1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Hijackthis log - please help

Discussion in 'Virus & Other Malware Removal' started by dhouk, Feb 16, 2005.

Thread Status:
Not open for further replies.
Advertisement
  1. dhouk

    dhouk Thread Starter

    Joined:
    Jul 22, 2004
    Messages:
    32
    Logfile of HijackThis v1.98.0
    Scan saved at 10:57:53 PM, on 2/16/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\WINDOWS\System32\RoamMgr.exe
    C:\Program Files\Intel\Switching\User\RoamSvc.exe
    C:\WINDOWS\System32\winapa.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\System32\pctspk.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\WINDOWS\System32\navapss32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\lssrv.exe
    C:\WINDOWS\System32\svlsass.exe
    C:\WINDOWS\System32\dscrss.exe
    C:\WINDOWS\System32\msmsgv.exe
    C:\WINDOWS\System32\svcosta.exe
    C:\WINDOWS\System32\winhps.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\l?***.exe
    C:\WINDOWS\System32\RunDLL32.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wral.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = fakeproxy
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = microsoft.com
    R3 - URLSearchHook: (no name) - _{30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
    O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [XML Service] msxml.exe
    O4 - HKLM\..\Run: [wu] C:\documents and settings\davidh\local settings\temp\wu.exe
    O4 - HKLM\..\Run: [Reg Service] REGSRV32.EXE
    O4 - HKLM\..\Run: [0JxE.exe] C:\documents and settings\davidh\local settings\temp\0JxE.exe
    O4 - HKLM\..\Run: [m2Fz1.exe] C:\documents and settings\davidh\local settings\temp\m2Fz1.exe
    O4 - HKLM\..\Run: [Windows Debugger] windbg.exe
    O4 - HKLM\..\Run: [protecse] navapss32.exe
    O4 - HKLM\..\Run: [Winamp media player] winapa.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CjfVAFRj] C:\WINDOWS\ftxjid.exe
    O4 - HKLM\..\Run: [¢‰¸u0–4C
    }ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\ftxjid.exe
    O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe
    O4 - HKLM\..\Run: [Windows Indexing Service Extensions] winidx32.exe
    O4 - HKLM\..\Run: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\Run: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKLM\..\Run: [Windows Interet Explorer 6] wmidx32.exe
    O4 - HKLM\..\Run: [Win32 Firewall Drivers] winfirewall.exe
    O4 - HKLM\..\Run: [lameshit] C:\winupd32.exe
    O4 - HKLM\..\Run: [DSCRSS] dscrss.exe
    O4 - HKLM\..\Run: [WINUSBDVCE ] C:\autoprotect.exe
    O4 - HKLM\..\Run: [ntfsmonitorpro] ntfs64.exe
    O4 - HKLM\..\Run: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKLM\..\Run: [WINS SYSTEM HOST] winsysh.exe
    O4 - HKLM\..\Run: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKLM\..\Run: [Windows Messenger Service] winsmsgr.exe
    O4 - HKLM\..\Run: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKLM\..\Run: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKLM\..\Run: [Windows Autolauncher] aol.exe
    O4 - HKLM\..\Run: [MediaService] C:\windowsstartup.exe
    O4 - HKLM\..\Run: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKLM\..\Run: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\Run: [Windows Enumerator] winedu32.exe
    O4 - HKLM\..\Run: [WinSYs startup] windowsmedia.exe
    O4 - HKLM\..\Run: [MediaServices] c:\anime.exe
    O4 - HKLM\..\Run: [Windows Automatic Updater] spupdate.exe
    O4 - HKLM\..\Run: [Windows HP Drivers] winhps.exe
    O4 - HKLM\..\Run: [Windows Javascript Daemon] jsdaemon.exe
    O4 - HKLM\..\Run: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKLM\..\Run: [WINS HUS SERVICE] winhus.exe
    O4 - HKLM\..\RunServices: [XML Service] msxml.exe
    O4 - HKLM\..\RunServices: [Reg Service] REGSRV32.EXE
    O4 - HKLM\..\RunServices: [Windows Debugger] windbg.exe
    O4 - HKLM\..\RunServices: [protecse] navapss32.exe
    O4 - HKLM\..\RunServices: [Winamp media player] winapa.exe
    O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
    O4 - HKLM\..\RunServices: [Windows Indexing Service Extensions] winidx32.exe
    O4 - HKLM\..\RunServices: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\RunServices: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKLM\..\RunServices: [Windows Interet Explorer 6] wmidx32.exe
    O4 - HKLM\..\RunServices: [Win32 Firewall Drivers] winfirewall.exe
    O4 - HKLM\..\RunServices: [DSCRSS] dscrss.exe
    O4 - HKLM\..\RunServices: [ntfsmonitorpro] ntfs64.exe
    O4 - HKLM\..\RunServices: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKLM\..\RunServices: [WINS SYSTEM HOST] winsysh.exe
    O4 - HKLM\..\RunServices: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKLM\..\RunServices: [Windows Messenger Service] winsmsgr.exe
    O4 - HKLM\..\RunServices: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKLM\..\RunServices: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKLM\..\RunServices: [Windows Autolauncher] aol.exe
    O4 - HKLM\..\RunServices: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKLM\..\RunServices: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\RunServices: [Windows Enumerator] winedu32.exe
    O4 - HKLM\..\RunServices: [WinSYs startup] windowsmedia.exe
    O4 - HKLM\..\RunServices: [Windows Automatic Updater] spupdate.exe
    O4 - HKLM\..\RunServices: [Windows HP Drivers] winhps.exe
    O4 - HKLM\..\RunServices: [Windows Javascript Daemon] jsdaemon.exe
    O4 - HKLM\..\RunServices: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKLM\..\RunServices: [WINS HUS SERVICE] winhus.exe
    O4 - HKLM\..\RunOnce: [Windows Debugger] windbg.exe
    O4 - HKLM\..\RunOnce: [Winamp media player] winapa.exe
    O4 - HKLM\..\RunOnce: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\RunOnce: [Win32 Firewall Drivers] winfirewall.exe
    O4 - HKLM\..\RunOnce: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\RunOnce: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ZBs3RkKsU] btqpmsg.exe
    O4 - HKCU\..\Run: [JavaUpdate0.07] C:\WINDOWS\System32\uxkvt.exe
    O4 - HKCU\..\Run: [Windows Debugger] windbg.exe
    O4 - HKCU\..\Run: [Winamp media player] winapa.exe
    O4 - HKCU\..\Run: [Jxu] C:\WINDOWS\System32\l?***.exe
    O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
    O4 - HKCU\..\Run: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKCU\..\Run: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKCU\..\Run: [Win32 Firewall Drivers] winfirewall.exe
    O4 - HKCU\..\Run: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKCU\..\Run: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKCU\..\Run: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKCU\..\Run: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKCU\..\Run: [Windows Autolauncher] aol.exe
    O4 - HKCU\..\Run: [Windows Network Controller] winmms32.exe
    O4 - HKCU\..\Run: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKCU\..\Run: [Windows Enumerator] winedu32.exe
    O4 - HKCU\..\Run: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\Run: [Windows Automatic Updater] spupdate.exe
    O4 - HKCU\..\Run: [Windows HP Drivers] winhps.exe
    O4 - HKCU\..\RunServices: [Windows HP Drivers] winhps.exe
    O4 - HKCU\..\RunOnce: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKCU\..\RunOnce: [Windows Debugger] windbg.exe
    O4 - HKCU\..\RunOnce: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\RunOnce: [Winamp media player] winapa.exe
    O4 - HKCU\..\RunOnce: [Win32 Firewall Drivers] winfirewall.exe
    O4 - HKCU\..\RunOnce: [Windows Network Controller] winmms32.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\yotxspxp.exe
    O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297B} - http://downloads.aaa1screensavers.com/download/rist-aug-acx21.exe
    O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://www.ritzpix.com/upload/WebUploadClient.cab
     
  2. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
  3. mazheen

    mazheen

    Joined:
    Sep 16, 2004
    Messages:
    6
    Your "O4 -" are too large.
    Try to delete them that unknow or nouse
     
  4. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Ignore the previous comments about the O4, that will be taken care of.

    Before you post the latest HJT version

    Do a couple online scans from this list

    http://forums.techguy.org/t110854.html

    Then get the free AVG 7 install it, check for updates and run a full scan

    AVG 7 - http://free.grisoft.com/freeweb.php/doc/2/


    SpywareBlaster http://www.javacoolsoftware.com/spywareblaster.html
    AdAware SE 1.05 http://www.majorgeeks.com/download506.html
    SpyBot S&D 1.3 http://www.safer-networking.org/en/download/

    DL them (they are free), install them, check each for their
    definition updates
    and then run AdAware and Spybot, fixing anything
    they say.

    In SpywareBlaster - Always enable all protection after updates
    SpyBot - After an update run immunize

    Do these and reboot before the next step.
     
  5. dhouk

    dhouk Thread Starter

    Joined:
    Jul 22, 2004
    Messages:
    32
    Thanks for the help! I have performed all of the scans - here is my new hijackthis log.

    Logfile of HijackThis v1.99.1
    Scan saved at 11:17:21 PM, on 2/18/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\WINDOWS\System32\RoamMgr.exe
    C:\Program Files\Intel\Switching\User\RoamSvc.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\winidx32.exe
    C:\WINDOWS\System32\svlsass.exe
    C:\WINDOWS\System32\msmsgv.exe
    C:\WINDOWS\System32\svcosta.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\l?***.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wral.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = fakeproxy
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = microsoft.com
    R3 - URLSearchHook: (no name) - _{30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [wu] C:\documents and settings\davidh\local settings\temp\wu.exe
    O4 - HKLM\..\Run: [Reg Service] REGSRV32.EXE
    O4 - HKLM\..\Run: [0JxE.exe] C:\documents and settings\davidh\local settings\temp\0JxE.exe
    O4 - HKLM\..\Run: [m2Fz1.exe] C:\documents and settings\davidh\local settings\temp\m2Fz1.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CjfVAFRj] C:\WINDOWS\ftxjid.exe
    O4 - HKLM\..\Run: [¢‰¸u0–4C
    }ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\ftxjid.exe
    O4 - HKLM\..\Run: [Windows Indexing Service Extensions] winidx32.exe
    O4 - HKLM\..\Run: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\Run: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKLM\..\Run: [Windows Interet Explorer 6] wmidx32.exe
    O4 - HKLM\..\Run: [lameshit] C:\winupd32.exe
    O4 - HKLM\..\Run: [WINUSBDVCE ] C:\autoprotect.exe
    O4 - HKLM\..\Run: [ntfsmonitorpro] ntfs64.exe
    O4 - HKLM\..\Run: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKLM\..\Run: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKLM\..\Run: [Windows Messenger Service] winsmsgr.exe
    O4 - HKLM\..\Run: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKLM\..\Run: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKLM\..\Run: [Windows Autolauncher] aol.exe
    O4 - HKLM\..\Run: [MediaService] C:\windowsstartup.exe
    O4 - HKLM\..\Run: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKLM\..\Run: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\Run: [Windows Enumerator] winedu32.exe
    O4 - HKLM\..\Run: [MediaServices] c:\anime.exe
    O4 - HKLM\..\Run: [Windows Automatic Updater] spupdate.exe
    O4 - HKLM\..\Run: [Windows Javascript Daemon] jsdaemon.exe
    O4 - HKLM\..\Run: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\RunServices: [Reg Service] REGSRV32.EXE
    O4 - HKLM\..\RunServices: [Windows Indexing Service Extensions] winidx32.exe
    O4 - HKLM\..\RunServices: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\RunServices: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKLM\..\RunServices: [Windows Interet Explorer 6] wmidx32.exe
    O4 - HKLM\..\RunServices: [ntfsmonitorpro] ntfs64.exe
    O4 - HKLM\..\RunServices: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKLM\..\RunServices: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKLM\..\RunServices: [Windows Messenger Service] winsmsgr.exe
    O4 - HKLM\..\RunServices: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKLM\..\RunServices: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKLM\..\RunServices: [Windows Autolauncher] aol.exe
    O4 - HKLM\..\RunServices: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKLM\..\RunServices: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\RunServices: [Windows Enumerator] winedu32.exe
    O4 - HKLM\..\RunServices: [Windows Automatic Updater] spupdate.exe
    O4 - HKLM\..\RunServices: [Windows Javascript Daemon] jsdaemon.exe
    O4 - HKLM\..\RunServices: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKLM\..\RunOnce: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\RunOnce: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\RunOnce: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ZBs3RkKsU] btqpmsg.exe
    O4 - HKCU\..\Run: [Jxu] C:\WINDOWS\System32\l?***.exe
    O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
    O4 - HKCU\..\Run: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKCU\..\Run: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKCU\..\Run: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKCU\..\Run: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKCU\..\Run: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKCU\..\Run: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKCU\..\Run: [Windows Autolauncher] aol.exe
    O4 - HKCU\..\Run: [Windows Network Controller] winmms32.exe
    O4 - HKCU\..\Run: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKCU\..\Run: [Windows Enumerator] winedu32.exe
    O4 - HKCU\..\Run: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\Run: [Windows Automatic Updater] spupdate.exe
    O4 - HKCU\..\RunServices: [Windows HP Drivers] winhps.exe
    O4 - HKCU\..\RunOnce: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\RunOnce: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKCU\..\RunOnce: [Windows Network Controller] winmms32.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O15 - Trusted IP range: 206.161.125.149
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\yotxspxp.exe
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://www.ritzpix.com/upload/WebUploadClient.cab
    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Adapter Switching (IntelRoam) - Intel Corporation - C:\Program Files\Intel\Switching\User\RoamSvc.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: RoamMgr - Intel Corporation - C:\WINDOWS\System32\RoamMgr.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    :) :)
     
  6. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Download CWShredder http://www.intermute.com/spysubtract/cwshredder_download.html
    Close all browser windows,
    Open cwshredder.exe then click "Fix" and let it run.

    Istsvc http://securityresponse.symantec.com/avcenter/FxIstbar.exe

    From Symantec
    Note:
    · The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.
    · The removal tool may terminate Internet Explorer and Windows Explorer. It is recommended that users save their work and log out of these programs before running the removal tool.
    · The removal tool will reset the Internet start page to a blank page. The start page can be modified by clicking on Tools > Internet Options in Internet Explorer.
    · The removal tool will not delete some harmless Temporary Internet files, which Adware.Istbar created, in C:\Documents and Setings\Administrator\Local Settings\Temporary Internet Files.
    These can be manually deleted using the following steps:
    a. Start Internet Explorer.
    b. Click Tools > Internet Options.
    c. In the Temporary Internet Files section, then click the Delete Files button.
    d. Check Delete all offline content, and then click OK.

    Print this and boot to safe mode
    Fix these with HJT

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cmfwk.dll/sp.html#29126
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = fakeproxy
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = microsoft.com

    R3 - URLSearchHook: (no name) - _{30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)

    O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

    O4 - HKLM\..\Run: [wu] C:\documents and settings\davidh\local settings\temp\wu.exe
    O4 - HKLM\..\Run: [Reg Service] REGSRV32.EXE
    O4 - HKLM\..\Run: [0JxE.exe] C:\documents and settings\davidh\local settings\temp\0JxE.exe
    O4 - HKLM\..\Run: [m2Fz1.exe] C:\documents and settings\davidh\local settings\temp\m2Fz1.exe
    O4 - HKLM\..\Run: [CjfVAFRj] C:\WINDOWS\ftxjid.exe
    O4 - HKLM\..\Run: [¢‰¸u0–4C
    }ïÁz î[ 8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\ftxjid.exe
    O4 - HKLM\..\Run: [Windows Indexing Service Extensions] winidx32.exe
    O4 - HKLM\..\Run: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\Run: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKLM\..\Run: [Windows Interet Explorer 6] wmidx32.exe
    O4 - HKLM\..\Run: [lameshit] C:\winupd32.exe
    O4 - HKLM\..\Run: [WINUSBDVCE ] C:\autoprotect.exe
    O4 - HKLM\..\Run: [ntfsmonitorpro] ntfs64.exe
    O4 - HKLM\..\Run: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKLM\..\Run: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKLM\..\Run: [Windows Messenger Service] winsmsgr.exe
    O4 - HKLM\..\Run: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKLM\..\Run: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKLM\..\Run: [Windows Autolauncher] aol.exe
    O4 - HKLM\..\Run: [MediaService] C:\windowsstartup.exe
    O4 - HKLM\..\Run: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKLM\..\Run: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\Run: [Windows Enumerator] winedu32.exe
    O4 - HKLM\..\Run: [MediaServices] c:\anime.exe
    O4 - HKLM\..\Run: [Windows Automatic Updater] spupdate.exe
    O4 - HKLM\..\Run: [Windows Javascript Daemon] jsdaemon.exe
    O4 - HKLM\..\Run: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
    O4 - HKLM\..\RunServices: [Reg Service] REGSRV32.EXE
    O4 - HKLM\..\RunServices: [Windows Indexing Service Extensions] winidx32.exe
    O4 - HKLM\..\RunServices: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\RunServices: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKLM\..\RunServices: [Windows Interet Explorer 6] wmidx32.exe
    O4 - HKLM\..\RunServices: [ntfsmonitorpro] ntfs64.exe
    O4 - HKLM\..\RunServices: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKLM\..\RunServices: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKLM\..\RunServices: [Windows Messenger Service] winsmsgr.exe
    O4 - HKLM\..\RunServices: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKLM\..\RunServices: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKLM\..\RunServices: [Windows Autolauncher] aol.exe
    O4 - HKLM\..\RunServices: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKLM\..\RunServices: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\RunServices: [Windows Enumerator] winedu32.exe
    O4 - HKLM\..\RunServices: [Windows Automatic Updater] spupdate.exe
    O4 - HKLM\..\RunServices: [Windows Javascript Daemon] jsdaemon.exe
    O4 - HKLM\..\RunServices: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKLM\..\RunOnce: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKLM\..\RunOnce: [Windows Network Controller] winmms32.exe
    O4 - HKLM\..\RunOnce: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\Run: [ZBs3RkKsU] btqpmsg.exe
    O4 - HKCU\..\Run: [Jxu] C:\WINDOWS\System32\l?***.exe
    O4 - HKCU\..\Run: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKCU\..\Run: [Microsoft SVHOST32 Service] svlsass.exe
    O4 - HKCU\..\Run: [Microsoft Kernel Patch] kernel3ox.exe
    O4 - HKCU\..\Run: [Windows32 Messenger Service] msmsgv.exe
    O4 - HKCU\..\Run: [rofl com rofl lol ioi] rofl32pro.exe
    O4 - HKCU\..\Run: [Sygate Personal Firewall] MSNSRV32.exe
    O4 - HKCU\..\Run: [Windows Autolauncher] aol.exe
    O4 - HKCU\..\Run: [Windows Network Controller] winmms32.exe
    O4 - HKCU\..\Run: [SvCosta Personal Firewall] svcosta.exe
    O4 - HKCU\..\Run: [Windows Enumerator] winedu32.exe
    O4 - HKCU\..\Run: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\Run: [Windows Automatic Updater] spupdate.exe
    O4 - HKCU\..\RunServices: [Windows HP Drivers] winhps.exe
    O4 - HKCU\..\RunOnce: [Windows Sql Service For Windows 32 Bit] winsql32.exe
    O4 - HKCU\..\RunOnce: [Microsoft Internet Explorer 6] winupdx.exe
    O4 - HKCU\..\RunOnce: [Windows Network Controller] winmms32.exe


    O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\yotxspxp.exe



    View Hidden Files
    Open Windows Explorer. Go to Tools, Folder Options and click on the View tab.
    Make sure that "Show hidden files and folders" is checked.
    Also uncheck "Hide protected operating system files".
    Now click "Apply to all folders", Click "Apply" then "OK"

    Delete these files

    C:\WINDOWS\System32\winidx32.exe
    C:\WINDOWS\System32\svlsass.exe
    C:\WINDOWS\System32\msmsgv.exe
    C:\WINDOWS\System32\svcosta.exe
    C:\Program Files\Internet Explorer\yotxspxp.exe
    c:\anime.exe
    C:\WINDOWS\ftxjid.exe

    Search for these and delete (prolly in System32) Be very careful of spelling

    btqpmsg.exe
    l?***.exe = THE file must have the special characters NOT lssas
    winupdx.exe
    svlsass.exe
    kernel3ox.exe
    msmsgv.exe
    rofl32pro.exe
    MSNSRV32.exe
    svcosta.exe
    winedu32.exe
    winsql32.exe
    spupdate.exe
    winhps.exe
    winsql32.exe
    winupdx.exe
    winmms32.exe


    Delete these folders

    C:\Program Files\AdTools Service


    START – RUN – key in %temp% OK - Edit – Select all – File – Delete
    Empty the recycle bin
    Boot and post a new log
     
  7. dhouk

    dhouk Thread Starter

    Joined:
    Jul 22, 2004
    Messages:
    32
    Thanks for the help!
    Logfile of HijackThis v1.99.1
    Scan saved at 11:40:08 PM, on 3/6/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\WINDOWS\System32\RoamMgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Intel\Switching\User\RoamSvc.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\System32\pctspk.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\WINDOWS\System32\avifile8.exe
    C:\WINDOWS\System32\xplorer.exe
    C:\WINDOWS\System32\RunDLL32.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\interMute\SpySubtract\SpySub.exe
    C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\hjt\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wral.com/
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
    O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [5444a081c00f] C:\WINDOWS\System32\avifile8.exe
    O4 - HKLM\..\Run: [Microsoft Proc Driver32] msprc.exe
    O4 - HKLM\..\Run: [WindowRegKey update] wins.exe
    O4 - HKLM\..\Run: [MS Windows CachePath] msnull32.exe
    O4 - HKLM\..\Run: [System Restore DLL] xplorer.exe
    O4 - HKLM\..\RunServices: [Windows Updater 32Bit Online] winupdm32.exe
    O4 - HKLM\..\RunServices: [Microsoft Proc Driver32] msprc.exe
    O4 - HKLM\..\RunServices: [WindowRegKey update] wins.exe
    O4 - HKLM\..\RunServices: [MS Windows CachePath] msnull32.exe
    O4 - HKLM\..\RunServices: [System Restore DLL] xplorer.exe
    O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
    O4 - HKCU\..\Run: [Microsoft Proc Driver32] msprc.exe
    O4 - HKCU\..\Run: [WindowRegKey update] wins.exe
    O4 - HKCU\..\Run: [MS Windows CachePath] msnull32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\RunServices: [Windows HP Drivers] winhps.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe
    O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://www.ritzpix.com/upload/WebUploadClient.cab
    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Adapter Switching (IntelRoam) - Intel Corporation - C:\Program Files\Intel\Switching\User\RoamSvc.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: RoamMgr - Intel Corporation - C:\WINDOWS\System32\RoamMgr.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
     
  8. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Download About:Buster from:
    http://downloads.subratam.org/AboutBuster.zip
    Double click aboutbuster.exe, click Update, click OK, click Start, then click OK.
    This will scan your computer for the bad files and delete them.

    Print this and boot to safe mode
    Fix these with HJT

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm

    O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll

    O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll

    O4 - HKLM\..\Run: [5444a081c00f] C:\WINDOWS\System32\avifile8.exe

    O4 - HKLM\..\Run: [Microsoft Proc Driver32] msprc.exe

    O4 - HKLM\..\Run: [WindowRegKey update] wins.exe

    O4 - HKLM\..\Run: [MS Windows CachePath] msnull32.exe

    O4 - HKLM\..\Run: [System Restore DLL] xplorer.exe

    O4 - HKLM\..\RunServices: [Windows Updater 32Bit Online] winupdm32.exe

    O4 - HKLM\..\RunServices: [Microsoft Proc Driver32] msprc.exe

    O4 - HKLM\..\RunServices: [WindowRegKey update] wins.exe

    O4 - HKLM\..\RunServices: [MS Windows CachePath] msnull32.exe

    O4 - HKLM\..\RunServices: [System Restore DLL] xplorer.exe

    O4 - HKCU\..\Run: [Microsoft Proc Driver32] msprc.exe

    O4 - HKCU\..\Run: [WindowRegKey update] wins.exe

    O4 - HKCU\..\Run: [MS Windows CachePath] msnull32.exe

    O4 - HKCU\..\RunServices: [Windows HP Drivers] winhps.exe

    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/Acti...iveLauncher.cab


    View Hidden Files
    Open Windows Explorer. Go to Tools, Folder Options and click on the View tab.
    Make sure that "Show hidden files and folders" is checked.
    Also uncheck "Hide protected operating system files".
    Uncheck hide extensions
    Now click "Apply to all folders", Click "Apply" then "OK"

    Delete these files
    C:\WINDOWS\System32\SearchBar.htm
    C:\WINDOWS\System32\avifile8.exe
    C:\WINDOWS\System32\xplorer.exe - careful no E

    Delete these folders

    C:\Program Files\SEP


    START – RUN – key in %temp% OK - Edit – Select all – File – Delete
    Empty the recycle bin
    Boot and post a new log
     
  9. dhouk

    dhouk Thread Starter

    Joined:
    Jul 22, 2004
    Messages:
    32
    Thanks again for the help - new HJT log.

    Logfile of HijackThis v1.99.1
    Scan saved at 6:28:26 PM, on 3/21/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\hjt\HijackThis.exe

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [Register Manager] RegistryManage.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\RunServices: [MS Manager] msmgr.exe
    O4 - HKLM\..\RunServices: [Register Manager] RegistryManage.exe
    O4 - HKLM\..\RunServices: [Sygate32 Firewall] Sygate32.exe
    O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Register Manager] RegistryManage.exe
    O4 - HKCU\..\RunServices: [MS Manager] msmgr.exe
    O4 - HKCU\..\RunServices: [Register Manager] RegistryManage.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
    O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Adapter Switching (IntelRoam) - Intel Corporation - C:\Program Files\Intel\Switching\User\RoamSvc.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: RoamMgr - Intel Corporation - C:\WINDOWS\System32\RoamMgr.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
     
  10. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Run the next log from normal mode

    Make sure your AVG has current definitions

    Do a couple online scans from this list

    http://forums.techguy.org/t110854.html

    Print this and boot to safe mode
    Fix these with HJT

    O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: [Register Manager] RegistryManage.exe

    O4 - HKLM\..\RunServices: [MS Manager] msmgr.exe

    O4 - HKLM\..\RunServices: [Register Manager] RegistryManage.exe

    O4 - HKLM\..\RunServices: [Sygate32 Firewall] Sygate32.exe

    O4 - HKCU\..\Run: [Register Manager] RegistryManage.exe

    O4 - HKCU\..\RunServices: [MS Manager] msmgr.exe

    O4 - HKCU\..\RunServices: [Register Manager] RegistryManage.exe

    O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)

    O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)

    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll

    View Hidden Files
    Open Windows Explorer. Go to Tools, Folder Options and click on the View tab.
    Make sure that "Show hidden files and folders" is checked.
    Also uncheck "Hide protected operating system files".
    Uncheck hide extensions
    Now click "Apply to all folders", Click "Apply" then "OK"

    Delete these files

    C:\WINDOWS\system32\msmgr.exe
    C:\WINDOWS\system32\RegistryManage.exe
    C:\WINDOWS\system32\Sygate32.exe

    START – RUN – key in %temp% OK - Edit – Select all – File – Delete
    Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp
    Empty the recycle bin
    Boot and post a new log
     
  11. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/331533

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice