Hijack This Log, NEED HELPZ

Comments

• Crunchie Mandurah. Western Australia. Member

  July 2006 edited July 2006

  Please download SmitfraudFix (by S!Ri)
  Extract the content (a folder named SmitfraudFix) to your Desktop.
  
  Open the SmitfraudFix folder and double-click smitfraudfix.cmd
  Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
  Please copy/paste the content of that report into your next reply.
  
  Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
  http://www.beyondlogic.org/consulting/proc...processutil.htm

  0
• thunder

  July 2006 edited July 2006

  KK here it is
  
  
  SmitFraudFix v2.73
  
  Scan done at 10:52:12.23, Mon 07/17/2006
  Run from C:\Documents and Settings\thomas soden\Desktop\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
  Fix ran in normal mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  C:\WINDOWS\system32\ishost.exe FOUND !
  C:\WINDOWS\system32\ismon.exe FOUND !
  C:\WINDOWS\system32\isnotify.exe FOUND !
  C:\WINDOWS\system32\issearch.exe FOUND !
  C:\WINDOWS\system32\ixt?.dll FOUND !
  C:\WINDOWS\system32\ixt??.dll FOUND !
  C:\WINDOWS\system32\ot.ico FOUND !
  C:\WINDOWS\system32\ts.ico FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\thomas soden\Application Data
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\THOMAS~1\FAVORI~1
  
  C:\DOCUME~1\THOMAS~1\FAVORI~1\Antivirus Test Online.url FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="My Current Home Page"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{259BA022-2005-45E9-A965-10EDB9C00605}"="Windows Updater"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» End

  0
• Crunchie Mandurah. Western Australia. Member

  July 2006 edited July 2006

  You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.
  
  Please download Ewido Anti-Malware it is a free version of the program.

  1. Install Ewido Anti-Malware
  2. When installing, under "Additional Options" uncheck..
     • Install background guard
     • Install scan via context menu
  3. Launch Ewido, there should be an icon on your desktop, double-click it.
  4. The program will now open to the main screen.
  5. You will need to update ewido to the latest definition files.
     • On the left hand side of the main screen click update.
     • Then click on Start Update.
  6. The update will start and a progress bar will show the updates being installed.
     (the status bar at the bottom will display ("Update successful")

  Close Ewido for now.
  ==============
  
  Please download ATF Cleaner by Atribune.
  This program is for XP and Windows 2000 only
  Close the program for now.
  ==================
  
  Next, please reboot your computer in Safe Mode by doing the following :

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.

  1) Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.
  
  If you use Firefox browser : Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  If you use Opera browser: Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  Click Exit on the Main menu to close the program.
  For Technical Support, double-click the e-mail address located at the bottom of each menu.
  
  
  2) Open the SmitfraudFix folder again and double-click smitfraudfix.cmd
  Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
  
  You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
  
  The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
  
  The tool may need to restart your computer to finish the cleaning process; if it does force a restart, please reboot into Safe Mode again, in order to complete the following step. If it does not reboot, please remain in Safe Mode until further notice.
  
  3) Launch Ewido from your Desktop :

  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • You will be prompted to clean the first infection.
  • Select "Perform action on all infections", then proceed.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop or a location where you can find it easily.

  Close Ewido Anti-Malware.
  
  4) Reboot your computer normally.
  
  If SmitfraudFix did not force a reboot, then you should now see a text file appear onscreen with results from the cleaning process; please copy/paste the content of that report into your next reply.
  The report can also be found at the root of the system drive, usually at C:\rapport.txt
  
  Note : running option #2 on a non infected computer will remove your Desktop background.
  
  5) Post the content of rapport.txt, the Ewido report and a new HijackThis! log in your next reply.

  0
• thunder

  July 2006 edited July 2006

  here is what you found.
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 6:10:52 PM, on 7/17/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Yahoo!\Antivirus\ISafe.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\QuickPlay\QPService.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
  C:\WINDOWS\system32\0dca2571.exe
  C:\Program Files\DAEMON Tools\daemon.exe
  C:\Program Files\ewido anti-spyware 4.0\ewido.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\hjt\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=laptop
  R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
  O4 - HKLM\..\Run: [0dca2571.exe] C:\WINDOWS\system32\0dca2571.exe
  O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
  O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
  O4 - HKCU\..\Run: [0dca2571.exe] C:\Documents and Settings\thomas soden\Local Settings\Application Data\0dca2571.exe
  O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
  O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
  O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm
  O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=laptop
  O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin7USA.cab
  O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\g18856687.dll (file missing)
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: winkve32 - winkve32.dll (file missing)
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
  
  
  

  ---

  
  SmitFraudFix v2.73
  
  Scan done at 17:01:44.03, Mon 07/17/2006
  Run from C:\Documents and Settings\thomas soden\Desktop\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
  Fix ran in safe mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{259BA022-2005-45E9-A965-10EDB9C00605}"="Windows Updater"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Killing process
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
  
  GenericRenosFix by S!Ri
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
  
  C:\WINDOWS\system32\ishost.exe Deleted
  C:\WINDOWS\system32\ismon.exe Deleted
  C:\WINDOWS\system32\isnotify.exe Deleted
  C:\WINDOWS\system32\issearch.exe Deleted
  C:\WINDOWS\system32\ixt?.dll Deleted
  C:\WINDOWS\system32\ot.ico Deleted
  C:\WINDOWS\system32\ts.ico Deleted
  C:\DOCUME~1\THOMAS~1\FAVORI~1\Antivirus Test Online.url Deleted
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
  
  Registry Cleaning done.
  
  »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{259BA022-2005-45E9-A965-10EDB9C00605}"="Windows Updater"
  
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» End

  0
• Crunchie Mandurah. Western Australia. Member

  July 2006 edited July 2006

  Can you please do the following.
  
  ===============
  
  Run HiJackThis then:
  
  1. Click "Open the Misc Tools Section"
  2. Click "Open Process manager"
  
  -
  
  Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:
  
  C:\WINDOWS\system32\0dca2571.exe
  
  Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.
  
  ===============
  
  Scan with HiJackThis, then check(tick) the following, if present:
  
  
  R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  
  O4 - HKLM\..\Run: [0dca2571.exe] C:\WINDOWS\system32\0dca2571.exe
  O4 - HKCU\..\Run: [0dca2571.exe] C:\Documents and Settings\thomas soden\Local Settings\Application Data\0dca2571.exe
  
  O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\g18856687.dll (file missing)
  O20 - Winlogon Notify: winkve32 - winkve32.dll (file missing)
  
  
  Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
  
  ===============
  
  Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:
  
  files...
  
  C:\WINDOWS\system32\0dca2571.exe
  C:\Documents and Settings\thomas soden\Local Settings\Application Data\0dca2571.exe
  
  -
  
  Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "Safe Mode".
  
  -
  
  Reboot.
  
  ===============
  
  After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.

  0