Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Uncleanable virus. Please help me out.

Started by dudek , Dec 10 2005 09:39 AM

  • Please log in to reply

#1
dudek
Posted 10 December 2005 - 09:39 AM

dudek

    New Member

  • Member
  • Pip
  • 2 posts
How can i get rid of the virus(es) that messes up my cpu. First I got a new desktop background urging me to buy SpyDetective, and now I can't change the background, and have trojans all over. I tried to clean it, but it seems I have more damage then good. And they keep changing names. I cant manage it at all.

This is my Hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 16:31:05, on 2005-12-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Microsoft Hardware\Mouse\point32.exe
C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program\ATI Technologies\HydraVision\HydraDM.exe
C:\Program\TerraTec\Cinergy 400 TV\TTTVRC.exe
C:\Program\D-Tools\daemon.exe
C:\Program\Vanliga filer\Real\Update_OB\realsched.exe
C:\Program\Microsoft AntiSpyware\gcasServ.exe
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\Java\jre1.5.0_06\bin\jusched.exe
C:\Program\Apache Group\Apache2\bin\Apache.exe
C:\Program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program\Vanliga filer\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\ewido\security suite\ewidoctrl.exe
C:\Program\ewido\security suite\ewidoguard.exe
C:\Program\Apache Group\Apache2\bin\Apache.exe
C:\Program\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\Smartscaps.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Vanliga filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe
C:\Program\Apache Group\Apache2\bin\ApacheMonitor.exe
C:\WINDOWS\system32\sdkxx32.exe
C:\Program\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\T\Skrivbord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ipvyi.dll/sp.html#83556
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alltomtv.se/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ipvyi.dll/sp.html#83556
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {147b1cdb-b5e1-429d-8f08-c072f7f7c9db} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Class - {B3F5436A-1744-480D-F31A-6BCEAE6F478C} - C:\WINDOWS\mfcbp.dll
O2 - BHO: Class - {C5DD24AA-44CE-3AF3-2B3D-6EB6F2ECB4A6} - C:\WINDOWS\syspa.dll
O2 - BHO: Class - {DC00A7FE-DD77-33B9-B040-1BE09D76632F} - C:\WINDOWS\system32\sdkup32.dll
O3 - Toolbar: (no name) - {215161fa-606e-4362-ac60-75bea515d521} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Aktivitetsfältet] SysTray.Exe
O4 - HKLM\..\Run: [Soltek] C:\WINDOWS\System32\autorun.exe
O4 - HKLM\..\Run: [POINTER] C:\Program\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program\ATI Technologies\HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Program\TerraTec\Cinergy 400 TV\TTTVRC.exe
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Advanced Tools Check] C:\Program\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Vanliga filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [108.tmp] C:\DOCUME~1\T\LOKALA~1\Temp\108.tmp.exe
O4 - HKLM\..\Run: [109.tmp] C:\DOCUME~1\T\LOKALA~1\Temp\109.tmp.exe
O4 - HKLM\..\Run: [108.tmp.exe] C:\DOCUME~1\T\LOKALA~1\Temp\108.tmp.exe
O4 - HKLM\..\Run: [109.tmp.exe] C:\DOCUME~1\T\LOKALA~1\Temp\109.tmp.exe
O4 - HKLM\..\RunOnce: [addtf.exe] C:\WINDOWS\system32\addtf.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: AOM(2).lnk = C:\Program\Vanliga filer\Adobe\Web\AOM.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Vanliga filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Certificate Mover.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program\Apache Group\Apache2\bin\ApacheMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O12 - Plugin for .bmp: C:\Program\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .pdf: C:\Program\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://epost.alingsas.se/iNotes6.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1096726777221
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B981C150-318E-4A8A-AEB3-FA8AD2D653B4}: Domain = BoNet
O17 - HKLM\System\CCS\Services\Tcpip\..\{B981C150-318E-4A8A-AEB3-FA8AD2D653B4}: NameServer = 81.26.226.3,81.26.229.3
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appby32.exe" /s (file missing)
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Apache2 - Unknown owner - C:\Program\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program\Vanliga filer\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Vanliga filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Program\NORTON~1\AdvTools\NPROTECT.EXE (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\Program\VANLIG~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: SmartTrust Smart Card Server (Smartscaps) - SmartTrust - C:\WINDOWS\system32\Smartscaps.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program\Vanliga filer\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\Program\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
  • 0

Advertisements

#2
dudek
Posted 10 December 2005 - 09:46 AM

dudek

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
As you can see I have a running process that is weird: C:\WINDOWS\system32\sdkxx32.exe

and also:
O4 - HKLM\..\Run: [108.tmp] C:\DOCUME~1\T\LOKALA~1\Temp\108.tmp.exe
O4 - HKLM\..\Run: [109.tmp] C:\DOCUME~1\T\LOKALA~1\Temp\109.tmp.exe
O4 - HKLM\..\Run: [108.tmp.exe] C:\DOCUME~1\T\LOKALA~1\Temp\108.tmp.exe
O4 - HKLM\..\Run: [109.tmp.exe] C:\DOCUME~1\T\LOKALA~1\Temp\109.tmp.exe

and:
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appby32.exe" /s (file missing)

But it might be more. The last entry appby32, I tried to delete. But I'm not sure that it was a good idea. That's how lost I am!
(Downloader.Agent.td is being stopped by ewido security suite. Have no idea what it is, but it seems to go under random names like ipio32.exe, d3ds32.exe which are created about every five minutes)

I have these tools at present: KillBox, AboutBuster, AVG Free Edition, Cleanup40, Smitrem, SpyWareblaster, Ewido, cwsserviceremove

Edited by dudek, 10 December 2005 - 10:39 AM.

  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP