Options

hijackthis log help please

Unknown
edited March 2005 in Spyware & Virus Removal
Hi everyone;

My name is mat and this is a hijackthis log file from my buddy's computer. His computer was completely infested with spyware. I ran ad-aware, spybot S & D, and also installed spyware blaster and the google toolbar but it has definately been hijacked. The homepage cannot be changed and he has numerous pop-ups. He also has an icon which appears in the lower right corner of windows and it looks like the windows security center icon but when you click on it brings up another pop-up.

If someone could take a look at this log and tell me what needs to be deleted and also point me in the direction of some instructions on how to go about actually deleting the necessary items I would really appreciate it.

Logfile of HijackThis v1.99.1
Scan saved at 6:54:04 PM, on 2/28/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
C:\PROGRAM FILES\NETWORK ICE\BLACKICE\BLACKD.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\WINDOWS\SYSTEM\MSQS.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\NETWORK ICE\BLACKICE\BLACKICE.EXE
C:\PROGRAM FILES\SONY CORPORATION\IMAGE TRANSFER\SONYTRAY.EXE
C:\WINDOWS\NTXV32.EXE
C:\WINDOWS\NTXV32.EXE
C:\WINDOWS\NTXV32.EXE
C:\WINDOWS\SYSTEM\SYSTI32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\SECURITY TOOLS\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qhgts.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qhgts.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qhgts.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qhgts.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qhgts.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qhgts.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {CC5E9067-DA39-D1CA-F6C9-04308455ADD6} - C:\WINDOWS\SYSTEM\IEEM.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [MSQS.EXE] C:\WINDOWS\SYSTEM\MSQS.EXE
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
O4 - HKLM\..\RunServices: [LoadBlackD] C:\Program Files\Network ICE\BlackICE\blackd.exe
O4 - HKLM\..\RunServices: [NTXV32.EXE] C:\WINDOWS\NTXV32.EXE
O4 - HKLM\..\RunServices: [SYSTI32.EXE] C:\WINDOWS\SYSTEM\SYSTI32.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: BlackICE Defender QuickStart Guide.lnk = C:\Program Files\Network ICE\BlackICE\BlackICE Def Quickstart.pdf
O4 - Startup: BlackICE Utility.lnk = C:\Program Files\Network ICE\BlackICE\blackice.exe
O4 - Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mcafee.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\knktqplk.exe

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    Please follow these steps to remove the HSA from your computer.

    Step 1
    Download this tool called AboutBuster http://www.downloads.subratam.org/AboutBuster.zip
    Unzip it to your desktop but don't run it yet.


    Step 2
    Download Adaware SE Personal from http://www.lavasoft.de/english/default.shtml. Install and open Adaware and click on *Check for Updates Now* and then *Connect*. It will find a new reference-file. Click *ok* and let it download and install the updates by clicking on *Finish* .This will return you to the main screen. Exit Adaware.


    Step 3
    Print out these instructions so you have them handy as most of the steps need to be done in safe mode and you may not be able to go online.


    Step 4
    Make sure your PC is configured to show hidden files.
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"


    Step 5
    Reboot to Safe Mode
    Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. To get back to normal mode just restart the computer as you normally would.


    Step 6
    Scan with Hijack This and put checks next to all the following, then click "Fix Checked"


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qhgts.dll/sp.html#12345
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qhgts.dll/sp.html#12345
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qhgts.dll/sp.html#12345
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qhgts.dll/sp.html#12345
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qhgts.dll/sp.html#12345
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qhgts.dll/sp.html#12345
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {CC5E9067-DA39-D1CA-F6C9-04308455ADD6} - C:\WINDOWS\SYSTEM\IEEM.DLL
    O4 - HKLM\..\Run: [MSQS.EXE] C:\WINDOWS\SYSTEM\MSQS.EXE
    O4 - HKLM\..\RunServices: [NTXV32.EXE] C:\WINDOWS\NTXV32.EXE
    O4 - HKLM\..\RunServices: [SYSTI32.EXE] C:\WINDOWS\SYSTEM\SYSTI32.EXE
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\knktqplk.exe


    and delete the following files if present(do not be concerned if some do not exist).


    C:\WINDOWS\SYSTEM\MSQS.EXE
    C:\WINDOWS\NTXV32.EXE
    C:\WINDOWS\qhgts.dll
    C:\WINDOWS\SYSTEM\SYSTI32.EXE
    C:\WINDOWS\SYSTEM\IEEM.DLL
    C:\Program Files\Internet Explorer\knktqplk.exe




    Step 7
    Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.


    Step 8
    Scan with Adaware and let it remove any bad files found.


    Step 9
    Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

    Temporary Files
    Temporary Internet Files
    Recycle Bin


    Step 10
    Reboot to normal mode, scan again with Hijack This and post a new log here.


    Step 11
    Finally, do an online scan at one of the following sites. Let it remove any infected files found.
    http://housecall.antivirus.com
    or
    http://www.pandasoftware.com/activescan/com/activescan_principal.htm


    Post a fresh HijackThis log and the AboutBuster report back here please.
  • matsawin
    edited March 2005
    Thanks for your detailed reply. I will follow these steps toady and post the results back here asap. Thanks

    ~Mat
  • matsawin
    edited March 2005
    Hi;

    I took all the steps listed and things seem to be fixed.

    Here is the aboutbuster log:

    Scanned at: 6:40:46 PM on: 3/12/2005


    -- Scan 1
    About:Buster Version 4.0
    Reference List : 19


    ADS not scanned System(FAT)
    Attempted Clean Of Temp folder.
    Removed Uninstall Key (HSA)
    Removed Uninstall Key (SE)
    Removed Uninstall Key (SW)
    Pages Reset... Done!

    -- Scan 2
    About:Buster Version 4.0
    Reference List : 19


    ADS not scanned System(FAT)
    Attempted Clean Of Temp folder.
    Pages Reset... Done!

    Here is the Hijackthis log:

    Logfile of HijackThis v1.99.1
    Scan saved at 7:03:27 PM, on 3/12/2005
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SSDPSRV.EXE
    C:\PROGRAM FILES\COMMON FILES\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
    C:\PROGRAM FILES\NETWORK ICE\BLACKICE\BLACKD.EXE
    C:\WINDOWS\SYSTEM\DEVLDR16.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\PRINTRAY.EXE
    C:\WINDOWS\SYSTEM\LXSUPMON.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\PCTVOICE.EXE
    C:\WINDOWS\SYSTEM\CTFMON.EXE
    C:\WINDOWS\SYSTEM\LEXBCES.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\PROGRAM FILES\NETWORK ICE\BLACKICE\BLACKICE.EXE
    C:\WINDOWS\DESKTOP\SECURITY TOOLS\HIJACKTHIS\HIJACKTHIS.EXE

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
    O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [LexStart] Lexstart.exe
    O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
    O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
    O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
    O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
    O4 - HKLM\..\RunServices: [LoadBlackD] C:\Program Files\Network ICE\BlackICE\blackd.exe
    O4 - HKLM\..\RunServices: [IEQT.EXE] C:\WINDOWS\SYSTEM\IEQT.EXE
    O4 - HKLM\..\RunServices: [D3SI32.EXE] C:\WINDOWS\D3SI32.EXE
    O4 - HKLM\..\RunServices: [MFCSS32.EXE] C:\WINDOWS\MFCSS32.EXE
    O4 - HKLM\..\RunServices: [APPUL32.EXE] C:\WINDOWS\APPUL32.EXE
    O4 - HKLM\..\RunServices: [D3IN32.EXE] C:\WINDOWS\D3IN32.EXE
    O4 - HKLM\..\RunServices: [IEIR32.EXE] C:\WINDOWS\SYSTEM\IEIR32.EXE
    O4 - HKLM\..\RunServices: [SDKXX.EXE] C:\WINDOWS\SDKXX.EXE
    O4 - HKLM\..\RunServices: [MFCZC.EXE] C:\WINDOWS\MFCZC.EXE
    O4 - HKLM\..\RunServices: [IEQO.EXE] C:\WINDOWS\SYSTEM\IEQO.EXE
    O4 - HKLM\..\RunServices: [MSHC32.EXE] C:\WINDOWS\SYSTEM\MSHC32.EXE
    O4 - HKLM\..\RunServices: [MFCWM.EXE] C:\WINDOWS\MFCWM.EXE
    O4 - HKLM\..\RunServices: [NTXJ32.EXE] C:\WINDOWS\SYSTEM\NTXJ32.EXE
    O4 - HKLM\..\RunServices: [CRRL32.EXE] C:\WINDOWS\CRRL32.EXE
    O4 - HKLM\..\RunServices: [JAVAVU.EXE] C:\WINDOWS\JAVAVU.EXE
    O4 - HKLM\..\RunServices: [SYSBH.EXE] C:\WINDOWS\SYSTEM\SYSBH.EXE
    O4 - HKLM\..\RunServices: [APPAO.EXE] C:\WINDOWS\SYSTEM\APPAO.EXE
    O4 - HKLM\..\RunServices: [SYSBC32.EXE] C:\WINDOWS\SYSBC32.EXE
    O4 - HKLM\..\RunServices: [MFCDH.EXE] C:\WINDOWS\SYSTEM\MFCDH.EXE
    O4 - HKLM\..\RunServices: [D3DH32.EXE] C:\WINDOWS\D3DH32.EXE
    O4 - HKLM\..\RunServices: [NETDS32.EXE] C:\WINDOWS\SYSTEM\NETDS32.EXE
    O4 - HKLM\..\RunServices: [MFCVK.EXE] C:\WINDOWS\MFCVK.EXE
    O4 - HKLM\..\RunServices: [ATLWK.EXE] C:\WINDOWS\ATLWK.EXE
    O4 - HKLM\..\RunServices: [SDKZO32.EXE] C:\WINDOWS\SYSTEM\SDKZO32.EXE
    O4 - HKLM\..\RunServices: [APIWY.EXE] C:\WINDOWS\APIWY.EXE
    O4 - HKLM\..\RunServices: [NTMH.EXE] C:\WINDOWS\NTMH.EXE
    O4 - HKLM\..\RunServices: [IPBE.EXE] C:\WINDOWS\IPBE.EXE
    O4 - HKLM\..\RunServices: [CRDB32.EXE] C:\WINDOWS\CRDB32.EXE
    O4 - HKLM\..\RunServices: [D3ML32.EXE] C:\WINDOWS\D3ML32.EXE
    O4 - HKLM\..\RunServices: [SYSPO.EXE] C:\WINDOWS\SYSPO.EXE
    O4 - HKLM\..\RunServices: [APIUD.EXE] C:\WINDOWS\APIUD.EXE
    O4 - HKLM\..\RunServices: [IERU.EXE] C:\WINDOWS\IERU.EXE
    O4 - HKLM\..\RunServices: [SDKEY32.EXE] C:\WINDOWS\SDKEY32.EXE
    O4 - HKLM\..\RunServices: [IPBL.EXE] C:\WINDOWS\SYSTEM\IPBL.EXE
    O4 - HKLM\..\RunServices: [IEZM32.EXE] C:\WINDOWS\IEZM32.EXE
    O4 - HKLM\..\RunServices: [MSLU32.EXE] C:\WINDOWS\MSLU32.EXE
    O4 - HKLM\..\RunServices: [APIJG32.EXE] C:\WINDOWS\SYSTEM\APIJG32.EXE
    O4 - HKLM\..\RunServices: [ATLXZ32.EXE] C:\WINDOWS\ATLXZ32.EXE
    O4 - HKLM\..\RunServices: [WINQD32.EXE] C:\WINDOWS\SYSTEM\WINQD32.EXE
    O4 - HKLM\..\RunServices: [APITJ.EXE] C:\WINDOWS\SYSTEM\APITJ.EXE
    O4 - HKLM\..\RunServices: [MFCOL32.EXE] C:\WINDOWS\MFCOL32.EXE
    O4 - HKLM\..\RunServices: [IPZZ32.EXE] C:\WINDOWS\SYSTEM\IPZZ32.EXE
    O4 - HKLM\..\RunServices: [APPGE32.EXE] C:\WINDOWS\SYSTEM\APPGE32.EXE
    O4 - HKLM\..\RunServices: [SDKAQ32.EXE] C:\WINDOWS\SYSTEM\SDKAQ32.EXE
    O4 - HKLM\..\RunServices: [NTLB.EXE] C:\WINDOWS\SYSTEM\NTLB.EXE
    O4 - HKLM\..\RunServices: [SYSCP.EXE] C:\WINDOWS\SYSTEM\SYSCP.EXE
    O4 - HKLM\..\RunServices: [SDKFM32.EXE] C:\WINDOWS\SDKFM32.EXE
    O4 - HKLM\..\RunServices: [MFCXP.EXE] C:\WINDOWS\SYSTEM\MFCXP.EXE
    O4 - HKLM\..\RunServices: [IENQ32.EXE] C:\WINDOWS\SYSTEM\IENQ32.EXE
    O4 - HKLM\..\RunServices: [APPLG32.EXE] C:\WINDOWS\APPLG32.EXE
    O4 - HKLM\..\RunServices: [MSVK.EXE] C:\WINDOWS\SYSTEM\MSVK.EXE
    O4 - HKLM\..\RunServices: [ADDAF.EXE] C:\WINDOWS\SYSTEM\ADDAF.EXE
    O4 - HKLM\..\RunServices: [JAVABP.EXE] C:\WINDOWS\JAVABP.EXE
    O4 - HKLM\..\RunServices: [ADDMR32.EXE] C:\WINDOWS\SYSTEM\ADDMR32.EXE
    O4 - HKLM\..\RunServices: [ATLGP.EXE] C:\WINDOWS\ATLGP.EXE
    O4 - HKLM\..\RunServices: [CRLS32.EXE] C:\WINDOWS\CRLS32.EXE
    O4 - HKLM\..\RunServices: [MFCNN32.EXE] C:\WINDOWS\MFCNN32.EXE
    O4 - HKLM\..\RunServices: [JAVABB.EXE] C:\WINDOWS\JAVABB.EXE
    O4 - HKLM\..\RunServices: [D3DW32.EXE] C:\WINDOWS\SYSTEM\D3DW32.EXE
    O4 - HKLM\..\RunServices: [SYSAL.EXE] C:\WINDOWS\SYSTEM\SYSAL.EXE
    O4 - HKLM\..\RunServices: [WINLZ32.EXE] C:\WINDOWS\WINLZ32.EXE
    O4 - HKLM\..\RunServices: [SYSCZ32.EXE] C:\WINDOWS\SYSTEM\SYSCZ32.EXE
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Startup: BlackICE Defender QuickStart Guide.lnk = C:\Program Files\Network ICE\BlackICE\BlackICE Def Quickstart.pdf
    O4 - Startup: BlackICE Utility.lnk = C:\Program Files\Network ICE\BlackICE\blackice.exe
    O4 - Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
    O14 - IERESET.INF: START_PAGE_URL=http://www.mcafee.com
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab

    I appreciate all your help. If there is anything else left to be done please let me know.
    Thanks a bunch.
    ~mat
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    You are still infected. You should know that the fix for HSA is time sensitive. The file names can change every time you reboot and every time you use IE. It can also create more files(as evident in your log) if it determines that it's being removed. If you wait another 10 days to do this fix, it probably will not work again.


    Please download CWShredder but don't run it yet.
    http://cwshredder.net/bin/CWSInstall.exe


    Download Ad-aware SE from: http://www.majorgeeks.com/download506.html

    Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


    Make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

    O4 - HKLM\..\RunServices: [IEQT.EXE] C:\WINDOWS\SYSTEM\IEQT.EXE
    O4 - HKLM\..\RunServices: [D3SI32.EXE] C:\WINDOWS\D3SI32.EXE
    O4 - HKLM\..\RunServices: [MFCSS32.EXE] C:\WINDOWS\MFCSS32.EXE
    O4 - HKLM\..\RunServices: [APPUL32.EXE] C:\WINDOWS\APPUL32.EXE
    O4 - HKLM\..\RunServices: [D3IN32.EXE] C:\WINDOWS\D3IN32.EXE
    O4 - HKLM\..\RunServices: [IEIR32.EXE] C:\WINDOWS\SYSTEM\IEIR32.EXE
    O4 - HKLM\..\RunServices: [SDKXX.EXE] C:\WINDOWS\SDKXX.EXE
    O4 - HKLM\..\RunServices: [MFCZC.EXE] C:\WINDOWS\MFCZC.EXE
    O4 - HKLM\..\RunServices: [IEQO.EXE] C:\WINDOWS\SYSTEM\IEQO.EXE
    O4 - HKLM\..\RunServices: [MSHC32.EXE] C:\WINDOWS\SYSTEM\MSHC32.EXE
    O4 - HKLM\..\RunServices: [MFCWM.EXE] C:\WINDOWS\MFCWM.EXE
    O4 - HKLM\..\RunServices: [NTXJ32.EXE] C:\WINDOWS\SYSTEM\NTXJ32.EXE
    O4 - HKLM\..\RunServices: [CRRL32.EXE] C:\WINDOWS\CRRL32.EXE
    O4 - HKLM\..\RunServices: [JAVAVU.EXE] C:\WINDOWS\JAVAVU.EXE
    O4 - HKLM\..\RunServices: [SYSBH.EXE] C:\WINDOWS\SYSTEM\SYSBH.EXE
    O4 - HKLM\..\RunServices: [APPAO.EXE] C:\WINDOWS\SYSTEM\APPAO.EXE
    O4 - HKLM\..\RunServices: [SYSBC32.EXE] C:\WINDOWS\SYSBC32.EXE
    O4 - HKLM\..\RunServices: [MFCDH.EXE] C:\WINDOWS\SYSTEM\MFCDH.EXE
    O4 - HKLM\..\RunServices: [D3DH32.EXE] C:\WINDOWS\D3DH32.EXE
    O4 - HKLM\..\RunServices: [NETDS32.EXE] C:\WINDOWS\SYSTEM\NETDS32.EXE
    O4 - HKLM\..\RunServices: [MFCVK.EXE] C:\WINDOWS\MFCVK.EXE
    O4 - HKLM\..\RunServices: [ATLWK.EXE] C:\WINDOWS\ATLWK.EXE
    O4 - HKLM\..\RunServices: [SDKZO32.EXE] C:\WINDOWS\SYSTEM\SDKZO32.EXE
    O4 - HKLM\..\RunServices: [APIWY.EXE] C:\WINDOWS\APIWY.EXE
    O4 - HKLM\..\RunServices: [NTMH.EXE] C:\WINDOWS\NTMH.EXE
    O4 - HKLM\..\RunServices: [IPBE.EXE] C:\WINDOWS\IPBE.EXE
    O4 - HKLM\..\RunServices: [CRDB32.EXE] C:\WINDOWS\CRDB32.EXE
    O4 - HKLM\..\RunServices: [D3ML32.EXE] C:\WINDOWS\D3ML32.EXE
    O4 - HKLM\..\RunServices: [SYSPO.EXE] C:\WINDOWS\SYSPO.EXE
    O4 - HKLM\..\RunServices: [APIUD.EXE] C:\WINDOWS\APIUD.EXE
    O4 - HKLM\..\RunServices: [IERU.EXE] C:\WINDOWS\IERU.EXE
    O4 - HKLM\..\RunServices: [SDKEY32.EXE] C:\WINDOWS\SDKEY32.EXE
    O4 - HKLM\..\RunServices: [IPBL.EXE] C:\WINDOWS\SYSTEM\IPBL.EXE
    O4 - HKLM\..\RunServices: [IEZM32.EXE] C:\WINDOWS\IEZM32.EXE
    O4 - HKLM\..\RunServices: [MSLU32.EXE] C:\WINDOWS\MSLU32.EXE
    O4 - HKLM\..\RunServices: [APIJG32.EXE] C:\WINDOWS\SYSTEM\APIJG32.EXE
    O4 - HKLM\..\RunServices: [ATLXZ32.EXE] C:\WINDOWS\ATLXZ32.EXE
    O4 - HKLM\..\RunServices: [WINQD32.EXE] C:\WINDOWS\SYSTEM\WINQD32.EXE
    O4 - HKLM\..\RunServices: [APITJ.EXE] C:\WINDOWS\SYSTEM\APITJ.EXE
    O4 - HKLM\..\RunServices: [MFCOL32.EXE] C:\WINDOWS\MFCOL32.EXE
    O4 - HKLM\..\RunServices: [IPZZ32.EXE] C:\WINDOWS\SYSTEM\IPZZ32.EXE
    O4 - HKLM\..\RunServices: [APPGE32.EXE] C:\WINDOWS\SYSTEM\APPGE32.EXE
    O4 - HKLM\..\RunServices: [SDKAQ32.EXE] C:\WINDOWS\SYSTEM\SDKAQ32.EXE
    O4 - HKLM\..\RunServices: [NTLB.EXE] C:\WINDOWS\SYSTEM\NTLB.EXE
    O4 - HKLM\..\RunServices: [SYSCP.EXE] C:\WINDOWS\SYSTEM\SYSCP.EXE
    O4 - HKLM\..\RunServices: [SDKFM32.EXE] C:\WINDOWS\SDKFM32.EXE
    O4 - HKLM\..\RunServices: [MFCXP.EXE] C:\WINDOWS\SYSTEM\MFCXP.EXE
    O4 - HKLM\..\RunServices: [IENQ32.EXE] C:\WINDOWS\SYSTEM\IENQ32.EXE
    O4 - HKLM\..\RunServices: [APPLG32.EXE] C:\WINDOWS\APPLG32.EXE
    O4 - HKLM\..\RunServices: [MSVK.EXE] C:\WINDOWS\SYSTEM\MSVK.EXE
    O4 - HKLM\..\RunServices: [ADDAF.EXE] C:\WINDOWS\SYSTEM\ADDAF.EXE
    O4 - HKLM\..\RunServices: [JAVABP.EXE] C:\WINDOWS\JAVABP.EXE
    O4 - HKLM\..\RunServices: [ADDMR32.EXE] C:\WINDOWS\SYSTEM\ADDMR32.EXE
    O4 - HKLM\..\RunServices: [ATLGP.EXE] C:\WINDOWS\ATLGP.EXE
    O4 - HKLM\..\RunServices: [CRLS32.EXE] C:\WINDOWS\CRLS32.EXE
    O4 - HKLM\..\RunServices: [MFCNN32.EXE] C:\WINDOWS\MFCNN32.EXE
    O4 - HKLM\..\RunServices: [JAVABB.EXE] C:\WINDOWS\JAVABB.EXE
    O4 - HKLM\..\RunServices: [D3DW32.EXE] C:\WINDOWS\SYSTEM\D3DW32.EXE
    O4 - HKLM\..\RunServices: [SYSAL.EXE] C:\WINDOWS\SYSTEM\SYSAL.EXE
    O4 - HKLM\..\RunServices: [WINLZ32.EXE] C:\WINDOWS\WINLZ32.EXE
    O4 - HKLM\..\RunServices: [SYSCZ32.EXE] C:\WINDOWS\SYSTEM\SYSCZ32.EXE


    Reboot your computer into Safe Mode


    Now run CWShredder, making sure to click "Fix".


    Then delete these files or directories (Do not be concerned if they do not exist)

    C:\WINDOWS\SYSTEM\IEQT.EXE
    C:\WINDOWS\D3SI32.EXE
    C:\WINDOWS\MFCSS32.EXE
    C:\WINDOWS\APPUL32.EXE
    C:\WINDOWS\D3IN32.EXE
    C:\WINDOWS\SYSTEM\IEIR32.EXE
    C:\WINDOWS\SDKXX.EXE
    C:\WINDOWS\MFCZC.EXE
    C:\WINDOWS\SYSTEM\IEQO.EXE
    C:\WINDOWS\SYSTEM\MSHC32.EXE
    C:\WINDOWS\MFCWM.EXE
    C:\WINDOWS\SYSTEM\NTXJ32.EXE
    C:\WINDOWS\CRRL32.EXE
    C:\WINDOWS\JAVAVU.EXE
    C:\WINDOWS\SYSTEM\SYSBH.EXE
    C:\WINDOWS\SYSTEM\APPAO.EXE
    C:\WINDOWS\SYSBC32.EXE
    C:\WINDOWS\SYSTEM\MFCDH.EXE
    C:\WINDOWS\D3DH32.EXE
    C:\WINDOWS\SYSTEM\NETDS32.EXE
    C:\WINDOWS\MFCVK.EXE
    C:\WINDOWS\ATLWK.EXE
    C:\WINDOWS\SYSTEM\SDKZO32.EXE
    C:\WINDOWS\APIWY.EXE
    C:\WINDOWS\NTMH.EXE
    C:\WINDOWS\IPBE.EXE
    C:\WINDOWS\CRDB32.EXE
    C:\WINDOWS\D3ML32.EXE
    C:\WINDOWS\SYSPO.EXE
    C:\WINDOWS\APIUD.EXE
    C:\WINDOWS\IERU.EXE
    C:\WINDOWS\SDKEY32.EXE
    C:\WINDOWS\SYSTEM\IPBL.EXE
    C:\WINDOWS\IEZM32.EXE
    C:\WINDOWS\MSLU32.EXE
    C:\WINDOWS\SYSTEM\APIJG32.EXE
    C:\WINDOWS\ATLXZ32.EXE
    C:\WINDOWS\SYSTEM\WINQD32.EXE
    C:\WINDOWS\SYSTEM\APITJ.EXE
    C:\WINDOWS\MFCOL32.EXE
    C:\WINDOWS\SYSTEM\IPZZ32.EXE
    C:\WINDOWS\SYSTEM\APPGE32.EXE
    C:\WINDOWS\SYSTEM\SDKAQ32.EXE
    C:\WINDOWS\SYSTEM\NTLB.EXE
    C:\WINDOWS\SYSTEM\SYSCP.EXE
    C:\WINDOWS\SDKFM32.EXE
    C:\WINDOWS\SYSTEM\MFCXP.EXE
    C:\WINDOWS\SYSTEM\IENQ32.EXE
    C:\WINDOWS\APPLG32.EXE
    C:\WINDOWS\SYSTEM\MSVK.EXE
    C:\WINDOWS\SYSTEM\ADDAF.EXE
    C:\WINDOWS\JAVABP.EXE
    C:\WINDOWS\SYSTEM\ADDMR32.EXE
    C:\WINDOWS\ATLGP.EXE
    C:\WINDOWS\CRLS32.EXE
    C:\WINDOWS\MFCNN32.EXE
    C:\WINDOWS\JAVABB.EXE
    C:\WINDOWS\SYSTEM\D3DW32.EXE
    C:\WINDOWS\SYSTEM\SYSAL.EXE
    C:\WINDOWS\WINLZ32.EXE
    C:\WINDOWS\SYSTEM\SYSCZ32.EXE


    Run a full scan with Adaware.

    Reboot your computer to go back to normal mode and post a new log.
  • matsawin
    edited March 2005
    Hi;

    I am away from the computer for the next seven days. I will go back and re-post a log as soon as I get back. Sorry for making you go over this more than once. I will run hijack this when I'm back from my trip and try to act more quickly next time. Thanks again.

    ~mat
Sign In or Register to comment.