Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Please take a look at my Hijackthis Log [CLOSED]


  • This topic is locked This topic is locked

#1
evolnomis

evolnomis

    Member

  • Member
  • PipPip
  • 51 posts
My internet connection to my other computers is fine but my laptop cannot seem to get connection. Pasted below is a the log for my laptop. Using one of the forum posts, i was able to get rid of the badurl repititive flashing on IE problem but still cannot go online. Please help. thanks.


Logfile of HijackThis v1.99.1
Scan saved at 6:16:30 PM, on 6/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\LiveUpdate\LiveUpdate.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\windows\system32\pgdsuj.exe
C:\WINDOWS\dvooxjfc.exe
C:\WINDOWS\wupdt.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\kurc.exe
C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
C:\windows\system32\calc.exe
C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINDOWS\GWMDMpi.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [pgdsuj] c:\windows\system32\pgdsuj.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [nsvcin] C:\WINDOWS\system32\n20050308.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\pailra.exe
O4 - HKLM\..\Run: [vdnnbgwgdfccrgmogigqclffnz] C:\WINDOWS\dvooxjfc.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - Global Startup: Post-itョ Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com..._1/axofupld.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k8pm0i71e8.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Net MD Simple Burner DB Access Service (mdrcdb) - Unknown owner - C:\Program Files\Sony\Net MD Simple Burner\mdrcdb.exe
O23 - Service: Net MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

Advertisements


#2
Guest_usetobe_*

Guest_usetobe_*
  • Guest
Hi evolnomis,

Lets see if we can get this sorted.

Please print out a copy of these instructions so that they are easy to follow and so that you have access to them, when you have to reboot your PC

A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

1. Please download LSPFix from here.
2. Run the LSPFix.exe that you have just finished downloading.
3. Check the I know what I'm doing box.
4. In the Keep box you may see one or more instances of aklsp.dll.
5. Select every instance of aklsp.dll and move each one to the Remove box by clicking the >> button.
6. When you are done click Finish>>.

Let know if that allows you to connect to the internet
  • 0

#3
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
Thanks a lot! Now i can finally get onto the internet using my dsl. But for some reason i still can't get on using my wireless card. I also noticed that i have a lot of popups. Can you help me solve this problem? thanks a lot.
  • 0

#4
Guest_usetobe_*

Guest_usetobe_*
  • Guest
Hi evol,

Please print out a copy of this to make it easier to follow as you will need to reboot your PC several times. Follow these instructions carefully, they may appear to be complicated but i am confident that with teamwork we will clear this up

A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

1. Please download LSPFix from here.
2. Run the LSPFix.exe that you have just finished downloading.
3. Check the I know what I'm doing box.
4. In the Keep box you may see one or more instances of aklsp.dll.
5. Select every instance of aklsp.dll and move each one to the Remove box by clicking the >> button.
6. When you are done click Finish>>.

Please run an on-line virus scan at Kaspersky OnLine Scan or if that doesnt work, you can use TrendMicro or BitDefender. (Please post the results of the scan(s) in your next reply)

Download and install CleanUp! Here. Do not run it yet.

Download a free 14 day trial of ewido from the link below. Install it and start it up. Follow the prompts to upgrade it, then close it down.

ewido

Set PC to show hidden files (click link if you do not know how)LINK

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Now run Ewido. click on the Scanner button, Select drives if you have more than one and then start. grab a cup of coffee, sandwiches, book as this may take some time. Once the first problem is detected ensure you tick the box for all (bottom left) and allow it to continue.

At the end of the scan, it may ask if you would like to delete anything found in archive or zipped files, OK that request, then click on save report. SAVE to the default location, it will then generate a text file. Copy that to post in this thread.

Now run HJT and check the following entries if they still exist.

R3 - Default URLSearchHook is missing
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [pgdsuj] c:\windows\system32\pgdsuj.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [nsvcin] C:\WINDOWS\system32\n20050308.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\pailra.exe
O4 - HKLM\..\Run: [vdnnbgwgdfccrgmogigqclffnz] C:\WINDOWS\dvooxjfc.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\k8pm0i71e8.dll


Now using windows explorer locate and delete the following files/folders if found.
C:\WINDOWS\systb.dll
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
c:\windows\system32\pgdsuj.exe
C:\WINDOWS\farmmext.exe
C:\WINDOWS\system32\n20050308.exe
C:\WINDOWS\System32\pailra.exe
C:\WINDOWS\dvooxjfc.exe
C:\WINDOWS\wupdt.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\PROGRA~1\ezula\mmod.exe
C:\Program Files\Ebates_MoeMoneyMaker\<<--entire folder
C:\WINDOWS\isrvs\<<--entire folder
C:\WINDOWS\system32\k8pm0i71e8.dll


Now run Cleanup.

Reboot pc normally, rescan with HJT and post the log back
  • 0

#5
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
I did everything asked of and attached below is the HJT Log. I ran the Kaspersky Online scan, and EVIDO but was unable to get a log from them. They didn't offer me the option. And Cleanup has also been completed. Please tell me what i should do next. Virtual Bouncer keeps popping up too. thanks a lot.

Logfile of HijackThis v1.99.1
Scan saved at 5:50:01 PM, on 6/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\kluarl.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINDOWS\GWMDMpi.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\kluarl.exe reg_run
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - Global Startup: MA521 Configuration Utility.lnk = ?
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com..._1/axofupld.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\ir24l5fq1.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Net MD Simple Burner DB Access Service (mdrcdb) - Unknown owner - C:\Program Files\Sony\Net MD Simple Burner\mdrcdb.exe
O23 - Service: Net MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#6
Guest_usetobe_*

Guest_usetobe_*
  • Guest
You now have a completely new nasty infection.....Do you have any antivirus program?
  • 0

#7
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
really? [bleep]! I have a copy of NAV on CD but its not installed into the computer. What should i do? Thanks.
  • 0

#8
Guest_usetobe_*

Guest_usetobe_*
  • Guest
NAV....Pah!!!

Click the link below for a free Antivirus . DO NOT CLICK ON TRIAL BUT ON THE INSTALLATION FILE IN THE ORANGE BOX.

AVG

Once installed and updated carry out full scan, then rescan with HJT and post the log back and we will then clear your nasty coolwebsearch infction.
  • 0

#9
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
I cleaned it out with AVG and here is my log. Thanks. What should i do next? I've noticed that virtual bouncer has also invaded my computer.

Logfile of HijackThis v1.99.1
Scan saved at 4:56:44 PM, on 6/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\program files\tvs\tvs_b.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINDOWS\GWMDMpi.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - Global Startup: MA521 Configuration Utility.lnk = ?
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com..._1/axofupld.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\acthz.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Net MD Simple Burner DB Access Service (mdrcdb) - Unknown owner - C:\Program Files\Sony\Net MD Simple Burner\mdrcdb.exe
O23 - Service: Net MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#10
Guest_usetobe_*

Guest_usetobe_*
  • Guest
Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

This will likely be a few step process in removing the malware that has infected your system. I encourage you to stick with it and follow my directions as closely as possible so as to avoid complicating the problem further.

You have a nasty CoolWebSearch infection. First we will need to download a few tools that will help us in the removal of your problem.

Download about:buster by RubbeRDuckY HERE
Download CWShredder Here.
Download SpSeHjfix Here.

Set PC to show hidden files (click link if you do not know how)LINK

Save all of these files somewhere you will remember like to the Desktop.

Unzip SpSeHjfix to its own folder (ie c:\SpSeHjfix)

Update About:Buster
  • Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
  • Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
  • Click "OK" at the prompt with instructions.
  • Click "Update" and then "Check For Update" to begin the update process.
  • If any updates exist please download them by clicking "Download Update" then click the X to close that window.
  • Now close About:Buster
Update CWShredder
  • Open CWShredder and click I AGREE
  • Click Check For Update
  • Close CWShredder
Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Please run about:buster by RubbeRDuckY:
  • Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
  • Click Yes to allow it to shutdown explorer.exe.
  • It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
  • When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
  • Reboot your computer into safe mode again
Run about:buster again following the same instructions as above, this time without the restart at the end

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

Now run SpSeHjfix. A log will be saved in the same folder that you put the exe into. Please post the results of that log in your next reply.

Warning Note: On a few occasions it has been reported that after using the SPSEHjfix you cannot open Internet Explorer. To fix this, go into Control Panel >Internet Options >Programs & press reset web settings, then you can set your home page to what you want on the general tab.

Now scan with HJT and check the following entries if they are there. Some may have been removed by earlier procedures.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R3 - Default URLSearchHook is missing
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\acthz.dll


Ensure no windows open except HJT and click FIX CHECKED.

now using windows explorer locate the following files/folders and delete them.

C:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\program files\tvs\ <<<---entire folder
C:\Program Files\Common Files\Java\flacpy.exe
C:\PROGRA~1\ezula\mmod.exe
C:\PROGRA~1\Web Offer\wo.exe
C:\Program Files\Ebates_MoeMoneyMaker\<<<--entire folder
C:\WINDOWS\system32\acthz.dll


Now run CleanUp!. Click CleanUp and allow it to delete all the temporary files.Reboot your computer into normal windows.

Please run an on-line virus scan at Panda Activescan(Please post the results of the scan(s) in your next reply)

Now run Ewido. click on the Scanner button, Select drives if you have more than one and then start.

grab a cup of coffee, sandwiches, book as this may take some time. Once the first problem is detected ensure you tick the box for all (bottom left) and allow it to continue.

At the end of the scan, it may ask if you would like to delete anything found in archive or zipped files, OK that request, then click on save report. SAVE to the default location, it will then generate a text file. Copy that to post in this thread.

Carry out another HJT scan and post the log back here, so we can sort out any remnants
  • 0

Advertisements


#11
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
I did everything you told me to do and below are the results.

Edited by evolnomis, 24 June 2005 - 11:23 PM.

  • 0

#12
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
SPSEH Post:

(6/22/05 5:09:52 PM) SPSeHjFix started v1.1.2
(6/22/05 5:09:52 PM) OS: WinXP Service Pack 1 (5.1.2600)
(6/22/05 5:09:52 PM) Language: english
(6/22/05 5:09:52 PM) Win-Path: C:\WINDOWS
(6/22/05 5:09:52 PM) System-Path: C:\WINDOWS\System32
(6/22/05 5:09:52 PM) Temp-Path: C:\DOCUME~1\Owner\LOCALS~1\Temp\
(6/22/05 5:09:57 PM) Disinfection started
(6/22/05 5:09:57 PM) Bad-Dll(IEP): (not found)
(6/22/05 5:09:57 PM) Bad-Dll(IEP) in BHO: (not found)
(6/22/05 5:09:57 PM) UBF: 7 - UBB: 0 - UBR: 20
(6/22/05 5:09:57 PM) UBF: 7 - UBB: 0 - UBR: 20
(6/22/05 5:09:57 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, CustomizeSearch:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
(6/22/05 5:09:57 PM) Stealth-String not found
(6/22/05 5:09:57 PM) Not infected->END
  • 0

#13
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
Panda Activescan Results:

Incident Status Location

Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iN420ihoe84c0.dll
Adware:Adware/eZula No disinfected Windows Registry
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\Downloaded Program Files\sporder_.dll
Adware:Adware/CWS No disinfected C:\Documents and Settings\Owner\Favorites\-Autos-
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\System32\PopOops*.dll
Adware:Adware/VirtualBouncer No disinfected C:\Documents and Settings\All Users\Application Data\VBouncer
Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\System32\nsvsvc\nsv.ocx
Adware:Adware/IPInsight No disinfected C:\WINDOWS\inf\farmmext.inf
Adware:Adware/ISearch No disinfected Windows Registry
Adware:Adware/Look2Me No disinfected C:\WINDOWS\System32\guard.tmp
Adware:Adware/IEPlugin No disinfected Windows Registry
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Owner\Favorites\Casino & Carrers
Adware:Adware/BTGrab No disinfected Windows Registry
Adware:Adware/Transponder No disinfected C:\WINDOWS\System32\mplay32.dll
Adware:Adware/BroadcastPC No disinfected C:\Program Files\Common Files\Java\tvs_re_inst.exe
Adware:Adware/DelFinMedia No disinfected C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe
Adware:Adware/AdDestroyer No disinfected C:\Program Files\VBouncer\BundleOuter.EXE
Adware:Adware/ISearch No disinfected C:\WINDOWS\delprot.ini
Adware:Adware/ISearch No disinfected C:\WINDOWS\deskbar.ini
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\Downloaded Program Files\sporder_.dll
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\casino.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\dating.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\drugs.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\fav.bmp
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\EliteToolBar\xml\images\virus.bmp
Adware:Adware/eZula No disinfected C:\WINDOWS\eZinstall.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\farmmext.ini
Adware:Adware/Look2Me No disinfected C:\WINDOWS\iconu.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\inf\dlmax.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\inf\farmmext.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\LastGood\farmmext.ini
Adware:Adware/Transponder No disinfected C:\WINDOWS\LastGood\INF\dlmax.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\LastGood\INF\dlmax.PNF
Adware:Adware/IPInsight No disinfected C:\WINDOWS\LastGood\INF\farmmext.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\LastGood\INF\farmmext.PNF
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ahsmsext.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ahupd.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\aotodisc.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\AQFV2.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\axycfilt.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\bzotvid.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cfmuid.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cpnsole.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\d2j02c1mgf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dgvvox.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\djcompos.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dJtime.dll
Spyware:Spyware/CouponAge No disinfected C:\WINDOWS\system32\docore.dll
Spyware:Spyware/CouponAge No disinfected C:\WINDOWS\system32\dosync.dll
Virus:Trj/Qhost.Y Disinfected C:\WINDOWS\system32\drivers\etc\hosts
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\eaentlog.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ehrol1931.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\en4ul1h91.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\en88l1lu1.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\enj6l11s1.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\enpol1731.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\enrol1931.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\eocapi.dll
Adware:Adware/eZula No disinfected C:\WINDOWS\system32\ezPopStub.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\FP20.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\fSultrep.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\g8400ihme84a0.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hr0605dse.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hr8805lue.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hrrq0595e.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hrru0599e.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\HSZc3212.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\i8420ihoe84c0.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\IftelNic.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iIlmrem.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iisutil.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ijitpki.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ilrdbg32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iLsnap.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iN420ihoe84c0.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\in50_32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\insutil.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ipfxdgps.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ir22l5fo1.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\isctl.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\izsecsnp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\j0n2la5o1d.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\j0p0la7m1d.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\j64olgh3164.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\jfpl400.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\jjpl400.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\jNn2la5o1d.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\jOvaee.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\k080lalm1dqa.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kcdbr.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kcuser.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kdd106.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kednecNT.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kidnecAT.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kldla.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kmdne.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kmdro.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\knuser.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kodnecAT.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kpdhu.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kpdru1.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ksdlv1.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ktjul7191.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kvdic.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kwdru.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kwdsf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kxdhept.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kydru1.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\l0p2la7o1d.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ldrmonui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ljadperf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lmadperf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lt2027fmg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lvjq0915e.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lvlo0933e.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lvr2099oe.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lvrm0991e.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lzadperf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\m0280afued280.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\m664lgjq16oe.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\m6julg1916.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mbimsg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mBjulg1916.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\meir3jp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mfiqtz32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mitlsapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\MkPMSNSv.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mlcomput.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\moxml.dll
Adware:Adware/Startpage.AAI No disinfected C:\WINDOWS\system32\mplay32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\MQIMUSIC.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mwxoci.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mYjulg1916.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mZpistub.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mzrecr40.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nfdll.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nktman.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nmdll.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nslanui.dll
Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\system32\nsvsvc\nsv.ocx
Adware:Adware/DelFinMedia No disinfected C:\WINDOWS\system32\nsvsvc\nsvs.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nutplwiz.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nxtman.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\o4pq0e75eh.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\oabccu32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\oobctrac.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\p0n80a5ued.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\p24ulch91f4.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pdwrprof.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pfisdecd.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pmbase.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\poisdecd.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\PopOops.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\PopOops2.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pvrfnet.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\qbsname.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rJssapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rqbdyctl.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rQsapi32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rzgapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\s6rslg9716.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sdarddlg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sdncui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sggina.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\silwoa.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sjarddlg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sjpblb.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\snhannel.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\SRDOCVW.DLL
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\SWLAD1.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\SWLAD2.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\tapmonui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\tEpiperf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\uerrtosa.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ufer32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ugerenv.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\uler32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ulrv42a.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\uprrtosa.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\utiime.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\uuiplat.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\vbmdbg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\vmrifier.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\VT5DB.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wapsrcwp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wbwfax.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wdnntbbu.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wFpsrcwp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wjnup2date.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wknotify.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\WlhRm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wmdmtpdr.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\woaaut.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS�
  • 0

#14
evolnomis

evolnomis

    Member

  • Topic Starter
  • Member
  • PipPip
  • 51 posts
Panda Activescan Continued:


Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wqv9vcm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wrsdmoe.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wspcd.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wwsdmod.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wxcltui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wyaaut.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wzavusd.dll
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\system32\xmlparse.dll
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\system32\xmltok.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\xvsp2res.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\zmpfldr.dll

EWIDO Post:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 2:58:19 PM, 6/25/2005
+ Report-Checksum: EE07C08F

+ Date of database: 6/14/2005
+ Version of scan engine: v3.0

+ Duration: 294 min
+ Scanned Files: 62351
+ Speed: 3.53 Files/Second
+ Infected files: 41
+ Removed files: 41
+ Files put in quarantine: 41
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\WINDOWS\system32\nxtman.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\oobctrac.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\p0n80a5ued.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\pdwrprof.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\PopOops.dll -> Spyware.VirtualBouncer.g -> Cleaned with backup
C:\WINDOWS\system32\PopOops2.dll -> Spyware.VirtualBouncer.g -> Cleaned with backup
C:\WINDOWS\system32\pvrfnet.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\qbsname.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\rqbdyctl.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\rQsapi32.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\rzgapi.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\s6rslg9716.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\sdarddlg.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\sdncui.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\sggina.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\SRDOCVW.DLL -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\SWLAD1.dll -> Spyware.VirtualBouncer.g -> Cleaned with backup
C:\WINDOWS\system32\SWLAD2.dll -> Spyware.VirtualBouncer.g -> Cleaned with backup
C:\WINDOWS\system32\tapmonui.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\tEpiperf.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\ugerenv.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\uler32.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\ulrv42a.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\uprrtosa.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\utiime.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\uuiplat.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\vbmdbg.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wdnntbbu.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wFpsrcwp.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wjnup2date.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wknotify.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\WlhRm.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wmdmtpdr.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\woaaut.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wrsdmoe.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wspcd.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wxcltui.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wyaaut.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\wzavusd.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\system32\zmpfldr.dll -> Spyware.Look2Me.ab -> Cleaned with backup
C:\WINDOWS\tdtb.exe -> Trojan.Imiserv.c -> Cleaned with backup


::Report End

HJT Post:

Logfile of HijackThis v1.99.1
Scan saved at 2:10:22 PM, on 6/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINDOWS\GWMDMpi.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - Global Startup: MA521 Configuration Utility.lnk = ?
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com..._1/axofupld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\guard.tmp (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Net MD Simple Burner DB Access Service (mdrcdb) - Unknown owner - C:\Program Files\Sony\Net MD Simple Burner\mdrcdb.exe
O23 - Service: Net MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\Net MD Simple Burner\NetMDSB.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



Thanks...
  • 0

#15
Guest_usetobe_*

Guest_usetobe_*
  • Guest
Boot PC into SAFE MODE, rescan with HJT and check the following entries.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\guard.tmp (file missing)


Ensure no windows open except HJT and click fix checked.

Now reboot pc normally,

Carry out another Panda Activescan. Save the lo.

Rescan with HJT and post both logs back
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP