[rsbrazil]

Hi, I can't open Internet Explorer. Here is the HijackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 8:26:53 AM, on 8/18/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.exe
C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINNT\loadqm.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
D:\bin\iPodManager.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\bin\iPodService.exe
D:\programs\opera.exe
D:\programs\Download\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINNT\System32\sfg_1f4c.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINNT\Downloaded Program Files\gbieh.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP CD-Writer] C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RegTony] C:\WINNT\SYSTEM32\REGTONY.EXE
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [iPodManager] D:\bin\iPodManager.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Popup Defence Updater] regsvr32 /s C:\WINNT\System32\pdfupd.dll
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINNT\System32\sfg_1f4c.dll"
O4 - HKLM\..\Run: [THGuard] "D:\programs\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\RunServices: [RegTony] C:\WINNT\SYSTEM32\REGTONY.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpyKiller] D:\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINNT\System32\sfg_1f4c.dll"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancob.../GbPluginBb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{73126032-F9D0-4615-B794-155F380FEDE2}: NameServer = 207.110.0.60
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - D:\bin\iPodService.exe

Thanks!!!!!

[Advertisements]

Hi rsbrazil, welcome to GeeksToGo

Sorry for the delay in responding. I'd like you to submit a file for analysis before we take action.

Jotti File Submission:

• Please go to Jotti's malware scan
  
• Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
  
  • C:\WINNT\SYSTEM32\REGTONY.EXE
• Click on the submit button
  
• Please post the results in your next reply.

Go to Start>Run and type the following lines hitting OK afterwards.Note the spaces before the slash and after u

regsvr32 /u pdfupd.dll
regsvr32 /u sfg_1f4c.dll

Open HijackThis and click Scan. Put a check next to these:

O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINNT\System32\sfg_1f4c.dll
O4 - HKLM\..\Run: [Popup Defence Updater] regsvr32 /s C:\WINNT\System32\pdfupd.dll
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINNT\System32\sfg_1f4c.dll"
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINNT\System32\sfg_1f4c.dll"
O17 - HKLM\System\CCS\Services\Tcpip\..\{73126032-F9D0-4615-B794-155F380FEDE2}: NameServer = 207.110.0.60 This IP adress corresponds to ns.connectnet.com and is owned by XO Communications. If this is your ISP or your network, leave this entry alone, otherwise fix it.

And this one is an optional:

O4 - HKCU\..\Run: [SpyKiller] D:\SpyKiller\spykiller.exe /startup This one is on rouge/suspect antispyware list. See this page for information on SpyKiller. I recommend that you fix this entry and uninstall it from Control Panel.

Close all windows except HijackThis and click Fix Checked.

Then navigate to these files and delete them. The first one may be gone already.

C:\WINNT\System32\sfg_1f4c.dll
C:\WINNT\System32\pdfupd.dll

If you decided to remove Spykiller, uninstall it from Control Panel Add/Remove Programs and then delete this folder:

D:\SpyKiller

Then reboot. Go here and make an online scan using the browser you are using now.

Please go to the TrendMicro website HERE

• Click Check my PC now
• On the next page it will verify that Trendmicro scan can be run.
• There should be 4 green checkmarks, if any of them stay a red X please let me know which one(s)
• Read the agreement, then click continue with Next Step
• Wait for the scanner to load, if you get a security warning about the Trend-Micro applet, click YES
• It will install "Core-Packages", then please run a full system scan - let me know how many infected items it found and if any of them couldn't be cleaned/deleted and the name/location. Also pay attention if that Regtony.exe file was deleted.

Reboot again, then post a new log, the Jotti results and list any files TrendMicro couldn't delete.

[Armodeluxe]

Hi rsbrazil, welcome to GeeksToGo

Sorry for the delay in responding. I'd like you to submit a file for analysis before we take action.

Jotti File Submission:

• Please go to Jotti's malware scan
  
• Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
  
  • C:\WINNT\SYSTEM32\REGTONY.EXE
• Click on the submit button
  
• Please post the results in your next reply.

Go to Start>Run and type the following lines hitting OK afterwards.Note the spaces before the slash and after u

regsvr32 /u pdfupd.dll
regsvr32 /u sfg_1f4c.dll

Open HijackThis and click Scan. Put a check next to these:

O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINNT\System32\sfg_1f4c.dll
O4 - HKLM\..\Run: [Popup Defence Updater] regsvr32 /s C:\WINNT\System32\pdfupd.dll
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINNT\System32\sfg_1f4c.dll"
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINNT\System32\sfg_1f4c.dll"
O17 - HKLM\System\CCS\Services\Tcpip\..\{73126032-F9D0-4615-B794-155F380FEDE2}: NameServer = 207.110.0.60 This IP adress corresponds to ns.connectnet.com and is owned by XO Communications. If this is your ISP or your network, leave this entry alone, otherwise fix it.

And this one is an optional:

O4 - HKCU\..\Run: [SpyKiller] D:\SpyKiller\spykiller.exe /startup This one is on rouge/suspect antispyware list. See this page for information on SpyKiller. I recommend that you fix this entry and uninstall it from Control Panel.

Close all windows except HijackThis and click Fix Checked.

Then navigate to these files and delete them. The first one may be gone already.

C:\WINNT\System32\sfg_1f4c.dll
C:\WINNT\System32\pdfupd.dll

If you decided to remove Spykiller, uninstall it from Control Panel Add/Remove Programs and then delete this folder:

D:\SpyKiller

Then reboot. Go here and make an online scan using the browser you are using now.

Please go to the TrendMicro website HERE

• Click Check my PC now
• On the next page it will verify that Trendmicro scan can be run.
• There should be 4 green checkmarks, if any of them stay a red X please let me know which one(s)
• Read the agreement, then click continue with Next Step
• Wait for the scanner to load, if you get a security warning about the Trend-Micro applet, click YES
• It will install "Core-Packages", then please run a full system scan - let me know how many infected items it found and if any of them couldn't be cleaned/deleted and the name/location. Also pay attention if that Regtony.exe file was deleted.

Reboot again, then post a new log, the Jotti results and list any files TrendMicro couldn't delete.

[Armodeluxe]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.