**INFECTED**HI Jack Log**Please Help

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
Will some1 help me out im geting all these pop ups an stuff why? Can some1 help me get rid of them


Logfile of HijackThis v1.99.1
Scan saved at 10:53:11 PM, on 1/4/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\S3Jpc3RpYW4\command.exe
D:\Program Files\Network Monitor\netmon.exe
D:\WINDOWS\inet20003\services.exe
C:\windows\banmanpro.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\sywsvcs.exe
D:\PROGRA~1\COMMON~1\owfz\owfzm.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\System32\wpabaln.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Krisitan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=D:\WINDOWS\inet20003\services.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe
O4 - HKLM\..\Run: [winsync] D:\WINDOWS\System32\kiayoo.exe reg_run
O4 - HKLM\..\Run: [banmanpro] C:\windows\banmanpro.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [xp_system] D:\WINDOWS\inet20003\services.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CU1] D:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] D:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [owfz] D:\PROGRA~1\COMMON~1\owfz\owfzm.exe
O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20003\services.exe
O4 - Global Startup: ihzp.exe
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O20 - Winlogon Notify: Reliability - D:\WINDOWS\system32\l46olej31ho.dll
O21 - SSODL: System - {CEBD682B-6183-4858-8A1C-40F5FAB4E157} - D:\WINDOWS\System32\winsock32.dll
O23 - Service: Command Service (cmdService) - Unknown owner - D:\WINDOWS\S3Jpc3RpYW4\command.exe
O23 - Service: Network Monitor - Unknown owner - D:\Program Files\Network Monitor\netmon.exe
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
There are multiple infections. You have no anti-virus protection. And no Windows Service Packs. Why?

Get AVG (it's free): http://free.grisoft.com/doc/1
Install it and run a scan.

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

* Note: If you receive an error while running option #1 like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications, choose close to terminate the application.."...then do one of the following:

1: Click on the l2mfix.bat again and choose option # 5 for Fix Autoexec.nt/cmd.exe error.
2: Alternatively, you can click the fixautont.html link in the l2mfix folder and follow the directions there to fix it manually.
Do not run the fix portion without fixing the error first.
After you have performed the procedures to fix the error, repeat the steps above to run option #1 for Run Find Log.
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
Hey...I cant start up my internet in Normal Windows mode...It always says error would you like to send an error report opr something like that. What Do I do...An when i donwload the files on safe mode it never comes thourgh on normal mode. By the way the reason i had no security was because i just rebooted my my computer so everything got delited.
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
NVM its working
ok heres my log
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility]
"Asynchronous"=dword:00000000
"DllName"="D:\\WINDOWS\\system32\\dnpq0175e.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{EF3757C8-7501-554C-BA59-962B2E7F7682}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{57461D64-16FA-4A75-807E-5A0D14900A73}"=""
"{867929DB-94C4-4734-8B0A-00EFED5C28D2}"=""
"{F334DF92-647B-4F2D-A1BE-61C763F010AA}"=""
"{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}"=""
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{3C150A4F-7580-436E-BF46-40FE200240CA}"=""
"{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}"=""
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}\InprocServer32]
@="D:\\WINDOWS\\system32\\mxobjs.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}\InprocServer32]
@="D:\\WINDOWS\\system32\\ccrsrv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}\InprocServer32]
@="D:\\WINDOWS\\system32\\dpskperf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}\InprocServer32]
@="D:\\WINDOWS\\system32\\lsadperf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}\InprocServer32]
@="D:\\WINDOWS\\system32\\wqnsrv.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

D:\WINDOWS\SYSTEM32\
ccrsrv.dll Wed Jan 4 2006 10:30:38p ..S.R 236,090 230.55 K
dnpq01~1.dll Thu Jan 5 2006 10:30:48a ..S.R 235,305 229.79 K
dpskperf.dll Thu Jan 5 2006 9:33:26a ..S.R 233,982 228.50 K
h4n0le~1.dll Wed Jan 4 2006 10:37:50p ..S.R 233,930 228.45 K
h60qlg~1.dll Wed Jan 4 2006 10:29:16p ..S.R 234,001 228.52 K
j0l40a~1.dll Thu Jan 5 2006 9:32:14a ..S.R 234,412 228.92 K
j22qlc~1.dll Thu Jan 5 2006 10:35:32a ..S.R 236,827 231.27 K
l8j8li~1.dll Wed Jan 4 2006 10:20:08p ..... 236,090 230.55 K
lsadperf.dll Thu Jan 5 2006 10:02:44a ..S.R 237,075 231.52 K
mxobjs.dll Thu Jan 5 2006 10:35:32a ..S.R 235,305 229.79 K
topiui.dll Wed Jan 4 2006 10:29:16p ..S.R 236,090 230.55 K
update.dll Thu Jan 5 2006 9:32:22a A.... 308 0.30 K
winsoc~1.dll Wed Jan 4 2006 10:06:58p A.... 21,504 21.00 K
wqnsrv.dll Thu Jan 5 2006 10:21:36a ..S.R 234,540 229.04 K
wustream.dll Thu Jan 5 2006 9:32:14a ..S.R 233,982 228.50 K

15 items found: 15 files (12 H/S), 0 directories.
Total of file sizes: 3,079,441 bytes 2.93 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive D has no label.
Volume Serial Number is 7CD9-DEB4

Directory of D:\WINDOWS\System32

01/05/2006 10:35 AM 235,305 mxobjs.dll
01/05/2006 10:35 AM 236,827 j22qlcf51f2.dll
01/05/2006 10:30 AM 235,305 dnpq0175e.dll
01/05/2006 10:21 AM 234,540 wqnsrv.dll
01/05/2006 10:02 AM 237,075 lsadperf.dll
01/05/2006 09:33 AM 233,982 dpskperf.dll
01/05/2006 09:32 AM 233,982 wustream.dll
01/05/2006 09:32 AM 234,412 j0l40a3qed.dll
01/04/2006 10:37 PM 233,930 h4n0le5m1h.dll
01/04/2006 10:30 PM 236,090 ccrsrv.dll
01/04/2006 10:29 PM 236,090 tOpiui.dll
01/04/2006 10:29 PM 234,001 h60qlgd5160.dll
01/04/2006 09:49 PM <DIR> dllcache
12 File(s) 2,821,539 bytes
1 Dir(s) 97,914,748,928 bytes free
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
Close any programs you have open since this step requires a reboot.

Open the l2mfix folder and double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter.
Your desktop and icons will disappear (this is normal).
L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot.
Press any key to reboot.
After the reboot notepad will open with a log.
Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
If after the reboot the log does not open, double click on it in the l2mfix folder.
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
L2mfix 010406
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
D:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 432 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 512 'winlogon.exe'
Killing PID 512 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1400 'explorer.exe'
Killing PID 1400 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1132 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
Deleting: D:\WINDOWS\system32\ccrsrv.dll
Successfully Deleted: D:\WINDOWS\system32\ccrsrv.dll
Deleting: D:\WINDOWS\system32\dgraw.dll
Successfully Deleted: D:\WINDOWS\system32\dgraw.dll
Deleting: D:\WINDOWS\system32\dnpq0175e.dll
Successfully Deleted: D:\WINDOWS\system32\dnpq0175e.dll
Deleting: D:\WINDOWS\system32\dpskperf.dll
Successfully Deleted: D:\WINDOWS\system32\dpskperf.dll
Deleting: D:\WINDOWS\system32\h4n0le5m1h.dll
Successfully Deleted: D:\WINDOWS\system32\h4n0le5m1h.dll
Deleting: D:\WINDOWS\system32\h60qlgd5160.dll
Successfully Deleted: D:\WINDOWS\system32\h60qlgd5160.dll
Deleting: D:\WINDOWS\system32\j0l40a3qed.dll
Successfully Deleted: D:\WINDOWS\system32\j0l40a3qed.dll
Deleting: D:\WINDOWS\system32\j22qlcf51f2.dll
Successfully Deleted: D:\WINDOWS\system32\j22qlcf51f2.dll
Deleting: D:\WINDOWS\system32\l66olgj316o.dll
Successfully Deleted: D:\WINDOWS\system32\l66olgj316o.dll
Deleting: D:\WINDOWS\system32\l8j8li1u18.dll
Successfully Deleted: D:\WINDOWS\system32\l8j8li1u18.dll
Deleting: D:\WINDOWS\system32\lsadperf.dll
Successfully Deleted: D:\WINDOWS\system32\lsadperf.dll
Deleting: D:\WINDOWS\system32\mv6ul9j91.dll
Successfully Deleted: D:\WINDOWS\system32\mv6ul9j91.dll
Deleting: D:\WINDOWS\system32\mvsign32.dll
Successfully Deleted: D:\WINDOWS\system32\mvsign32.dll
Deleting: D:\WINDOWS\system32\n4l80e3ueh.dll
Successfully Deleted: D:\WINDOWS\system32\n4l80e3ueh.dll
Deleting: D:\WINDOWS\system32\sdi.dll
Successfully Deleted: D:\WINDOWS\system32\sdi.dll
Deleting: D:\WINDOWS\system32\tmappcmp.dll
Successfully Deleted: D:\WINDOWS\system32\tmappcmp.dll
Deleting: D:\WINDOWS\system32\tOpiui.dll
Successfully Deleted: D:\WINDOWS\system32\tOpiui.dll
Deleting: D:\WINDOWS\system32\wqnsrv.dll
Successfully Deleted: D:\WINDOWS\system32\wqnsrv.dll
Deleting: D:\WINDOWS\system32\wustream.dll
Successfully Deleted: D:\WINDOWS\system32\wustream.dll

msg11?.dll
0 file(s) copied.



Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SideBySide]
"Asynchronous"=dword:00000000
"DllName"="D:\\WINDOWS\\system32\\mv6ul9j91.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
D:\WINDOWS\system32\ccrsrv.dll
D:\WINDOWS\system32\dgraw.dll
D:\WINDOWS\system32\dnpq0175e.dll
D:\WINDOWS\system32\dpskperf.dll
D:\WINDOWS\system32\h4n0le5m1h.dll
D:\WINDOWS\system32\h60qlgd5160.dll
D:\WINDOWS\system32\j0l40a3qed.dll
D:\WINDOWS\system32\j22qlcf51f2.dll
D:\WINDOWS\system32\l66olgj316o.dll
D:\WINDOWS\system32\l8j8li1u18.dll
D:\WINDOWS\system32\lsadperf.dll
D:\WINDOWS\system32\mv6ul9j91.dll
D:\WINDOWS\system32\mvsign32.dll
D:\WINDOWS\system32\n4l80e3ueh.dll
D:\WINDOWS\system32\sdi.dll
D:\WINDOWS\system32\tmappcmp.dll
D:\WINDOWS\system32\tOpiui.dll
D:\WINDOWS\system32\wqnsrv.dll
D:\WINDOWS\system32\wustream.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}\InprocServer32]
@="D:\\WINDOWS\\system32\\tmappcmp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}\InprocServer32]
@="D:\\WINDOWS\\system32\\ccrsrv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}\InprocServer32]
@="D:\\WINDOWS\\system32\\dpskperf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}\InprocServer32]
@="D:\\WINDOWS\\system32\\lsadperf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}\InprocServer32]
@="D:\\WINDOWS\\system32\\wqnsrv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F4E8CE78-D7BB-456A-A03D-467EC80900D3}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4E8CE78-D7BB-456A-A03D-467EC80900D3}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4E8CE78-D7BB-456A-A03D-467EC80900D3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4E8CE78-D7BB-456A-A03D-467EC80900D3}\InprocServer32]
@="D:\\WINDOWS\\system32\\dgraw.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2F088D9A-32C8-4D52-BC41-8989FC01654B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2F088D9A-32C8-4D52-BC41-8989FC01654B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2F088D9A-32C8-4D52-BC41-8989FC01654B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2F088D9A-32C8-4D52-BC41-8989FC01654B}\InprocServer32]
@="D:\\WINDOWS\\system32\\mvsign32.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{57461D64-16FA-4A75-807E-5A0D14900A73}"=-
"{867929DB-94C4-4734-8B0A-00EFED5C28D2}"=-
"{F334DF92-647B-4F2D-A1BE-61C763F010AA}"=-
"{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}"=-
"{3C150A4F-7580-436E-BF46-40FE200240CA}"=-
"{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}"=-
"{F4E8CE78-D7BB-456A-A03D-467EC80900D3}"=-
"{2F088D9A-32C8-4D52-BC41-8989FC01654B}"=-
[-HKEY_CLASSES_ROOT\CLSID\{57461D64-16FA-4A75-807E-5A0D14900A73}]
[-HKEY_CLASSES_ROOT\CLSID\{867929DB-94C4-4734-8B0A-00EFED5C28D2}]
[-HKEY_CLASSES_ROOT\CLSID\{F334DF92-647B-4F2D-A1BE-61C763F010AA}]
[-HKEY_CLASSES_ROOT\CLSID\{D5C9FE1A-9845-4B7C-AFEA-3A630B732543}]
[-HKEY_CLASSES_ROOT\CLSID\{3C150A4F-7580-436E-BF46-40FE200240CA}]
[-HKEY_CLASSES_ROOT\CLSID\{2AAD1582-3A33-4DC8-B513-DE20BAD414B7}]
[-HKEY_CLASSES_ROOT\CLSID\{F4E8CE78-D7BB-456A-A03D-467EC80900D3}]
[-HKEY_CLASSES_ROOT\CLSID\{2F088D9A-32C8-4D52-BC41-8989FC01654B}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/ccrsrv.dll (164 bytes security) (deflated 5%)
adding: dlls/dgraw.dll (164 bytes security) (deflated 5%)
adding: dlls/dnpq0175e.dll (164 bytes security) (deflated 5%)
adding: dlls/dpskperf.dll (164 bytes security) (deflated 4%)
adding: dlls/h4n0le5m1h.dll (164 bytes security) (deflated 4%)
adding: dlls/h60qlgd5160.dll (164 bytes security) (deflated 4%)
adding: dlls/j0l40a3qed.dll (164 bytes security) (deflated 5%)
adding: dlls/j22qlcf51f2.dll (164 bytes security) (deflated 5%)
adding: dlls/l66olgj316o.dll (164 bytes security) (deflated 5%)
adding: dlls/l8j8li1u18.dll (164 bytes security) (deflated 5%)
adding: dlls/lsadperf.dll (164 bytes security) (deflated 6%)
adding: dlls/mv6ul9j91.dll (164 bytes security) (deflated 4%)
adding: dlls/mvsign32.dll (164 bytes security) (deflated 5%)
adding: dlls/n4l80e3ueh.dll (164 bytes security) (deflated 5%)
adding: dlls/sdi.dll (164 bytes security) (deflated 5%)
adding: dlls/tmappcmp.dll (164 bytes security) (deflated 4%)
adding: dlls/tOpiui.dll (164 bytes security) (deflated 5%)
adding: dlls/wqnsrv.dll (164 bytes security) (deflated 5%)
adding: dlls/wustream.dll (164 bytes security) (deflated 4%)
adding: backregs/2AAD1582-3A33-4DC8-B513-DE20BAD414B7.reg (188 bytes security) (deflated 70%)
adding: backregs/2F088D9A-32C8-4D52-BC41-8989FC01654B.reg (188 bytes security) (deflated 70%)
adding: backregs/3C150A4F-7580-436E-BF46-40FE200240CA.reg (188 bytes security) (deflated 70%)
adding: backregs/57461D64-16FA-4A75-807E-5A0D14900A73.reg (188 bytes security) (deflated 70%)
adding: backregs/D5C9FE1A-9845-4B7C-AFEA-3A630B732543.reg (188 bytes security) (deflated 70%)
adding: backregs/F334DF92-647B-4F2D-A1BE-61C763F010AA.reg (188 bytes security) (deflated 70%)
adding: backregs/F4E8CE78-D7BB-456A-A03D-467EC80900D3.reg (188 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Heres a hijack log

Logfile of HijackThis v1.99.1
Scan saved at 1:21:44 PM, on 1/5/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\notepad.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\Messenger\msmsgs.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\WINDOWS\System32\wpabaln.exe
D:\Documents and Settings\Krisitan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
F3 - REG:win.ini: run=D:\WINDOWS\inet20003\services.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20003\services.exe
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O20 - Winlogon Notify: SideBySide - D:\WINDOWS\system32\mv6ul9j91.dll (file missing)
O21 - SSODL: System - {CEBD682B-6183-4858-8A1C-40F5FAB4E157} - D:\WINDOWS\System32\winsock32.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Command Service (cmdService) - Unknown owner - D:\WINDOWS\S3Jpc3RpYW4\command.exe (file missing)
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
Download KillBox here: http://www.downloads.subratam.org/KillBox.exe
Save it to your desktop.
DO NOT run it yet.

Click here to download the trial version of Ewido Security Suite:
http://www.ewido.net/en/download/

· Install Ewido.
· During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
· Launch ewido.
· It will prompt you to update click the OK button and it will go to the main screen.
· On the left side of the main screen click update.
· Click on Start and let it update.
· DO NOT run a scan yet.

Restart your computer into Safe Mode now.
(Start tapping the F8 key at Startup, before the Windows logo screen).
Perform the following steps in Safe Mode:

* Run Ewido:
Click on scanner
Click Complete System Scan and the scan will begin.
During the scan it will prompt you to clean files, click OK.
When the scan is finished, look at the bottom of the screen and click the Save report button.
Save the report to your desktop.

Reboot.

Post a new Hijack This log and the results of the Ewido scan.
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
Logfile of HijackThis v1.99.1
Scan saved at 3:46:11 PM, on 1/5/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\Messenger\msmsgs.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\Program Files\ewido anti-malware\ewidoctrl.exe
D:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Documents and Settings\Krisitan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
F3 - REG:win.ini: run=D:\WINDOWS\inet20003\services.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20003\services.exe
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O20 - Winlogon Notify: Antiwpa - D:\WINDOWS\SYSTEM32\antiwpa.dll
O20 - Winlogon Notify: SideBySide - D:\WINDOWS\system32\mv6ul9j91.dll (file missing)
O21 - SSODL: System - {CEBD682B-6183-4858-8A1C-40F5FAB4E157} - D:\WINDOWS\System32\winsock32.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Command Service (cmdService) - Unknown owner - D:\WINDOWS\S3Jpc3RpYW4\command.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 2:14:51 PM, 1/5/2006
+ Report-Checksum: D54261E6

+ Scan result:

C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Jozo\Application Data\Mozilla\Profiles\default\2vfalnz8.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Jozo\Application Data\Mozilla\Profiles\default\2vfalnz8.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Bpath : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Bpath : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected][1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Cookies\[email protected]2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Jozo\Local Settings\Temporary Internet Files\Content.IE5\6TOFIT2T\0,1-0,french_desserts,FF[2].html -> Spyware.BookedSpace : Cleaned with backup
C:\Documents and Settings\Jozo\Local Settings\Temporary Internet Files\Content.IE5\81WD2BKT\exitpop[1].htm -> Trojan.NoClose.i : Cleaned with backup
C:\Documents and Settings\Jozo\Local Settings\Temporary Internet Files\Content.IE5\OLGJ8NKN\exitpop[1].htm -> Trojan.NoClose.i : Cleaned with backup
C:\Documents and Settings\Jozo\Local Settings\Temporary Internet Files\Content.IE5\YVYFAX2Z\exitpop[2].htm -> Trojan.NoClose.i : Cleaned with backup
C:\install.exe -> Dropper.Agent.aed : Cleaned with backup
C:\WINDOWS\Temp\TBuninst.exe -> Spyware.WebSearch : Cleaned with backup
:mozilla.10:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l5weuyn7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.11:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l5weuyn7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.12:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l5weuyn7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.13:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l5weuyn7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.14:D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l5weuyn7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
Click Start – Run - and type in:

services.msc

Click OK.

In the services window find: Command Service

Right click and choose Properties. On the General tab under Service Status click the Stop button to stop the service. Beside Startup Type in the dropdown menu select Disabled. Click Apply then OK. Exit the Services utility.

Note: You may get an error here when trying to access the properties of the service. If you do get an error, just select the service and look there in the top left of the main service window and click "Stop" to stop the service. If that gives an error or it is already stopped, just skip this step and proceed with the rest.

Rescan with Hijack This.
Close all browser windows except Hijack This.
Put a check mark beside these entries and click "Fix Checked".

F3 - REG:win.ini: run=D:\WINDOWS\inet20003\services.exe

O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe

O4 - HKCU\..\Run: [xp_system] D:\WINDOWS\inet20003\services.exe

O20 - Winlogon Notify: SideBySide - D:\WINDOWS\system32\mv6ul9j91.dll (file missing)

O21 - SSODL: System - {CEBD682B-6183-4858-8A1C-40F5FAB4E157} - D:\WINDOWS\System32\winsock32.dll

O23 - Service: Command Service (cmdService) - Unknown owner - D:\WINDOWS\S3Jpc3RpYW4\command.exe (file missing)


Boot into Safe Mode.

* Double-click on Killbox.exe to run it.

Put a tick by Standard File Kill.
In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time:

D:\WINDOWS\inet20003\services.exe
C:\windows\enewsletterpro.exe
D:\WINDOWS\system32\mv6ul9j91.dll
D:\WINDOWS\System32\winsock32.dll
D:\WINDOWS\S3Jpc3RpYW4\command.exe


Click on the button that has the red circle with the X in the middle after you enter each file.
It will ask for confirmation to delete the file.
Click Yes.
Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box.
Killbox may tell you that one or more files do not exist.
If that happens, just continue on with all the files. Be sure you don't miss any.
Next in Killbox go to Tools > Delete Temp Files
In the window that pops up, put a check by ALL the options there except these three:
XP Prefetch
Recent
History
Now click the Delete Selected Temp Files button.
Exit the Killbox.

Find and delete these folders:

D:\WINDOWS\inet20003
D:\WINDOWS\S3Jpc3RpYW4


Finally go to Control Panel > Internet Options.
On the General tab under "Temporary Internet Files" Click "Delete Files".
Put a check by "Delete Offline Content" and click OK.
Click on the Programs tab then click the "Reset Web Settings" button.
Click Apply then OK.

Empty the Recycle Bin.

Reboot, post a new log.
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
Logfile of HijackThis v1.99.1
Scan saved at 4:11:49 PM, on 1/5/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\Messenger\msmsgs.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\Program Files\ewido anti-malware\ewidoctrl.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Krisitan\Desktop\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O20 - Winlogon Notify: Antiwpa - D:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
How are things now?

I was suspicious of this: D:\WINDOWS\SYSTEM32\antiwpa.dll

I think it might be OK. Just to be safe, go to this site and have it scan it:
http://virusscan.jotti.org/

Use the Browse button at Jotti, navigate to the file's location on your hard drive and submit it.
Let me know what it says regarding the file.
 

kris78164

Thread Starter
Joined
Nov 7, 2004
Messages
107
It says its ok.....Thank you for leading me so wel.. with detalied descripion. Thank you so much. Not to be a bother but can you reccomend any virus scanners?
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
You're welcome :)

Are you not happy with AVG?

I also highly recommend that you go to Windows Update and install all "Critical Updates and Service Packs" ASAP! This will patch numerous security holes in IE and Windows. Many baddies get on your machine by taking advantage of these vulnerabilities. As your machine stands now it is wide open to attack from all sorts of nasties. You need to get these updates IMMEDIATELY!

Now turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a restore point:

Single-click Start and point to All Programs.
Mouse over Accessories, then System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point. Something like "After trojan/spyware cleanup". Click Create and you're done.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top