[Whitefire]

Ok so my computers connected to that god [bleep] abi network and i was wondering if someone could read my hijack log and tell me what else is wrong

ive used

ad aware
avg
spybot search and deystroy
killme2
about buster
clean up
and ive downloaded and updated ewido

ive turned off my system restore and restarted in windows safe mode and then used all the programs again i just need someone to tell me what else to do..

I would really appreciate help thanks


heres my hijack log

Logfile of HijackThis v1.99.1
Scan saved at 10:51:49 p.m., on 20/06/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Documents and Settings\Adam\Desktop\Hijack\security suite\ewidoctrl.exe
C:\WINDOWS\System32\pctspk.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-nz\msnappau.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Documents and Settings\Adam\Desktop\Hijack\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc16.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Rmvjh\Wzdqn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\windows\system32\pqwsfo.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\WindowsMedia9-KB885492-x86-ENU.exe
d:\39ebd0b25995f51e6969\update\update.exe
C:\WINDOWS\System32\wuauclt.exe
C:\DOCUME~1\Adam\LOCALS~1\Temp\OFN\aurareco.exe
C:\Documents and Settings\Adam\Desktop\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.activebass.com/
R3 - URLSearchHook: (no name) - {52DFBEF7-29D5-4E0F-1D16-792E516C924F} - sysmon12.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\gamlq.dll
O2 - BHO: Internet Explorer Hot Fix - {1A4A7CFF-D60F-4CCD-868D-70D62215D024} - C:\WINDOWS\System32\eaofa.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-nz\msntb.dll
O3 - Toolbar: xtramsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-nz\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\gamlq.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [KAZAA] "C:\Program Files\Kazaa Lite K++\kpp.exe" "C:\Program Files\Kazaa Lite K++\Kazaa.kpp" /SYSTRAY
O4 - HKLM\..\Run: [CornTest] C:\PROGRA~1\flaw enc balm\Wave Bore Creative.exe
O4 - HKLM\..\Run: [2E8A1D5E] C:\WINDOWS\System32\qivhkc.exe
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\egyabj.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-nz\msnappau.exe"
O4 - HKLM\..\Run: [ywqklqoofvl] C:\WINDOWS\System32\pusczg.exe
O4 - HKLM\..\Run: [Windows media service] crvss.exe
O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [Services] C:\winset.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Video Driver] nvsvc16.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [Yjmkole] C:\Program Files\Rmvjh\Wzdqn.exe
O4 - HKLM\..\Run: [Stop-Sign_Install_Recovery] C:\DOCUME~1\Adam\LOCALS~1\Temp\ss_stopsign.exe -k
O4 - HKLM\..\Run: [_ctcp] defect08.exe
O4 - HKLM\..\Run: [borlandg] PasswdMon.exe
O4 - HKLM\..\Run: [jpbeni] c:\windows\system32\pqwsfo.exe r
O4 - HKLM\..\RunServices: [78F0A56C] C:\WINDOWS\System32\qivhkc.exe
O4 - HKLM\..\RunServices: [Windows media service] crvss.exe
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [Video Driver] nvsvc16.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [NukeSpan] Kargo.exe
O4 - HKCU\..\Run: [backd] Trayz.exe
O4 - HKCU\..\Run: [defect08] dePloy.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - http://bar.mywebsear...?p=ZNxuk169YYNZ
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c293.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...up1.0.0.8-2.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14....es/MsnPUpld.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory....sharingctrl.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamesp...nch/alaunch.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/d...onale_ver10.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/d...onale_ver11.CAB
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.host...ler/1019465.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/p...t/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E6EF4E0-A9A1-4333-8977-3C5067A26826}: NameServer = 69.50.184.84 195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B41E3E4-6F56-4716-BA82-1586E105D036}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{ECFF8F98-69BE-40ED-A311-2965DB08F05D}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CS1\Services\Tcpip\..\{2E6EF4E0-A9A1-4333-8977-3C5067A26826}: NameServer = 69.50.184.84 195.225.176.37
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Adam\Desktop\Hijack\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\Adam\Desktop\Hijack\security suite\ewidoguard.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)

[Advertisements]

Hi Whitefire,

Please do not turn off System Restore till you are told to do so. Turning it off before doing a fix and then proceeding with deleting files etc. could result in your PC crashing and u having no System restore points to fall back upon. Please ensure that the System Retore is turned on and then reboot the PC !!!!!!!!!!!


I am working on a fix and will revert to you !!!

[tampabelle]

Hi Whitefire,

Please do not turn off System Restore till you are told to do so. Turning it off before doing a fix and then proceeding with deleting files etc. could result in your PC crashing and u having no System restore points to fall back upon. Please ensure that the System Retore is turned on and then reboot the PC !!!!!!!!!!!


I am working on a fix and will revert to you !!!

[tampabelle]

Hi Whitefire,

Please print out these instructions or copy them into a text file on your Desktop for easy access.

During the fix, u will be asked to fix some entries, delete some files or uninstall some programs. If in case, you do not see those entries / files / programs, please make a note of it. Continue with the fix and in your next post please inform me of all deviations from the fix prescribed.

1. Download Programs

Download CleanUp from here and save it on your Desktop.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

2. Remove Infections

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Run CleanUp. Delete all temp files including temporary internet files.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

3. Run Hijack This

Run HijackThis, click Scan :

R3 - URLSearchHook: (no name) - {52DFBEF7-29D5-4E0F-1D16-792E516C924F} - sysmon12.dll (file missing)
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\gamlq.dll
O2 - BHO: Internet Explorer Hot Fix - {1A4A7CFF-D60F-4CCD-868D-70D62215D024} - C:\WINDOWS\System32\eaofa.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\gamlq.dll
O4 - HKLM\..\Run: [CornTest] C:\PROGRA~1\flaw enc balm\Wave Bore Creative.exe
O4 - HKLM\..\Run: [2E8A1D5E] C:\WINDOWS\System32\qivhkc.exe
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\egyabj.exe
O4 - HKLM\..\Run: [ywqklqoofvl] C:\WINDOWS\System32\pusczg.exe
O4 - HKLM\..\Run: [Windows media service] crvss.exe
O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [Services] C:\winset.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Video Driver] nvsvc16.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [Yjmkole] C:\Program Files\Rmvjh\Wzdqn.exe
O4 - HKLM\..\Run: [Stop-Sign_Install_Recovery] C:\DOCUME~1\Adam\LOCALS~1\Temp\ss_stopsign.exe -k
O4 - HKLM\..\Run: [_ctcp] defect08.exe
O4 - HKLM\..\Run: [borlandg] PasswdMon.exe
O4 - HKLM\..\Run: [jpbeni] c:\windows\system32\pqwsfo.exe r
O4 - HKLM\..\RunServices: [78F0A56C] C:\WINDOWS\System32\qivhkc.exe
O4 - HKLM\..\RunServices: [Windows media service] crvss.exe
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [Video Driver] nvsvc16.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [NukeSpan] Kargo.exe
O4 - HKCU\..\Run: [backd] Trayz.exe
O4 - HKCU\..\Run: [defect08] dePloy.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - http://bar.mywebsear...?p=ZNxuk169YYNZ
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c293.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...up1.0.0.8-2.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory....sharingctrl.cab
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/d...onale_ver10.CAB
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/d...onale_ver11.CAB
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.host...ler/1019465.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)

Close all open windows except for HijackThis. Check the boxes next to above items and click on fix checked.

4. Uninstall Rogue Programs

Open Add/ Remove Programs (click on Start ---> Settings ---> Control Panel. This should be the 3rd item). Uninstall / remove the following items -

Messenger Plus
Wareout

Close all Windows.

5. Delete Rogue files

Open Windows Explorer (right click on Start and then click on explore). Navigate and delete the followiwng folders and files -

C:\Program Files\flaw enc balm
C:\Program Files\Messenger Plus!3
C:\Program Files\WareOut

C:\winset.exe
C:\Program Files\AdTools Service
C:\Program Files\Rmvjh\Wzdqn.exe
C:\WINDOWS\zeta.exe
C:\WINDOWS\System32\gamlq.dll
C:\WINDOWS\System32\eaofa.dll
C:\WINDOWS\System32\qivhkc.exe
C:\WINDOWS\System32\egyabj.exe
C:\WINDOWS\System32\pusczg.exe
c:\windows\system32\pqwsfo.exe
syslog32.exe
crvss.exe
sres32.exe
defect08.exe
PasswdMon.exe
Kargo.exe
Trayz.exe
dePloy.exe

d:\39ebd0b25995f51e6969\update\update.exe

Reboot the PC in Normal Mode.

6. Online Scan

Please visit Kaspersky and do an online scan.


Run Hijack This and click on Scan. Post the logs from Hijack This, Ewido and Kaspersky here.

[Whitefire]

so kaspersky is down so im going to use trendmicro instead..

[tampabelle]

Thats fine

[tampabelle]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.