Trojan-spy.HTML.Smitfraud.c [RESOLVED]
Started by
disturbd17
, Jun 30 2005 09:07 AM
#16
Posted 30 June 2005 - 07:21 PM
#17
Posted 30 June 2005 - 08:29 PM
Yeah, other than that everything seems fine. Should I just ignore this and say it's fixed?
#18
Posted 01 July 2005 - 11:43 AM
Could please log on to the account that still has problems and post a HiJackThis log from that account.
Thanks Tom
Thanks Tom
#19
Posted 01 July 2005 - 12:31 PM
This is his HJT:
Logfile of HijackThis v1.99.1
Scan saved at 2:28:55 PM, on 7/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\dell\bldbubg.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\windows\jaqqqnq.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\HijackThis.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\HPZipm12.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PtLiveUpdate] C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [seuubsp] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [mktsfua] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [dkjuucn] c:\windows\cnpplef.exe
O4 - HKCU\..\Run: [rnpbrbc] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [umhrxii] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [ltxctdl] c:\windows\qirvlos.exe
O4 - HKCU\..\Run: [jukcblh] c:\windows\dwxgltm.exe
O4 - HKCU\..\Run: [yreaepe] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vaxagpo] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ldotopu] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gnredbg] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [bivxgff] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [utyupir] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [erqbdhh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mfslita] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [dxhroba] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gudljfk] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [yojnfrh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mqngtkh] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ouwnnnq] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [tbgdhpr] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [emyqnjr] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bkjwdqt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vkxjree] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mypgvni] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [pjhuhdy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [aegbmxc] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [biklpjy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lmeqrvl] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fcovmmv] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [paavwvp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ojhojkj] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [qlssdsx] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [iuwbuur] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ijxmery] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fouvgxk] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ehnouds] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xuptwyy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xpfljro] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [oikfvga] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [saedelt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xypmnmc] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vyghgcp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [utrdjen] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lwuoqba] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ntcpojo] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bhtydih] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [nvxhhcp] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ahpprab] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [krnnbml] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [actqccp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [durliac] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [byvbqtn] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vrivjkb] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xlihpuv] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [lovetys] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [apochdm] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [jcwxlnt] c:\windows\vblrdxv.exe
O4 - HKCU\..\Run: [gvydqtn] c:\windows\yxhtxxc.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120143117000
O16 - DPF: {885BB46A-3F1E-44C3-A01B-A7D9260CC98B} (InstallShield Update Service Setup Player) - http://updates.insta...AB/dwusplay.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://24.97.55.102/...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Logfile of HijackThis v1.99.1
Scan saved at 2:28:55 PM, on 7/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\dell\bldbubg.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\windows\jaqqqnq.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\HijackThis.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\HPZipm12.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PtLiveUpdate] C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [seuubsp] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [mktsfua] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [dkjuucn] c:\windows\cnpplef.exe
O4 - HKCU\..\Run: [rnpbrbc] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [umhrxii] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [ltxctdl] c:\windows\qirvlos.exe
O4 - HKCU\..\Run: [jukcblh] c:\windows\dwxgltm.exe
O4 - HKCU\..\Run: [yreaepe] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vaxagpo] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ldotopu] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gnredbg] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [bivxgff] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [utyupir] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [erqbdhh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mfslita] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [dxhroba] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gudljfk] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [yojnfrh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mqngtkh] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ouwnnnq] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [tbgdhpr] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [emyqnjr] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bkjwdqt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vkxjree] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mypgvni] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [pjhuhdy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [aegbmxc] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [biklpjy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lmeqrvl] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fcovmmv] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [paavwvp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ojhojkj] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [qlssdsx] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [iuwbuur] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ijxmery] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fouvgxk] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ehnouds] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xuptwyy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xpfljro] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [oikfvga] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [saedelt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xypmnmc] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vyghgcp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [utrdjen] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lwuoqba] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ntcpojo] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bhtydih] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [nvxhhcp] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ahpprab] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [krnnbml] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [actqccp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [durliac] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [byvbqtn] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vrivjkb] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xlihpuv] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [lovetys] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [apochdm] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [jcwxlnt] c:\windows\vblrdxv.exe
O4 - HKCU\..\Run: [gvydqtn] c:\windows\yxhtxxc.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120143117000
O16 - DPF: {885BB46A-3F1E-44C3-A01B-A7D9260CC98B} (InstallShield Update Service Setup Player) - http://updates.insta...AB/dwusplay.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://24.97.55.102/...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
#20
Posted 01 July 2005 - 12:59 PM
Make sure you do this fix logged on to your brothers account.
[*]Reboot into Safe Mode: please see here if you are not sure how to do this.
[*]Please set your system to show
all files; please see here if you're unsure how to do this.
[*]Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [seuubsp] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [mktsfua] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [dkjuucn] c:\windows\cnpplef.exe
O4 - HKCU\..\Run: [rnpbrbc] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [umhrxii] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [ltxctdl] c:\windows\qirvlos.exe
O4 - HKCU\..\Run: [jukcblh] c:\windows\dwxgltm.exe
O4 - HKCU\..\Run: [yreaepe] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vaxagpo] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ldotopu] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gnredbg] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [bivxgff] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [utyupir] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [erqbdhh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mfslita] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [dxhroba] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gudljfk] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [yojnfrh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mqngtkh] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ouwnnnq] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [tbgdhpr] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [emyqnjr] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bkjwdqt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vkxjree] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mypgvni] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [pjhuhdy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [aegbmxc] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [biklpjy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lmeqrvl] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fcovmmv] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [paavwvp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ojhojkj] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [qlssdsx] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [iuwbuur] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ijxmery] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fouvgxk] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ehnouds] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xuptwyy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xpfljro] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [oikfvga] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [saedelt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xypmnmc] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vyghgcp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [utrdjen] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lwuoqba] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ntcpojo] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bhtydih] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [nvxhhcp] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ahpprab] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [krnnbml] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [actqccp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [durliac] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [byvbqtn] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vrivjkb] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xlihpuv] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [lovetys] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [apochdm] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [jcwxlnt] c:\windows\vblrdxv.exe
O4 - HKCU\..\Run: [gvydqtn] c:\windows\yxhtxxc.exe
Click on Fix Checked when finished and exit HijackThis.
Using Windows Explorer, locate the following files/folders, and delete them:
c:\windows\jaqqqnq.exe
c:\windows\cnpplef.exe
c:\windows\iqlpjge.exe
c:\windows\qirvlos.exe
c:\windows\dwxgltm.exe
c:\windows\nhxgqvt.exe
c:\windows\aamdgmh.exe
c:\windows\vblrdxv.exe
c:\windows\yxhtxxc.exe
Exit Explorer, and reboot as normal afterwards.
Post back a fresh HijackThis log and we will take another look.
[*]Reboot into Safe Mode: please see here if you are not sure how to do this.
[*]Please set your system to show
all files; please see here if you're unsure how to do this.
[*]Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [seuubsp] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [mktsfua] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [dkjuucn] c:\windows\cnpplef.exe
O4 - HKCU\..\Run: [rnpbrbc] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [umhrxii] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [ltxctdl] c:\windows\qirvlos.exe
O4 - HKCU\..\Run: [jukcblh] c:\windows\dwxgltm.exe
O4 - HKCU\..\Run: [yreaepe] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vaxagpo] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ldotopu] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gnredbg] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [bivxgff] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [utyupir] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [erqbdhh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mfslita] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [dxhroba] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gudljfk] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [yojnfrh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mqngtkh] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ouwnnnq] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [tbgdhpr] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [emyqnjr] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bkjwdqt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vkxjree] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mypgvni] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [pjhuhdy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [aegbmxc] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [biklpjy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lmeqrvl] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fcovmmv] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [paavwvp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ojhojkj] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [qlssdsx] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [iuwbuur] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ijxmery] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fouvgxk] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ehnouds] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xuptwyy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xpfljro] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [oikfvga] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [saedelt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xypmnmc] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vyghgcp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [utrdjen] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lwuoqba] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ntcpojo] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bhtydih] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [nvxhhcp] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ahpprab] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [krnnbml] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [actqccp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [durliac] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [byvbqtn] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vrivjkb] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xlihpuv] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [lovetys] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [apochdm] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [jcwxlnt] c:\windows\vblrdxv.exe
O4 - HKCU\..\Run: [gvydqtn] c:\windows\yxhtxxc.exe
Click on Fix Checked when finished and exit HijackThis.
Using Windows Explorer, locate the following files/folders, and delete them:
c:\windows\jaqqqnq.exe
c:\windows\cnpplef.exe
c:\windows\iqlpjge.exe
c:\windows\qirvlos.exe
c:\windows\dwxgltm.exe
c:\windows\nhxgqvt.exe
c:\windows\aamdgmh.exe
c:\windows\vblrdxv.exe
c:\windows\yxhtxxc.exe
Exit Explorer, and reboot as normal afterwards.
Post back a fresh HijackThis log and we will take another look.
#21
Posted 01 July 2005 - 01:16 PM
Logfile of HijackThis v1.99.1
Scan saved at 3:14:12 PM, on 7/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\dell\bldbubg.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\HijackThis.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PtLiveUpdate] C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120143117000
O16 - DPF: {885BB46A-3F1E-44C3-A01B-A7D9260CC98B} (InstallShield Update Service Setup Player) - http://updates.insta...AB/dwusplay.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://24.97.55.102/...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Scan saved at 3:14:12 PM, on 7/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\dell\bldbubg.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\HijackThis.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PtLiveUpdate] C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120143117000
O16 - DPF: {885BB46A-3F1E-44C3-A01B-A7D9260CC98B} (InstallShield Update Service Setup Player) - http://updates.insta...AB/dwusplay.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://24.97.55.102/...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
#22
Posted 01 July 2005 - 01:21 PM
Are you still having problems?
#23
Posted 01 July 2005 - 01:23 PM
Yeah I am.
#24
Posted 01 July 2005 - 01:47 PM
I need you to do the fix below logged into the profile that is still having the problems.
Follow the instructions below.
Please RIGHT-CLICK: HERE and go to Save As (in Internet Explorer it's "Save Target As") in order to download Grinler's reg file. Save it to your desktop.
Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.
Please let me know if everything is OK in your next post.
Follow the instructions below.
Please RIGHT-CLICK: HERE and go to Save As (in Internet Explorer it's "Save Target As") in order to download Grinler's reg file. Save it to your desktop.
Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.
Please let me know if everything is OK in your next post.
Edited by TomNJ, 01 July 2005 - 01:50 PM.
#25
Posted 01 July 2005 - 05:25 PM
That one was the ticket. Thank you very much for all your help. If I ever have another problem I will come straight here.
#26
Posted 03 July 2005 - 02:41 PM
You are very welcome. Don't forget to Protect your system. Follw the instructions I posted earlier.
#27
Posted 04 July 2005 - 06:27 AM
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users