Options

Trojan-Spy.HTML.Smitfraud.c

Unknown
edited April 2005 in Spyware & Virus Removal
When my computer boots up, my desktop has a blue background with the message below:

SECURITY WARNING

A fatal error in IE has occurred at 0028:C0011E36 in VXD VMM<01> + 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c

System can not function in normal mode. Please check your security settings.
Scan your PC with any available antivirus/spyware remover program to fix the problem.

-Also, a Notepad window pops up containing the following information:

DESKTOP.INI - Notepad

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

- I can access email, however I an unable to open antivirus/spyware programs or the internet.

Help!

Comments

  • kanezfankanezfan sunny south florida Icrontian
    edited April 2005
    Disable your active desktop and you wont see that error. I know Norton AV lets you boot up off of the CD to run a virus scan, not sure what AV program you have though.
  • PickeringSatellite
    edited April 2005
    When I right-click on my desktop, attempting to adjust my settings, the only two tabs I see are Screensaver and Settings. How can I disable my active desktop?
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited April 2005
    Moved to SVT so our crack SWAT Team can give you a hand. :)
  • PickeringSatellite
    edited April 2005
    Please help, Swat Team?!?!
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited April 2005
    Go Here, download HijackThis, then post the log here.

    We'll tell you what needs to be removed. Most of what HJT finds is good; don't treat it like a normal AV/Spyware program where you would delete everything. :)
  • PickeringSatellite
    edited April 2005
    Logfile of HijackThis v1.99.1

    Scan saved at 9:52:09 AM, on 4/14/2005

    Platform: Windows XP SP1 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)



    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\System32\brsvc01a.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\System32\brss01a.exe

    C:\Program Files\Dell\Media Experience\PCMService.exe

    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    C:\Program Files\Common Files\Dell\EUSW\Support.exe

    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    C:\Program Files\CasinoOnline\CsRemnd.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

    C:\wp.exe

    C:\WINDOWS\webshots.scr

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\System32\nvsvc32.exe

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

    C:\WINDOWS\System32\ctfmon.exe

    C:\Documents and Settings\Josh Barksdale\Local Settings\Temp\Temporary Directory 1 for HijackThis.zip\HijackThis.exe



    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pickeringandco.com/index.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm

    R3 - Default URLSearchHook is missing

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: (no name) - {ABB5DE2B-3912-48F7-AAB4-29BF505EC0B0} - C:\WINDOWS\System32\lob.dll (file missing)

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    O4 - HKLM\..\Run: [Remndr] "C:\Program Files\CasinoOnline\CsRemnd.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe

    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

    O9 - Extra button: Microsoft AntiSpyware helper - {E3BCA0D8-318E-41B9-A37E-83A669E7372F} - (no file) (HKCU)

    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E3BCA0D8-318E-41B9-A37E-83A669E7372F} - (no file) (HKCU)

    O15 - Trusted Zone: *.musicmatch.com

    O15 - Trusted Zone: *.musicmatch.com (HKLM)

    O16 - DPF: {284E61B6-0305-4C9A-9986-4CF949CADFAF} - http://69.50.182.94/1/rdgUS1882.exe

    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://domino5.ncat.edu/iNotes6.cab

    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdq/downloads/sysinfo.cab

    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx

    O16 - DPF: {69432678-2906-2705-1128-068943397621} -

    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdq/downloads/msxml4.cab

    O16 - DPF: {977231BF-B887-4CD7-8156-6F429268F7E2} (MRIWeb Class) - https://mriweb.mrinetsource.com/MRINet.cab

    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab

    O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    PLEASE HELP SWAT THIS PROBLEM, SWAT TEAM!!!!
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Let's see what we can do for you.

    You are currently using hijackthis from a temp directory. This can cause problems. Please create a directory on your c: drive called c:\hijackthis and download and unzip hijackthis into that directory. Run the program from that directory from now on. It is essential that you follow these steps or certain important features of the program will not function correctly.


    Please remove these entries from Add/Remove Programs in the Control Panel(if present):

    Viewpoint Manager
    Viewpoint Media Player



    Please download CWShredder but don't run it yet.
    http://cwshredder.net/bin/CWSInstall.exe


    Download Ad-aware SE from: http://www.majorgeeks.com/download506.html

    Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


    Make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
    R3 - Default URLSearchHook is missing
    O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll
    O2 - BHO: (no name) - {ABB5DE2B-3912-48F7-AAB4-29BF505EC0B0} - C:\WINDOWS\System32\lob.dll (file missing)
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [Remndr] "C:\Program Files\CasinoOnline\CsRemnd.exe"
    O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe


    Reboot your computer into Safe Mode


    Now run CWShredder, making sure to click "Fix".


    Then delete these files or directories (Do not be concerned if they do not exist)

    c:\wp.exe
    C:\WINDOWS\System32\lob.dll
    C:\WINDOWS\SYSTEM\Loader.dll
    C:\Program Files\CasinoOnline
    C:\Program Files\Viewpoint


    Run a full scan with Adaware.

    Reboot your computer to go back to normal mode and post a new log.
  • PickeringSatellite
    edited April 2005
    Logfile of HijackThis v1.99.1

    Scan saved at 11:50:11 AM, on 4/14/2005

    Platform: Windows XP SP1 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)



    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\System32\brsvc01a.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\System32\brss01a.exe

    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

    C:\Program Files\Dell\Media Experience\PCMService.exe

    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    C:\Program Files\Common Files\Dell\EUSW\Support.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

    C:\WINDOWS\webshots.scr

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\System32\nvsvc32.exe

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Documents and Settings\Josh Barksdale\Local Settings\Temp\Temporary Directory 1 for hijackthis_199.zip\HijackThis.exe



    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pickeringandco.com/index.html

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

    O9 - Extra button: Microsoft AntiSpyware helper - {E3BCA0D8-318E-41B9-A37E-83A669E7372F} - (no file) (HKCU)

    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E3BCA0D8-318E-41B9-A37E-83A669E7372F} - (no file) (HKCU)

    O15 - Trusted Zone: *.musicmatch.com

    O15 - Trusted Zone: *.musicmatch.com (HKLM)

    O16 - DPF: {284E61B6-0305-4C9A-9986-4CF949CADFAF} - http://69.50.182.94/1/rdgUS1882.exe

    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://domino5.ncat.edu/iNotes6.cab

    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdq/downloads/sysinfo.cab

    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx

    O16 - DPF: {69432678-2906-2705-1128-068943397621} -

    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdq/downloads/msxml4.cab

    O16 - DPF: {977231BF-B887-4CD7-8156-6F429268F7E2} (MRIWeb Class) - https://mriweb.mrinetsource.com/MRINet.cab

    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab

    O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



    Should I restore the settings concerning viewing Hidden files?
    I am still unable to adjust my desktop settings. My only options in Display Properties are Screensaver and Settings.
  • PickeringSatellite
    edited April 2005
    Did I do something wrong?!?!
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Have hijackthis fix these lines.

    O16 - DPF: {284E61B6-0305-4C9A-9986-4CF949CADFAF} - http://69.50.182.94/1/rdgUS1882.exe
    O16 - DPF: {69432678-2906-2705-1128-068943397621} -



    Go to Start -> Control Panel -> Add/Remove Programs and uninstall Webshots

    Then check your display settings again.
  • PickeringSatellite
    edited April 2005
    It removed the blue background containing the error message. Because I am now able to access the internet, I was able to change my desktop background, however I am still only able to view the Screensaver & Settings tabs under Display Properties.

    Thanks for the help thus far!
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Save the text at this link as fix.reg

    http://kellys-korner-xp.com/regs_edits/webtabmissing.reg

    Double click it, OK the prompt, and reboot.
  • la8pv
    edited April 2005
    I have tried updated versions of Spybot, Ad aware and Windows AntiSPyware but I am not getting rid of the problem. someone suggested to send a HiJack log to you guys for help, and here it is:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:07:50, on 20.04.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\system32\cisvc.exe
    C:\WINNT\System32\GEARSEC.EXE
    C:\Programfiler\Fellesfiler\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINNT\system32\cidaemon.exe
    C:\Programfiler\Software Innovation\Polaris\phobos.exe
    C:\WINNT\explorer.exe
    C:\WINNT\System32\TASKMGRU.EXE
    C:\WINNT\System32\MSIMN32.EXE
    C:\WINNT\SOUNDMAN.EXE
    C:\WINNT\System32\igfxtray.exe
    C:\WINNT\System32\hkcmd.exe
    C:\Quicktime\iTunesHelper.exe
    C:\Programfiler\QuickTime\qttask.exe
    C:\Programfiler\iPod\bin\iPodService.exe
    C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
    C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe
    C:\WINNT\System32\ctfmon.exe
    C:\Programfiler\Messenger\msmsgs.exe
    C:\WINNT\System32\MSIMN32.EXE
    C:\wp.exe
    C:\WINNT\System32\TASKMGRU.EXE
    D:\Vega5\dbsrv8.exe
    C:\Corel\Graphics8\Programs\MFIndexer.exe
    C:\Programfiler\Microsoft AntiSpyware\gcasDtServ.exe
    C:\powerpoint\Office\OSA.EXE
    C:\Documents and Settings\Stephan Jørgensen\Skrivebord\Vega.exe
    C:\WINNT\System32\wuauclt.exe
    C:\WINNT\System32\dllhost.exe
    C:\WINNT\System32\msdtc.exe
    C:\Programfiler\Microsoft Office\Office10\OUTLOOK.EXE
    C:\Programfiler\Spybot - Search & Destroy\SpybotSD.exe
    C:\Programfiler\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Stephan Jørgensen\Lokale innstillinger\Temp\Midlertidig mappe 2 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
    O2 - BHO: BHDP Class - {1A1488CB-8028-49ba-AD19-18D13CDC650F} - C:\WINNT\bhoass.dll
    O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Quicktime\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [¢‰¸K0¨4K
    }ïÁzî[8C:\Programfiler\ISTsvc\istsvc.exe] C:\WINNT\immpp.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MSIMN32] C:\WINNT\System32\MSIMN32.EXE
    O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
    O4 - HKCU\..\Run: [TASKMGRU] C:\WINNT\System32\TASKMGRU.EXE
    O4 - Startup: Office Oppstart.lnk = C:\powerpoint\Office\OSA.EXE
    O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O10 - Broken Internet access because of LSP provider 'c:\programfiler\newdotnet\newdotnet6_38.dll' missing
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - https://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/08a6ad08f20001181205/netzip/RdxIE601.cab
    O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
    O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
    O23 - Service: GEARSecurity - GEAR Software - C:\WINNT\System32\GEARSEC.EXE
    O23 - Service: InfoCenter - Software Innovation asa - C:\Programfiler\Software Innovation\InfoCenter\infocsvc.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe
    O23 - Service: Phobos - Software Innovation asa - C:\Programfiler\Software Innovation\Polaris\phobos.exe


    PLEASE HELP ME!
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    la8pv - Did you read the giant red letters at the top of every page that says -

    TO AVOID CONFUSION, PLEASE DO NOT POST YOUR LOG IN THE THREAD OF SOMEONE ELSE'S LOG.

    Start a new thread with your log and ONLY in the SVT forum.


    Please start your own thread and someone will help you.
Sign In or Register to comment.