bestfriends.scr please help witm my HJT log

Unknown

Logfile of HijackThis v1.98.2
Scan saved at 5:38:01 PM, on 9/27/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\pctspk.exe
C:\Program Files\FrontierNet\FrontierNet DSL Attendant\app\TangoService.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\System32\ICQLITE.EXE
C:\Documents and Settings\s\Application Data\crf??g.exe
C:\WINNT\System32\??oolsv.exe
C:\WINNT\System32\Jel387h.exe
C:\WINNT\System32\Yefy37.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\pchealth\helpctr\binaries\helpctr.exe
C:\WINNT\explorer.exe
C:\DOCUME~1\s\LOCALS~1\Temp\Rar$EX00.863\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINNT\localNRD.dll
O2 - BHO: (no name) - {4EFA3809-B46D-78B3-D225-6D557FF9211E} - C:\WINNT\System32\yprejsdk.dll
O2 - BHO: deskbarBHO Class - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Toolbar Pack\DESKBAR\deskbar.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINNT\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINNT\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\System32\msbe.dll
O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-D4F3-F66DA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrsaimf.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [5QSTXLD2X#MWXX] C:\WINNT\System32\RmtPCB55.exe
O4 - HKLM\..\Run: [uacmyusj] C:\WINNT\System32\rbejgeyf.exe
O4 - HKLM\..\Run: [TangoManager] C:\PROGRA~1\FRONTI~1\FRONTI~1\app\TANGOM~1.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ICQ Lite Messenger] ICQLITE.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Asaa] C:\Documents and Settings\s\Application Data\crf??g.exe
O4 - HKCU\..\Run: [Idp] C:\WINNT\System32\??oolsv.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\RunOnce: [ICQ Lite Messenger] ICQLITE.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/12wfwr1d.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=ffe5909ffe00eb7f12d063133b3d23bee077a5bf6056e04090b5d765ec2e75e4f9e8656dccedb6d89d09d2c86f5b30597ea87d3d2a4c1ed47e9128c74281bfb4:a6d60611056994dfac80e4ac3a715ede
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/070a56e62451c28b1103/netzip/RdxIE601.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50188/QDow_AS2.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {D772D92A-30F8-457D-B63B-1C1BEEE4F514} (WebInstCtrl Class) - http://freepopupblocker.duble.com/tool/WebInstAx.cab
O16 - DPF: {D97287B6-4018-4060-948D-54D2122FC5C3} - http://www.fastfind.org/ss/client/52983/vsigns/0003C00/setup.exe
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.roings.com/cabs/mmed.cab

Trogan

Hi, there is a removal guide for the bestfriends.scr virus.

Click here for the guide and also post a HJT log.

Good Luck

geoffrowley

i tried doing that stuff already and couldnt get it to work.

Trogan

Post a HJT log

Dexter

He did post a log Trogan

However, he did not follow the instructions in the BIG RED LETTERS AT THE TOP OF THE PAGE!

Please read:

Steps To Take Before Posting a Hijack This Log

SVT Forum Etiquette


Your post is exactly the kind our Etiquette thread talks about. No explanation, no please or thank you. Just a log. Guess what? We get really frustrated by those kinds of posts, and we will not help you until you follow the posting guidelines in those 2 links.

Dexter...