IEVZ.EXE
C:\WINDOWS\IEVZ.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpidl.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpidl.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zpidl.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpidl.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpidl.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zpidl.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.ne...ch?r=minisearch
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.netzero.net"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\39t3k739.slt\prefs.js)
O2 - BHO: Class - {9C47C137-4A96-D283-A6D4-541C590343E6} - C:\WINDOWS\SYSTEM\SYSWS32.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP5_1_2_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [eMachine eBoard] C:\PROGRA~1\ESOFT\EBOARD\eBoard.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [IPER32.EXE] C:\WINDOWS\SYSTEM\IPER32.EXE
O4 - HKLM\..\Run: [APPNQ32.EXE] C:\WINDOWS\SYSTEM\APPNQ32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [SYSMC.EXE] C:\WINDOWS\SYSTEM\SYSMC.EXE /s
O4 - HKLM\..\RunServices: [SYSSO32.EXE] C:\WINDOWS\SYSSO32.EXE /s
O4 - HKLM\..\RunServices: [WINAM32.EXE] C:\WINDOWS\SYSTEM\WINAM32.EXE /s
O4 - HKLM\..\RunServices: [APILD32.EXE] C:\WINDOWS\APILD32.EXE /s
O4 - HKLM\..\RunServices: [IEVZ.EXE] C:\WINDOWS\IEVZ.EXE /s
O4 - HKLM\..\RunServices: [JAVAGS32.EXE] C:\WINDOWS\JAVAGS32.EXE /s
O4 - HKLM\..\RunServices: [NETHV.EXE] C:\WINDOWS\NETHV.EXE /s
O4 - HKLM\..\RunServices: [WINOB32.EXE] C:\WINDOWS\SYSTEM\WINOB32.EXE /s
O4 - HKLM\..\RunServices: [IECS32.EXE] C:\WINDOWS\SYSTEM\IECS32.EXE /s
O4 - HKLM\..\RunServices: [NTGD.EXE] C:\WINDOWS\SYSTEM\NTGD.EXE /s
O4 - HKLM\..\RunServices: [JAVAYX.EXE] C:\WINDOWS\SYSTEM\JAVAYX.EXE /s
O4 - HKLM\..\RunServices: [NTBJ32.EXE] C:\WINDOWS\NTBJ32.EXE /s
O4 - HKLM\..\RunServices: [SYSHX.EXE] C:\WINDOWS\SYSHX.EXE /s
O4 - HKLM\..\RunServices: [ADDLW32.EXE] C:\WINDOWS\SYSTEM\ADDLW32.EXE /s
O4 - HKLM\..\RunServices: [IPYS32.EXE] C:\WINDOWS\SYSTEM\IPYS32.EXE /s
O4 - HKLM\..\RunServices: [APITY32.EXE] C:\WINDOWS\APITY32.EXE /s
O4 - HKLM\..\RunServices: [D3HM32.EXE] C:\WINDOWS\SYSTEM\D3HM32.EXE /s
O4 - HKLM\..\RunServices: [APPAR.EXE] C:\WINDOWS\SYSTEM\APPAR.EXE /s
O4 - HKCU\..\Run: [RealJukeboxSystray] "C:\PROGRAM FILES\REAL\REALJUKEBOX\tsystray.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NetZero_uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O12 - Plugin for .wav: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.c...ebio5_1_2_0.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab

Scanned at: 7:57:45 PM on: 6/7/2005

-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 26

ADS not scanned System(FAT)
Removed! : C:\WINDOWS\SYSTEM\yiref.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

#15
greyknight17

Posted 07 June 2005 - 08:44 PM

Malware Expert

Visiting Consultant
16,560 posts

Is smitfraud gone now? Just want to make sure on that one.

OK, do this:

Please print out the instructions here (or save it in Notepad) so that you can follow along more easily.

Download Ewido Security Suite at http://www.ewido.net/en/download/ and install it. Update to the newest definitions. If you have trouble updating, you may do it manually at http://www.ewido.net...wnload/updates/ Do NOT the Ewido scan yet.

Reboot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Run AboutBuster again and save the log.

Next run a full scan in Ewido. Save the log from the Ewido scan so that you can post it later.

Restart and give me a new HijackThis, AboutBuster and Ewido log.