Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Trojan-spy.HTML.Smitfraud.c [RESOLVED]


  • This topic is locked This topic is locked

#16
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Even after the reg repair?
  • 0

Advertisements


#17
disturbd17

disturbd17

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
Yeah, other than that everything seems fine. Should I just ignore this and say it's fixed?
  • 0

#18
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Could please log on to the account that still has problems and post a HiJackThis log from that account.

Thanks Tom
  • 0

#19
disturbd17

disturbd17

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
This is his HJT:

Logfile of HijackThis v1.99.1
Scan saved at 2:28:55 PM, on 7/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\dell\bldbubg.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\windows\jaqqqnq.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\HijackThis.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\HPZipm12.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PtLiveUpdate] C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [seuubsp] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [mktsfua] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [dkjuucn] c:\windows\cnpplef.exe
O4 - HKCU\..\Run: [rnpbrbc] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [umhrxii] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [ltxctdl] c:\windows\qirvlos.exe
O4 - HKCU\..\Run: [jukcblh] c:\windows\dwxgltm.exe
O4 - HKCU\..\Run: [yreaepe] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vaxagpo] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ldotopu] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gnredbg] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [bivxgff] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [utyupir] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [erqbdhh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mfslita] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [dxhroba] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gudljfk] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [yojnfrh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mqngtkh] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ouwnnnq] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [tbgdhpr] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [emyqnjr] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bkjwdqt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vkxjree] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mypgvni] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [pjhuhdy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [aegbmxc] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [biklpjy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lmeqrvl] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fcovmmv] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [paavwvp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ojhojkj] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [qlssdsx] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [iuwbuur] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ijxmery] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fouvgxk] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ehnouds] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xuptwyy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xpfljro] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [oikfvga] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [saedelt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xypmnmc] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vyghgcp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [utrdjen] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lwuoqba] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ntcpojo] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bhtydih] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [nvxhhcp] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ahpprab] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [krnnbml] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [actqccp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [durliac] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [byvbqtn] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vrivjkb] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xlihpuv] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [lovetys] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [apochdm] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [jcwxlnt] c:\windows\vblrdxv.exe
O4 - HKCU\..\Run: [gvydqtn] c:\windows\yxhtxxc.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120143117000
O16 - DPF: {885BB46A-3F1E-44C3-A01B-A7D9260CC98B} (InstallShield Update Service Setup Player) - http://updates.insta...AB/dwusplay.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://24.97.55.102/...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#20
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Make sure you do this fix logged on to your brothers account.

[*]Reboot into Safe Mode: please see here if you are not sure how to do this.

[*]Please set your system to show
all files; please see here if you're unsure how to do this.

[*]Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [seuubsp] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [mktsfua] c:\windows\jaqqqnq.exe
O4 - HKCU\..\Run: [dkjuucn] c:\windows\cnpplef.exe
O4 - HKCU\..\Run: [rnpbrbc] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [umhrxii] c:\windows\iqlpjge.exe
O4 - HKCU\..\Run: [ltxctdl] c:\windows\qirvlos.exe
O4 - HKCU\..\Run: [jukcblh] c:\windows\dwxgltm.exe
O4 - HKCU\..\Run: [yreaepe] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vaxagpo] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ldotopu] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gnredbg] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [bivxgff] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [utyupir] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [erqbdhh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mfslita] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [dxhroba] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [gudljfk] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [yojnfrh] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mqngtkh] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ouwnnnq] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [tbgdhpr] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [emyqnjr] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bkjwdqt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vkxjree] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [mypgvni] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [pjhuhdy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [aegbmxc] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [biklpjy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lmeqrvl] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fcovmmv] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [paavwvp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ojhojkj] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [qlssdsx] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [iuwbuur] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ijxmery] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [fouvgxk] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ehnouds] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xuptwyy] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xpfljro] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [oikfvga] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [saedelt] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [xypmnmc] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [vyghgcp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [utrdjen] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [lwuoqba] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [ntcpojo] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [bhtydih] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [nvxhhcp] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [ahpprab] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [krnnbml] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [actqccp] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [durliac] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [byvbqtn] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [vrivjkb] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [xlihpuv] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [lovetys] c:\windows\nhxgqvt.exe
O4 - HKCU\..\Run: [apochdm] c:\windows\aamdgmh.exe
O4 - HKCU\..\Run: [jcwxlnt] c:\windows\vblrdxv.exe
O4 - HKCU\..\Run: [gvydqtn] c:\windows\yxhtxxc.exe


Click on Fix Checked when finished and exit HijackThis.

Using Windows Explorer, locate the following files/folders, and delete them:

c:\windows\jaqqqnq.exe
c:\windows\cnpplef.exe
c:\windows\iqlpjge.exe
c:\windows\qirvlos.exe
c:\windows\dwxgltm.exe
c:\windows\nhxgqvt.exe
c:\windows\aamdgmh.exe
c:\windows\vblrdxv.exe
c:\windows\yxhtxxc.exe


Exit Explorer, and reboot as normal afterwards.

Post back a fresh HijackThis log and we will take another look.
  • 0

#21
disturbd17

disturbd17

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
Logfile of HijackThis v1.99.1
Scan saved at 3:14:12 PM, on 7/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\dell\bldbubg.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\HijackThis.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PtLiveUpdate] C:\Program Files\Common Files\Pumatech Shared\LiveUpdate Client\PtLUWorker.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....204&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120143117000
O16 - DPF: {885BB46A-3F1E-44C3-A01B-A7D9260CC98B} (InstallShield Update Service Setup Player) - http://updates.insta...AB/dwusplay.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://24.97.55.102/...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.co...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

#22
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Are you still having problems?
  • 0

#23
disturbd17

disturbd17

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
Yeah I am.
  • 0

#24
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
I need you to do the fix below logged into the profile that is still having the problems.

Follow the instructions below.

Please RIGHT-CLICK: HERE and go to Save As (in Internet Explorer it's "Save Target As") in order to download Grinler's reg file. Save it to your desktop.

Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.

Please let me know if everything is OK in your next post.

Edited by TomNJ, 01 July 2005 - 01:50 PM.

  • 0

#25
disturbd17

disturbd17

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
That one was the ticket. Thank you very much for all your help. If I ever have another problem I will come straight here.
  • 0

Advertisements


#26
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
You are very welcome. Don't forget to Protect your system. Follw the instructions I posted earlier.
  • 0

#27
TomNJ

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP