[hatred247]

I got this by X-ing a banner ad to get rid of it. I saw the cammand prompt open for a second and that was the end of my PC. I have ewido and ad aware se pro they do not do any good. So what can I do? Here is the HJT log. Logfile of HijackThis v1.99.1
Scan saved at 2:16:31 PM, on 6/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Rage3DTweak\RegTwk.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Documents and Settings\PeerGuardian2\pg2.exe
C:\WINDOWS\explorer.exe
c:\windows\system32\shgixsv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jake\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/
O1 - Hosts: 69.20.30.75 auto.search.msn.com
O1 - Hosts: 69.20.30.75 search.netscape.com
O1 - Hosts: 69.20.30.75 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RegTweak] C:\Program Files\Rage3DTweak\RegTwk.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MwsmRRH2R] uliks.exe
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O8 - Extra context menu item: &Google Search - res://c:\windows\GoogleToolbar_en_2.0.114-big.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar_en_2.0.114-big.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar_en_2.0.114-big.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar_en_2.0.114-big.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\GoogleToolbar_en_2.0.114-big.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Zoom ...1000% - C:\WINDOWS\web\zoom1000.htm
O8 - Extra context menu item: Zoom 100% - C:\WINDOWS\web\zoom100.htm
O8 - Extra context menu item: Zoom 200% - C:\WINDOWS\web\zoom200.htm
O8 - Extra context menu item: Zoom 300% - C:\WINDOWS\web\zoom300.htm
O8 - Extra context menu item: Zoom 400% - C:\WINDOWS\web\zoom400.htm
O8 - Extra context menu item: Zoom 500% - C:\WINDOWS\web\zoom500.htm
O8 - Extra context menu item: Zoom 600% - C:\WINDOWS\web\zoom600.htm
O8 - Extra context menu item: Zoom 700% - C:\WINDOWS\web\zoom700.htm
O8 - Extra context menu item: Zoom 800% - C:\WINDOWS\web\zoom800.htm
O8 - Extra context menu item: Zoom 900% - C:\WINDOWS\web\zoom900.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Filter: text/html - {2DE94081-9FE6-4227-BC59-B7A80CC8308C} - C:\Program Files\ClientMan\run\searchrep887fa403.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Edited by hatred247, 20 June 2005 - 12:23 PM.

[Advertisements]

I might have got it myself. I stumbled on to this so let me know if this is good. I used killbox to try and delete the random .exe file that just comes back in the task manager window with the end explorer shell while killing file checked on killbox. when I killed the file with whatever name it was under at the time I noticed that an imapi.exe would pop up in the task manager window for about 3 seconds before the random named .exe file would come back. I ran a search for all imapi.exe files and deleted them all. there was a windows warning but I proceeded anyway. The random file was gone. Then I deleted all the aurora and nail.exe files I could find. Finally I ran ad aware and ewido to clean up the rest. So far it seems like it is gone and everything is still working. Is there something more I should be looking for to keep aurora from coming back?

[hatred247]

I might have got it myself. I stumbled on to this so let me know if this is good. I used killbox to try and delete the random .exe file that just comes back in the task manager window with the end explorer shell while killing file checked on killbox. when I killed the file with whatever name it was under at the time I noticed that an imapi.exe would pop up in the task manager window for about 3 seconds before the random named .exe file would come back. I ran a search for all imapi.exe files and deleted them all. there was a windows warning but I proceeded anyway. The random file was gone. Then I deleted all the aurora and nail.exe files I could find. Finally I ran ad aware and ewido to clean up the rest. So far it seems like it is gone and everything is still working. Is there something more I should be looking for to keep aurora from coming back?