[delno2005]

Logfile of HijackThis v1.99.1
Scan saved at 3:28:38 PM, on 10/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crbu.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe
C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\NuCam\CamCheck\CamCheck.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\apiff32.exe
C:\WINDOWS\System32\intell32.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\svcnvt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration Utility\utility.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\AOL\110654~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\110654~1\EE\AOLServiceHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lurk Nasty\Desktop\sp1aexpress_usa.exe
c:\b1d\update\update.exe
C:\WINDOWS\System32\cleanmgr.exe
C:\Documents and Settings\Lurk Nasty\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdocnvt.dll/blank.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {3428818B-50B8-001E-0872-C41BAD172E15} - C:\WINDOWS\system32\netwd32.dll
O2 - BHO: Class - {3698678C-C5F1-2B0F-7784-86A3A0B91EC5} - C:\WINDOWS\mfciu32.dll
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: Class - {66E0BB58-5F1A-3C89-6233-F802B7FF6A3B} - C:\WINDOWS\apimh.dll
O2 - BHO: Class - {674D012F-6A8F-3061-C6A3-EAEE4CA2D4CA} - C:\WINDOWS\msws.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {AEAB8016-5094-74F5-8E87-1A38A180680D} - C:\WINDOWS\system32\sdkrt32.dll
O2 - BHO: Class - {B9FBCC0E-658E-7FF9-97B0-FE0DA15F0299} - C:\WINDOWS\system32\mfcjv32.dll
O2 - BHO: Class - {BA50DA44-7645-C1B0-1681-1C13EBB65669} - C:\WINDOWS\system32\netyl.dll
O2 - BHO: Class - {FF821169-5E94-6256-7895-F4D785DD878A} - C:\WINDOWS\system32\sdkrt32.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1106548832\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CamCheck] C:\Program Files\NuCam\CamCheck\CamCheck.exe
O4 - HKLM\..\Run: [#1 Spyware Killer] C:\Program Files\#1SpywareKillerv2.1\#1 Spyware Killer.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [apiff32.exe] C:\WINDOWS\system32\apiff32.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Fast Home] C:\WINDOWS\system32\svcnvt.exe home
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Belkin 802.11g Wireless Card Utility.lnk = ?
O8 - Extra context menu item: &Search - http://kl.bar.need2f...earch.html?p=KL
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Home Prefix: http://bla.troyanov.net/gall.php?url=
O13 - Mosaic Prefix: http://bla.troyanov.net/gall.php?url=
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...e/bridge-c9.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberli...xp/CheckDVD.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\crbu.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: Blink2PnP - Unknown owner - C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

heres the log,can anyone help?this is a very annoying virus!thanks

[Advertisements]

Hi delno2005 and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time. DO NOT UPGRADE TO SP2 AT THIS TIME

• Click HERE for the update.
  
• Apply the update.
• REBOOT YOUR SYSTEM

2. Please DELETE your current HJT program from its present location.

3. Download and run the following HijackThis autoinstall program from Here HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

A. Close ALL windows except HJT

B. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

C. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER


Regards,

Trevuren

[Trevuren]

Hi delno2005 and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time. DO NOT UPGRADE TO SP2 AT THIS TIME

• Click HERE for the update.
  
• Apply the update.
• REBOOT YOUR SYSTEM

2. Please DELETE your current HJT program from its present location.

3. Download and run the following HijackThis autoinstall program from Here HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

A. Close ALL windows except HJT

B. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

C. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER


Regards,

Trevuren

[delno2005]

Logfile of HijackThis v1.99.1
Scan saved at 6:48:11 AM, on 10/8/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crbu.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe
C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\AOL\110654~1\EE\AOLHOS~1.EXE
C:\Program Files\NuCam\CamCheck\CamCheck.exe
C:\PROGRA~1\COMMON~1\AOL\110654~1\EE\AOLServiceHost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\intell32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\mfcfn32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration Utility\utility.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {03366A3D-41F9-DA72-3EB8-2B95B53BE1FE} - C:\WINDOWS\system32\msem32.dll
O2 - BHO: Class - {3428818B-50B8-001E-0872-C41BAD172E15} - C:\WINDOWS\system32\netwd32.dll
O2 - BHO: Class - {3698678C-C5F1-2B0F-7784-86A3A0B91EC5} - C:\WINDOWS\mfciu32.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: Class - {66E0BB58-5F1A-3C89-6233-F802B7FF6A3B} - C:\WINDOWS\apimh.dll
O2 - BHO: Class - {674D012F-6A8F-3061-C6A3-EAEE4CA2D4CA} - C:\WINDOWS\msws.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {AEAB8016-5094-74F5-8E87-1A38A180680D} - C:\WINDOWS\system32\sdkrt32.dll
O2 - BHO: Class - {B9FBCC0E-658E-7FF9-97B0-FE0DA15F0299} - C:\WINDOWS\system32\mfcjv32.dll
O2 - BHO: Class - {BA50DA44-7645-C1B0-1681-1C13EBB65669} - C:\WINDOWS\system32\netyl.dll
O2 - BHO: Class - {FF821169-5E94-6256-7895-F4D785DD878A} - C:\WINDOWS\system32\sdkrt32.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1106548832\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CamCheck] C:\Program Files\NuCam\CamCheck\CamCheck.exe
O4 - HKLM\..\Run: [#1 Spyware Killer] C:\Program Files\#1SpywareKillerv2.1\#1 Spyware Killer.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [apiff32.exe] C:\WINDOWS\system32\apiff32.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Fast Home] C:\WINDOWS\system32\svcnvt.exe home
O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe
O4 - HKLM\..\Run: [mfcfn32.exe] C:\WINDOWS\system32\mfcfn32.exe
O4 - HKLM\..\Run: [atlqb.exe] C:\WINDOWS\system32\atlqb.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Belkin 802.11g Wireless Card Utility.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...e/bridge-c9.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberli...xp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1128726807527
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1128726775320
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\crbu.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: Blink2PnP - Unknown owner - C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[Trevuren]

Your system is infected with a very serious CWS About Blank infection as well as with a PSGuard infection and miscellaneous trojans adware and spyware. The cleanup has to be quite radical and the infections dealt with seperately.

Your system is infected with a variant of the About:Blank infection.

• First we must STOP, and Disable a bad Added Service
  • Click Start>Run and type in: services.msc
  • Click OK
  • In the Services window find: Network Security Service (NSS)
  • Select/highlight and right click the entry, and choose: Properties
  • On the General tab, under Service Status click the Stop button
  • Beside: Startup Type, in the drop menu, select: Disabled
  • Click Apply, then OK
• Download CWShredder
  Click check for updates. Do not use it yet.
  
  
• Download About Buster from the attachment provided with this post Do not use it yet.
  
  
• Download: HomeSearchfix. Unzip it to your desktop. Do not use it yet.
  
  
• Download Killbox
  Choose save as to your desktop. Unzip the file. Do not use it yet.
  
  Take care: some files can be hidden, so first go to start > control panel > folder options > view (tab) > mark “show hidden files en extensions >OK
  
  Please print out these directions for in safe mode you will have to be disconnected from the internet. You should entirely disconnect (UNPLUG) from the internet!!!
  
  
• Reboot your system into safe mode for all OS
  
  
• Close all windows and open HijackThis.
  • Click "scan only” in the main window
  • Put a checkmark beside the following entries and click “FIX checked”.
    
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {03366A3D-41F9-DA72-3EB8-2B95B53BE1FE} - C:\WINDOWS\system32\msem32.dll
    O2 - BHO: Class - {3428818B-50B8-001E-0872-C41BAD172E15} - C:\WINDOWS\system32\netwd32.dll
    O2 - BHO: Class - {3698678C-C5F1-2B0F-7784-86A3A0B91EC5} - C:\WINDOWS\mfciu32.dll
    O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
    O2 - BHO: Class - {66E0BB58-5F1A-3C89-6233-F802B7FF6A3B} - C:\WINDOWS\apimh.dll
    O2 - BHO: Class - {674D012F-6A8F-3061-C6A3-EAEE4CA2D4CA} - C:\WINDOWS\msws.dll
    O2 - BHO: (no name) - {AEAB8016-5094-74F5-8E87-1A38A180680D} - C:\WINDOWS\system32\sdkrt32.dll
    O2 - BHO: Class - {B9FBCC0E-658E-7FF9-97B0-FE0DA15F0299} - C:\WINDOWS\system32\mfcjv32.dll
    O2 - BHO: Class - {BA50DA44-7645-C1B0-1681-1C13EBB65669} - C:\WINDOWS\system32\netyl.dll
    O2 - BHO: Class - {FF821169-5E94-6256-7895-F4D785DD878A} - C:\WINDOWS\system32\sdkrt32.dll
    O4 - HKLM\..\Run: [apiff32.exe] C:\WINDOWS\system32\apiff32.exe
    O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [mfcfn32.exe] C:\WINDOWS\system32\mfcfn32.exe
    O4 - HKLM\..\Run: [atlqb.exe] C:\WINDOWS\system32\atlqb.exe
    O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...e/bridge-c9.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
    O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\crbu.exe
• Run CWShredder and choose FIX
  
  
• Start AboutBuster and press START, and then OK. The program will start scanning.
  
  
• Doubleclick HomeSearchfix.reg to merge the info to the registry. You will be prompted to accept the merge, answer YES.
  
  
• Start Killbox
  • Place a checkmark next to [x] Delete On Reboot.
  • Highlight the following list and Copy it (Ctrl+C) to the windows clipboard.
    
    C:\WINDOWS\system32\crbu.exe
    C:\WINDOWS\System32\intell32.exe
    C:\WINDOWS\system32\mfcfn32.exe
    C:\WINDOWS\odsvm.dll
    C:\WINDOWS\system32\msem32.dll
    C:\WINDOWS\system32\netwd32.dll
    C:\WINDOWS\mfciu32.dll
    C:\Program Files\RXToolBar
    C:\WINDOWS\apimh.dll
    C:\WINDOWS\msws.dll
    C:\WINDOWS\system32\sdkrt32.dll
    C:\WINDOWS\system32\mfcjv32.dll
    C:\WINDOWS\system32\netyl.dll
    C:\WINDOWS\system32\apiff32.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\system32\atlqb.exe
  • Back in Killbox, go > file > paste from clipboard,
  • Click the red highlighted X button and click yes to the prompt when all the files have been pasted.
  • Then click OK
  • Exit Killbox and Reboot your PC.
• After the reboot, Start AboutBuster AGAIN and scan AGAIN.
  
  
• Clean temporary files:
  • Go > start > run and type cleanmgr and OK
  • Scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
  • Click OK to remove those files.
  • Click Yes to confirm deletion.
• Reboot your system into normal mode.
  
  
• Download Ewido scan
  • Check for updates.
  • Let it do a full run.
  • Copy the log. Past it to a blank Notepad file and save it to post here.
• Finally, run HijackThis, click SCAN, produce a LOG and POST it and the EWIDOscan log in this thread for review.

Regards,

Trevuren

Edited by Trevuren, 08 October 2005 - 09:40 AM.

[delno2005]

hey heres the hjt log.the ewido security thing keeps freezing.still have some viruses it seems like.thanks

Logfile of HijackThis v1.99.1
Scan saved at 7:56:39 PM, on 10/12/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\twain_32\SiPix\SCBlink2\USBPNP.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberli...xp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1128726807527
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1128726775320
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: Blink2PnP - Unknown owner - C:\WINDOWS\twain_32\SiPix\SCBlink2\Srvany.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[Trevuren]

Your system is infected with a variant of the About:Blank infection.

• Please DELETE the programs I recommended for the last fix, for they have been updated. All except Ewido which I just want you to update
  
  
• Download CWShredder
  Click check for updates. Do not use it yet.
  
  
• Download Aboutbuster 5
  • Create a new folder on your desktop and call it AB
  • Extract [ALL] the files from the AboutBuster.zip file into this new Folder
  • Click on Updates to ensure you are working with the most current version
  • [/B] Do not use it yet.
• Download: HomeSearchfix. Unzip it to your desktop. Do not use it yet.
  
  
• Download Killbox
  Choose save as to your desktop. Unzip the file. Do not use it yet.
  
  Take care: some files can be hidden, so first go to start > control panel > folder options > view (tab) > mark “show hidden files en extensions >OK
  
  Please print out these directions for in safe mode you will have to be disconnected from the internet. You should entirely disconnect (UNPLUG) from the internet!!!
  
  
• Reboot your system intosafe mode for all OS
  
  
• Close all windows and open HijackThis.
  • Click "scan only” in the main window
  • Put a checkmark beside the following entries and click “FIX checked”.
    
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odsvm.dll/sp.html#10001
    R3 - Default URLSearchHook is missing
• Run CWShredder and choose FIX
  
  
• Start AboutBuster and press START, and then OK. The program will start scanning. Please keep the log and post it with your eply.
  
  
• Doubleclick HomeSearchfix.reg to merge the info to the registry. You will be prompted to accept the merge, answer YES.
  
  
• Start Killbox
  • Place a checkmark next to [x] Delete On Reboot.
  • Highlight the following list and Copy it (Ctrl+C) to the windows clipboard.
    
    C:\WINDOWS\odsvm.dll
    
  • Back in Killbox, go > file > paste from clipboard,
  • Click the red highlighted X button and click yes to the prompt when all the files have been pasted.
  • Then click OK
  • Exit Killbox and Reboot your PC.
• After the reboot, Start AboutBuster AGAIN and scan AGAIN.
  
  
• Clean temporary files:
  • Go > start > run and type cleanmgr and OK
  • Scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
  • Click OK to remove those files.
  • Click Yes to confirm deletion.
• Reboot your system into normal mode.
  
  
• Download Ewido scan
  • Check for updates.
  • Let it do a full run.
  • Copy the log. Past it to a blank Notepad file and save it to post here.
• Finally, run HijackThis, click SCAN, produce a LOG and POST it, the EWIDOscan log, and the About Buster log in this thread for review.

Regards,

Trevuren

[delno2005]

hey,the problem is,when i try to clean the system, it freezes, i type in cleanmgr,in the run box,and it just says calculating ...scanning compress files..i have tried to do this for up to 2 hours,still frozen,how long does it usually take?ok thank you.

[Trevuren]

No, that is way too long for that to take.

Get out of that procedure and contibue with Ewido.

Reboot.

Download CCleaner from HERE

• Choose download from Download FileHippo.com.
  
• A new window appears in which you must click on "Download Latest Version" at the top of the green column.
  
• Another window pops up and you must ckick where indicated near the Green Arrow.
  
• A box will open and Click Save on your Desktop as the destination.
  
• Now, click on the CCSetup icon on your desktop.
  
• Then RUN>>OK>>NEXT
  
• Agree to the Licence Agreement bu placing a checkmark in the appropriate box.
• Click NEXT and thus Accept the default location for the installation.
  
• Uncheck "Automatically check for updates to CCleaner.
  
• Click INSTALL and FINISH
  
• Do not change the Default Settings of CCleaner and click "Run Cleaner"
• REBOOT if required.

Regards,

Trevuren

[delno2005]

hey i ran the ccleaner program,but the ewido is freezing up so i cant use it.it just stays at 18.2 % for hours.heres a HJT log.im certain i have ps guard spyware because the ccleaner says that it had an error while cleaning it so its still here.thanks:

Logfile of HijackThis v1.99.1
Scan saved at 8:39:30 PM, on 10/13/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\AOL\1106548832\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1106548832\ee\AOLServiceHost.exe
c:\program files\common files\aol\1106548832\ee\services\antiSpywareApp\ver2_0_7\AOLSP Scheduler.exe
C:\Program Files\Common Files\AOL\1106548832\ee\AOLServiceHost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\securitysuite.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\America Online 9.0d\waol.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1106548832\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0d\AOL.EXE" -b
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z....iTunesSetup.exe
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberli...xp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1128726807527
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1128726775320
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[Trevuren]

This is not normal practice to clean out your restore cache before the end but I need to have Ewido run and it is probably hanging there.

Step #1 - Create a New Restore Point

Go - Start>Programmes>Accessories>System Tools>System Restore>Create a New Restore point.

Step #2 - Flush All Previous Points

Go - Start>Programs>Accessories>System Tools>Disc Cleanup>"More Options" Tab>Remove All But Most Recent Point.
Now try to run Ewido again in Safe Mode. (It cab take a ouple of hours depending on the number of files on your system)


Regards,

Trevuren

[delno2005]

Hey the ewido is not working, it will find new viruses( 8) but it stops at 20.1 percent, doesnt go anywhere past that, i left it on for 4 hours came back and was still at 20.1 percent.I know there is still a virus present because ewido finds them, but cant delete them because the scan is not able to finish.thanks

[delno2005]

Hey the ewido is not working, it will find new viruses( 8) but it stops at 20.1 percent, doesnt go anywhere past that, i left it on for 4 hours came back and was still at 20.1 percent.I know there is still a virus present because ewido finds them, but cant delete them because the scan is not able to finish.thanks

[delno2005]

Hey the ewido is not working, it will find new viruses( 8) but it stops at 20.1 percent, doesnt go anywhere past that, i left it on for 4 hours came back and was still at 20.1 percent.I know there is still a virus present because ewido finds them, but cant delete them because the scan is not able to finish.thanks

[Trevuren]

1. If the program just exits before it finishes, start it again and set it up to do a custom scan:

Click the Scanner button over to the left, then clickthe +Disk/Directory/File button and add:

*and add c:\documents and settings\
*add c:\windows\
*add c:\windows\system32\

Then click start scan, have it remove everything found.

2. If you have to, just do the smallest folder first, then restart and go toe second one mentioned above, then the third.

3. Once all that is clean, go with the full scan.


Regards,

Trevuren

[Trevuren]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.