1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

VIRUS-no control panel, constant pop ups

Discussion in 'Virus & Other Malware Removal' started by jim916, Oct 30, 2007.

Thread Status:
Not open for further replies.
  1. jim916

    jim916 Thread Starter

    Joined:
    Oct 30, 2007
    Messages:
    3
    Hi,
    We have a virus and are having a hard time trying get rid of it. We have lost the control panel, task manager and keep getting popups about no administrater privileges.
    My wife usues this for her work at home job and it is causing a few problems so we need this fixed asap. I see other people have a simlar issue, but it seems to be many fixes.

    I alos have my combofix text at the end.
    Here is my hijack this file:

    Logfile of HijackThis v1.99.1
    Scan saved at 9:57:57 PM, on 10/30/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\WINDOWS\zHotkey.exe
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\BigFix\BigFix.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\WINDOWS\System32\svchost.exe
    C:\hijack-this\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
    R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
    O4 - HKCU\..\Run: [Jfygoq] C:\WINDOWS\A?pPatch\?pool32.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
    O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: iifdbbx - iifdbbx.dll (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

    combofix info:

    ComboFix 07-10-29.1** - Owner 2007-10-30 21:47:48.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.657 [GMT -5:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Owner\Application Data\TSKS~1
    C:\Documents and Settings\Owner\My Documents\SMANTE~1
    C:\Documents and Settings\Owner\My Documents\SMANTE~1\S?mantec\
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Terms.lnk
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Uninstall.lnk
    C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
    C:\Program Files\ISM
    C:\Program Files\outerinfo
    C:\Program Files\outerinfo\Terms.rtf
    C:\WINDOWS\appatc~1
    C:\WINDOWS\appatc~1\?pool32.exe
    C:\WINDOWS\system32\8_exception.nls

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_SYMAVC32
    -------\runtime
    -------\symavc32


    ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-31 )))))))))))))))))))))))))))))))
    .

    2007-10-30 21:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-30 20:03 <DIR> d-------- C:\Documents and Settings\Administrator.HELBERG\Application Data\AVG7
    2007-10-30 20:02 <DIR> d-------- C:\Documents and Settings\Administrator.HELBERG\Application Data\You've Got Pictures Screensaver
    2007-10-30 20:02 <DIR> d-------- C:\Documents and Settings\Administrator.HELBERG\Application Data\Symantec
    2007-10-30 20:02 <DIR> d-------- C:\Documents and Settings\Administrator.HELBERG\Application Data\CyberLink
    2007-10-30 20:02 <DIR> d-------- C:\Documents and Settings\Administrator.HELBERG\Application Data\AOL
    2007-10-30 15:47 <DIR> d-------- C:\Program Files\Windows Live Safety Center
    2007-10-29 19:50 114,688 --a------ C:\WINDOWS\rearede.exe
    2007-10-25 20:05 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVG7
    2007-10-25 20:00 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2007-10-25 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-25 19:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2007-10-25 19:50 16,384 --a------ C:\WINDOWS\xlavba6.exe
    2007-10-25 15:13 6,465 --ahs---- C:\WINDOWS\system32\nqstv.bak1
    2007-10-25 15:10 <DIR> d-------- C:\Program Files\SpyGuardPro
    2007-10-25 15:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SpyGuardPro
    2007-10-18 15:45 23,402,288 --------- C:\AdbeRdr810_en_US.exe
    2007-10-10 10:54 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-31 02:35 61,192 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
    2007-10-25 22:54 --------- d-----w C:\Program Files\Managed DirectX (0900)
    2007-10-18 20:47 --------- d-----w C:\Program Files\Common Files\Adobe
    2007-10-13 19:56 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM
    2007-09-23 15:22 --------- d-----w C:\Program Files\Punch! Super Home
    2007-09-17 19:41 --------- d-----w C:\Program Files\Desktop Screen Record 5
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-07-31 00:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-31 00:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-31 00:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-31 00:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-31 00:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-31 00:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-31 00:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-31 00:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-07-09 13:09 584,192 ----a-w C:\WINDOWS\system32\rpcrt4.dll
    2007-03-12 11:47 122,880 ----a-w C:\Documents and Settings\Owner\Application Data\prg.exe
    2005-09-04 20:42 758 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
    2005-03-18 21:36 184,808 ----a-w C:\Documents and Settings\Owner\Application Data\shb.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 17:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 21:42]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50]
    "mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2004-01-26 12:46]
    "CHotkey"="zHotkey.exe" [2004-05-17 20:30 C:\WINDOWS\zHotkey.exe]
    "ShowWnd"="ShowWnd.exe" [2003-09-19 11:09 C:\WINDOWS\ShowWnd.exe]
    "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-03-11 17:18]
    "SoundMan"="SOUNDMAN.EXE" [2004-07-01 14:58 C:\WINDOWS\SOUNDMAN.EXE]
    "AlcWzrd"="ALCWZRD.EXE" [2004-07-05 21:05 C:\WINDOWS\ALCWZRD.EXE]
    "EPSON Stylus Photo R320 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.exe" [2004-04-26 03:00]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-02-25 20:34]
    "iRiver Updater"="\Updater.exe" []
    "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 04:50 C:\WINDOWS\LOGI_MWX.EXE]
    "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 05:32]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-26 08:52]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
    "spc_w"="C:\Program Files\NZSearch\nzspc.exe" [2004-11-09 03:29]
    "Jfygoq"="C:\WINDOWS\A?pPatch\?pool32.exe" []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-12-31 15:31:47]
    BigFix.lnk - C:\Program Files\BigFix\BigFix.exe [2004-08-19 20:49:46]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 04:01:04]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifdbbx]
    iifdbbx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll


    .
    **************************************************************************

    catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-30 21:51:17
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-30 21:52:03 - machine was rebooted
    .
    --- E O F ---
     
  2. jim916

    jim916 Thread Starter

    Joined:
    Oct 30, 2007
    Messages:
    3
    Anyone have any ideas? This computer is for my wifes freelance work, and it is very important to get this fixed ASAP.

    Thanks,

    Jim
     
  3. jim916

    jim916 Thread Starter

    Joined:
    Oct 30, 2007
    Messages:
    3
    The virus seems to be gone. we have control of things again and no pop-ups.
    How do I know if the virus is gone for sure? Also any advise on how to prevent this in the future. I see a lot of peple had the same problems.Thanks,

    Jim
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/645753

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice