Infected with several viruses, HijackThis Log Included - Please Help! (CA_Dude)

CA_DUDECA_DUDE
edited May 2005 in Spyware & Virus Removal
Hello,

My computer was recently infected with several viruses. I've been trying for two days to remove them, but can't seem to get them off my machine no matter what I try. Can someone please read the below summary of actions that I've taken and my HijackThis Log file and give me some advice of how I can terminate the little b*stards? Any help would be greatly appreciated!

Thanks in advance!
CA_Dude

Summary

Scanned computer with McAfee, didn't find anything. Now McAfee doesn't work at all (no firewall, no antivirus, nothing)

Downloaded Webroot's Spy Sweeper. Was able to install it, but program didn't run. I'd double click the desktop icon and nothing would happen. Went into webroot directory and renamed SpySweeper.exe to something random (e.g. 1234124.exe) then program worked. Found a pile of viruses on my machine.

F_juokikv[1]__exe
F_spoolsrv32[1]__exe
F_thun32[1]__dll.spy
R_Desktop Hijacker[1]
R_Vesbiz Downloader[2]
R_W-find Hijack[1]

Downloaded Spy Doctor, same deal as Spy Sweeper. I had to rename the .exe to get program to run. Found another pile of stuff. Deleted it all. I'd give some more virus names, but I can't pull up the log file.

Scanned computer with online virus scanner found another virus and deleted it. (Online scanner didn’t give name of virus.)

Switched to safe mode. Couldn’t access the internet because my DSL doesn’t work when I’m in safe mode; therefore, I wasn’t able to do an online scan. Scanned computer with both Spy Sweeper and Spy Doctor. Didn’t find anything.

Computer still exhibits signs of infestation. Namely, McAfee still doesn't work, even if I rename the .exe file. In addtion, my desktop is still hijacked. It taunts me by continuously flashing from gray to white no matter what I do to it.

Here's my HijackThis log file. Again, any suggestions would be greatly appreciated. Thank you!

Logfile of HijackThis v1.99.1
Scan saved at 12:04:59 AM, on 4/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\dbmsikey.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Spyware Doctor\tyertyer.exe
C:\Program Files\sw\kjh.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [RCScheduleCheck] C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\tyertyer.exe" /Q
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\sw\kjh.exe" /0
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/264b9403b90d8ec40805/netzip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093685545312
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4404/mcfscan.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/ym/yiebio5_1_6_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F2AA45A-987B-4152-94E1-AFD4AA006067}: NameServer = 63.203.35.55 206.13.28.12
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Fix-It Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Please download MWAV virus scanner and install. Run a scan and then post the log that it creates.

    http://www.mwti.net/antivirus/mwav.asp
  • CA_DUDECA_DUDE
    edited April 2005
    Here's the virus log generated by MWAV. Thanks for your help!

    at Apr 30 15:08:38 2005 => Total Objects Scanned: 70604
    Sat Apr 30 15:08:38 2005 => Total Virus(es) Found: 82
    Sat Apr 30 15:08:38 2005 => Total Disinfected Files: 0
    Sat Apr 30 15:08:38 2005 => Total Files Renamed: 0
    Sat Apr 30 15:08:38 2005 => Total Deleted Objects: 0
    Sat Apr 30 15:08:38 2005 => Total Errors: 149
    Sat Apr 30 15:08:38 2005 => Time Elapsed: 01:14:27
    Sat Apr 30 15:08:38 2005 => Virus Database Date: 2005/04/29
    Sat Apr 30 15:08:38 2005 => Virus Database Count: 127682

    Sat Apr 30 15:08:38 2005 => Scan Completed.


    File C:\WINDOWS\System32\qt-mgsvc.dll infected by "Backdoor.Win32.PPdoor.j" Virus.
    File System Found infected by "BearShare Spyware/Adware" Virus.
    File System Found infected by "vendor Spyware/Adware" Virus.
    File System Found infected by "Narrator Spyware/Adware" Virus.
    File System Found infected by "sw Spyware/Adware" Virus.
    File System Found infected by "bearshare Spyware/Adware" Virus.
    File System Found infected by "bearsharechatnotifymsg Spyware/Adware" Virus.
    File System Found infected by "cws.therealsearch Spyware/Adware" Virus.
    File C:\WINDOWS\System32\shell32.exe infected by "not-a-virus:AdWare.WinAD.b" Virus.
    File C:\WINDOWS\System32\sysmmsft.dll infected by "Backdoor.Win32.PPdoor.j" Virus.
    File C:\WINDOWS\System32\username.exe infected by "Trojan-Downloader.Win32.Small.ya" Virus.
    File C:\Documents and Settings\All Users\Documents\AOL Downloads\aolsetup90\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot.
    File C:\Program Files\BearShare\Installer\BSINSTALL.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus.
    File C:\Program Files\mIRC\download\Copy of Advanced Password Recovery - (Ace,Excel,Pdf,Zip,Icq,Rar,Access,Office,Outlook).rar tagged as not-a-virus:RiskWare.PSWTool.OEPass.b. No Action Taken.

    File C:\WINDOWS\SYSTEM32\DRIVERS\ETC\pnc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.NetCat. File C:\WINDOWS\SYSTEM32\shell32.exe infected by "not-a-virus:AdWare.WinAD.b" Virus.
    File C:\WINDOWS\SYSTEM32\sysmmsft.dll infected by "Backdoor.Win32.PPdoor.j" Virus.
    File C:\WINDOWS\SYSTEM32\username.exe infected by "Trojan-Downloader.Win32.Small.ya" Virus.

    Several of these
    File C:\RECYCLER\NPROTECT\00000489. infected by "BkCln.Unknown"
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Hmmm...more there than I would have guessed. Delete everything in your recycle bin, including whatever Norton is protecting.

    Please run at least two of these online scans.
    Make sure they are set to clean automatically:

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    http://www.bitdefender.com/scan/licence.php

    http://housecall.trendmicro.com/housecall/start_corp.asp

    There will be files that these scans will not remove. Please include that information in your next post.


    Reboot and post a new hijackthis log.
  • CA_DUDECA_DUDE
    edited May 2005
    I scanned my computer with both Panda and Bitdefender. Also, I found a trial version of MWAV and scanned my computer both in regular WINXP and safe mode. Below are the results of the scans (infected files still on my machine) as well as a new HJT log.

    I tried to delete those files that are being protected by Norton (e.g.File C:\RECYCLER\NPROTECT\00000489. infected by "BkCln.Unknown"). Unfortunately, I couldn't even rename them let alone delete them. Furthermore, I uninstalled Norton several months, so I don't know why those files are still there (assuming they are really from Norton and not some virus). You'll see below that MWAV claims to have renamed the files, but I looked in the folder after the scan and the file names are still the same.

    Again, thanks for your help,
    CA_DUDE

    PANDA ONLINE SCANNER

    C:\WINDOWS\System32\dbmsikey.exe (Is this file a system file or virus?)
    Adware:Adware/Adsmart C:\WINDOWS\SYSTEM32\thun.dll
    MWAV
    File C:\RECYCLER\NPROTECT\00000489. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000511. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000516. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000534. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000638. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000643. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000656. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000662. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000668. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000680. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000683. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000701. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000718. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000721. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000775. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000780. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000792. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000807. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000838. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000843. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000954. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00000976. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00001079. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00001094. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00001122. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00001325. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00002342. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00002408. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003688. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003693. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003711. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003831. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003839. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003858. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003871. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003877. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003890. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003894. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003904. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003920. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003932. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003954. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00003957. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004013. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004018. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004033. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004051. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004081. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004110. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004305. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004308. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004342. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004504. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004516. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004528. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00004556. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00011927. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00011993. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\RECYCLER\NPROTECT\00015392. infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.


    Bitdefender didn't find anything.


    Logfile of HijackThis v1.99.1
    Scan saved at 4:52:49 PM, on 5/1/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\eScan\TRAYSSER.EXE
    C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\locator.exe
    C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
    C:\WINDOWS\System32\hphmon04.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\WINDOWS\System32\RUNDLL32.EXE
    C:\WINDOWS\System32\dbmsikey.exe
    C:\WINDOWS\System32\HPHipm11.exe
    C:\PROGRA~1\eScan\TRAYICOS.EXE
    C:\PROGRA~1\eScan\MAILDISP.EXE
    C:\PROGRA~1\eScan\SPOOLER.EXE
    C:\PROGRA~1\eScan\MAILSCAN.EXE
    C:\PROGRA~1\eScan\kavss.exe
    C:\Program Files\Spyware Doctor\tyertyer.exe
    C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
    O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
    O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [RCScheduleCheck] C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\tyertyer.exe" /Q
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\sw\kjh.exe" /0
    O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/264b9403b90d8ec40805/netzip/RdxIE601.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093685545312
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4404/mcfscan.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/ym/yiebio5_1_6_0.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1F2AA45A-987B-4152-94E1-AFD4AA006067}: NameServer = 63.203.35.55 206.13.28.12
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: eScan Server-Updater (eScan-trayicos) - MWTI2 - C:\PROGRA~1\eScan\TRAYSSER.EXE
    O23 - Service: Fix-It Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    First let me say that your hijackthis log is clean, so none of these files are active on your system. It's just a matter of housecleaning.


    Delete these files, if you haven't already.

    C:\WINDOWS\System32\dbmsikey.exe
    C:\WINDOWS\SYSTEM32\thun.dll


    Even though you uninstalled Norton, parts of it still hang around and are very difficult to actually get rid of. Almost like a virus huh? :wtf:
    If you right click on your recycle bin you should get an option to select Remove Norton protected files, or something like that.

    Let me know if that doesn't work and I'll dig around and figure something else out.
  • CA_DUDECA_DUDE
    edited May 2005
    Buckeye_Sam,

    Thanks so much for your help. I really appreciate it.

    Per your instructions, I removed those two files. Also, I tried to delete those Norton files with Kill Box, but KB says those files don't exist. That's really strange because, I can see them when I go into the folder C:\RECYCLER\NPROTECT\. I tried to delete them by right clicking on the recycle bin, but there is no option to remove Norton Protected files. I must have done that when I originally uninstalled Norton months ago.

    I have much more control over my computer now, thanks again. However, my desktop is still hijacked. It still flashes from gray to white. I've adjusted my desktop properties back to what they were prior to the infection several times, but nothing happens. What can I do to regain control of my desktop?

    Again, thanks for the help,
    CA_DUDE

    Here's a new HJT log.

    Logfile of HijackThis v1.99.1
    Scan saved at 12:31:39 PM, on 5/2/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\eScan\TRAYSSER.EXE
    C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\locator.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
    C:\WINDOWS\System32\hphmon04.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\WINDOWS\System32\RUNDLL32.EXE
    C:\PROGRA~1\eScan\TRAYICOS.EXE
    C:\PROGRA~1\eScan\MAILDISP.EXE
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\WINDOWS\System32\HPHipm11.exe
    C:\Program Files\Spyware Doctor\tyertyer.exe
    C:\PROGRA~1\eScan\SPOOLER.EXE
    C:\PROGRA~1\eScan\MAILSCAN.EXE
    C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
    C:\PROGRA~1\eScan\kavss.exe
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
    O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
    O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [RCScheduleCheck] C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Agent Network] C:\WINDOWS\System32\dbmsikey.exe
    O4 - HKLM\..\Run: [QD FastAndSafe] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\Program Files\eScan\LAUNCH.EXE"
    O4 - HKLM\..\Run: [eScan Updater] C:\PROGRA~1\eScan\TRAYICOS.EXE /App
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\tyertyer.exe" /Q
    O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/264b9403b90d8ec40805/netzip/RdxIE601.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093685545312
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4404/mcfscan.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/ym/yiebio5_1_6_0.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1F2AA45A-987B-4152-94E1-AFD4AA006067}: NameServer = 63.203.35.55 206.13.28.12
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O21 - SSODL: Terminal Agent - {6DE292C6-FA54-4EBF-9983-D9D0F334232E} - C:\WINDOWS\System32\qt-mgsvc.dll (file missing)
    O23 - Service: eScan Server-Updater (eScan-trayicos) - MWTI2 - C:\PROGRA~1\eScan\TRAYSSER.EXE
    O23 - Service: Fix-It Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Good ol' Norton. The good news is that those files are trapped there. You can't get to them and they can't get to you, so they won't do your computer any harm. You might check out this page to see if it will help you completely get rid of Norton.

    http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001092114452606


    For your desktop problem, try this.

    Download the following reg file to your desktop by right clicking on the link, and selecting save as.

    http://www.bleepingcomputer.com/files/reg/smitfraud.reg

    Once it has downloaded, double-click on the smitfraud.reg file on your desktop and when it asks if you would like to merge the data, click on the Yes button.

    Reboot your computer and you should now be able to change your desktop settings back to how you would like it. If your desktop still looks strange, go into your display properties and click on the Themes tab. Change the theme to Windows XP and you will now be using the default Windows XP settings. Then change them as you see fit.
  • CA_DUDECA_DUDE
    edited May 2005
    My apologies for the delayed response. I was busy studying for an actuarial exam.

    I followed your instructions with the smitfraud.reg file (including changing my themes back to WINXP). Unfortunately, my desktop is still highjacked. Do you know of any other methods to find and eradicate the file(s) that are causing my desktop to stay hijacked?

    Thanks again for all your help. I really appreciate it.
    CA_DUDE

    New HJT Log

    Logfile of HijackThis v1.99.1
    Scan saved at 1:45:55 AM, on 5/6/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\eScan\TRAYSSER.EXE
    C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
    C:\WINDOWS\System32\hphmon04.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    C:\WINDOWS\System32\RUNDLL32.EXE
    C:\PROGRA~1\eScan\TRAYICOS.EXE
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\PROGRA~1\eScan\MAILDISP.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    C:\PROGRA~1\eScan\SPOOLER.EXE
    C:\PROGRA~1\eScan\MAILSCAN.EXE
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\System32\HPHipm11.exe
    C:\PROGRA~1\eScan\kavss.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
    C:\PROGRA~1\mcafee.com\agent\McDash.exe
    c:\program files\mcafee.com\shared\mghtml.exe
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
    O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
    O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [RCScheduleCheck] C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QD FastAndSafe] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\Program Files\eScan\LAUNCH.EXE"
    O4 - HKLM\..\Run: [eScan Updater] C:\PROGRA~1\eScan\TRAYICOS.EXE /App
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe /autorun
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\tyertyer.exe" /Q
    O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/264b9403b90d8ec40805/netzip/RdxIE601.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093685545312
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4404/mcfscan.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/ym/yiebio5_1_6_0.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1F2AA45A-987B-4152-94E1-AFD4AA006067}: NameServer = 206.13.31.12 206.13.28.12
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: eScan Server-Updater (eScan-trayicos) - MWTI2 - C:\PROGRA~1\eScan\TRAYSSER.EXE
    O23 - Service: Fix-It Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Try this:
    • Click Start>Control Panel>Display
    • Go to the Desktop tab and click on the Customise Desktop button.
    • Go to the Web tab
    • In the web page box, click on the page that is checkmarked and then click the Delete button.
    • Ok your way out of the dialog and check your desktop.
  • CA_DUDECA_DUDE
    edited May 2005
    IT WORKED!!!! :D


    Thanks for all your help. I really appreciate peope like yourself who are willing to take ten minutes out their day to save someone else hours of frustration. Once again, thank you!

    CA_DUDE
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Good to hear! :)

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
This discussion has been closed.