Options

Need help with this hijack this log file

Unknown
edited May 2005 in Spyware & Virus Removal
My aunt's computer has been thoroughly infested with spyware/trojans. Last week, I had to use the winsock win xp fix to get their internet back. Something messed it up and that was the only fix I could get to work. After getting their
computer back on the net, I was able to get spybot and adaware updated and running. I ran 3 different anti-virus (avg, trend micro, and Kaspersky on a trial basis), along with trojan hunter. I couldnt stay, and she let those antivirus scan her computer overnight. She said it found a bunch of trojans and crap. I went by yesterday and she said that the firefox browser no longer worked, and only IE did. However, I noticed that IE was still being "hijacked". While there, her anti-virus kept finding tons of trojans on her computer. I reinstalled firefox and noticed it almost seemed like it was being hijacked too. I ran hijack this and this is her log file.

Logfile of HijackThis v1.99.1
Scan saved at 4:18:24 PM, on 5/13/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\Debbie Armstrong\Application Data\dees.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Debbie Armstrong\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [fdjfocv] c:\windows\system32\fdjfocv.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PS1] C:\WINDOWS\System32\ps1.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Ltho] C:\Documents and Settings\Debbie Armstrong\Application Data\dees.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} - http://www.pacimedia.com/install/pcs_0026.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\i8jq0i15e8.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: CWShredder Service - InterMute, Inc. - D:\Deb\Stuff for Debbie\CWShredder.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Some of the trojans found include VX2 , FFIsearch, and IBIS. Any information is appreciated. I'm about to the point telling her just to backup everything, reformat and reinstall windows. Her pentium 4 2.4 GHz runs slower than my old windows 98Se on a pentium 3 550 MHz mainly because of that crap.

Comments

  • Go6Go
    edited May 2005
    This is from my aunt's computer. It is very infested with trojans and crap. I had to run the winsock xp fix just to get the computer back on the internet. She is now running 3 different antivirus programs, adaware, spybot, etc. But she she says after she fixes them, they come back upon reboot. The virus scanners is always finding trojans (like I said, it was very infested). Any help is appreciated. Thanks. She says there is a trojan in here winlogon S that keeps appearing as well.

    Logfile of HijackThis v1.99.1
    Scan saved at 4:21:22 PM, on 5/13/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\TrojanHunter 4.2\THGuard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\AIM\aim.exe
    C:\Documents and Settings\Debbie Armstrong\Application Data\dees.exe
    C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
    C:\Program Files\Common Files\WinTools\WSup.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\WinTools\WToolsA.exe
    C:\Documents and Settings\Debbie Armstrong\Desktop\HijackThis.exe

    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
    O4 - HKLM\..\Run: [fdjfocv] c:\windows\system32\fdjfocv.exe
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch
    Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
    Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky
    Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
    Shared\ccApp.exe"
    O4 - HKLM\..\Run: [PS1] C:\WINDOWS\System32\ps1.exe
    O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware
    Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [Ltho] C:\Documents and Settings\Debbie Armstrong\Application
    Data\dees.exe
    O4 - HKCU\..\Run: [PopUpStopperFreeEdition]
    "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM
    Toolbar\AIMBar.dll/aimsearch.htm
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
    Files\AIM\aim.exe
    O15 - Trusted Zone: *.awmdabest.com (HKLM)
    O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} -
    http://www.pacimedia.com/install/pcs_0026.exe
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: URL - C:\WINDOWS\system32\i8jq0i15e8.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: CWShredder Service - InterMute, Inc. - D:\Deb\Stuff for
    Debbie\CWShredder.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky
    Anti-Virus Personal\kavsvc.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
    C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online,
    Inc. - C:\WINDOWS\wanmpsvc.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Please do not post twice for the same problem. I have merged both of your posts into one thread.

    Wintools may have an entry in the Add/Remove Programs Control Panel. If so, it may be easy to get rid of. If not, there are still ways to remove it from your system.

    For either solution:


    Reboot into Safe Mode.


    Once in Safe Mode:
    Click on the Start Button, Control Panel. Double-click on Administrative Tools then on Services.
    Look for a service called Wintools for IE Service. double-click it to open, then click the Stop button and change the "Startup type" to Disabled.
    (If the service is not there, no worries...all the better!)

    Next, right-click on the Windows Taskbar and select Task Manager.
    In the Processes tab, look for WToolsA.exe, WToolsS.exe and WSup.exe. If any or all of these exist, right-click on each one and select End Process Tree, and answer affirmatively to any confirmation questions.

    At this point, you can check the Add/Remove Programs Control Panel. If there is an uninstaller for Wintools, try running it now. I would still recommend proceeding through the rest of this fix even if there is an uninstaller, however.

    Now, please open a command prompt (Start button -> Run, type cmd and click "OK"). at the prompt, type
    regsvr32 /u /s "C:\Program Files\Toolbar\toolbar.dll" then <ENTER>.
    Then type exit to close the command prompt window.

    Now, we can proceed to delete these directories, located at:

    C:\Program Files\Common Files\WinTools <-- Delete the BOLD directory.
    C:\Program Files\Toolbar <-- Delete the BOLD directory.


    Reboot your computer back to normal mode and post a new hijackthis log.
  • Go6Go
    edited May 2005
    SOrry for the "double" post. I didnt think the first when had posted when I couldnt find it checking for answers.

    Sorry.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    No problem. Just trying to keep things as organized as I can around here. :)

    Just post a new hijackthis log once you have followed those instructions.
  • Go6Go
    edited May 2005
    Buckeye_Sam wrote:
    No problem. Just trying to keep things as organized as I can around here. :)

    Just post a new hijackthis log once you have followed those instructions.
    Logfile of HijackThis v1.99.1
    Scan saved at 4:18:47 PM, on 5/16/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\MusicMatch\MusicMatch
    Jukebox\mmtask.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH
    Jukebox\mm_tray.exe
    C:\Program Files\TrojanHunter 4.2\THGuard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\ps1.exe
    C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Spyware Doctor\swdoctor.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Common Files\Symantec
    Shared\ccEvtMgr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\system32\??plorer.exe
    C:\Documents and Settings\Debbie
    Armstrong\Desktop\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe

    O4 - HKLM\..\Run: [IgfxTray]
    C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds]
    C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [mmtask] c:\Program
    Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program
    Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [THGuard] "C:\Program
    Files\TrojanHunter 4.2\THGuard.exe"
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program
    Files\Kaspersky Lab\Kaspersky Anti-Virus
    Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [AVG7_CC]
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC]
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
    Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [PS1] C:\WINDOWS\System32\ps1.exe
    O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program
    Files\WeirdOnTheWeb\WeirdOnTheWeb.exe"
    O4 - HKLM\..\Run: [gcasServ] "C:\Program
    Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe
    -cnetwait.odl
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program
    Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [Ltho] C:\Documents and
    Settings\Debbie Armstrong\Application Data\dees.exe
    O4 - HKCU\..\Run: [Npd]
    C:\WINDOWS\system32\??plorer.exe
    O8 - Extra context menu item: &AIM Search -
    res://C:\Program Files\AIM
    Toolbar\AIMBar.dll/aimsearch.htm
    O9 - Extra button: AIM -
    {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
    Files\AIM\aim.exe
    O9 - Extra button: Messenger -
    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -
    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
    Files\Messenger\msmsgs.exe
    O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} -
    http://www.pacimedia.com/install/pcs_0026.exe
    O20 - Winlogon Notify: igfxcui -
    C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) -
    GRISOFT, s.r.o. -
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) -
    GRISOFT, s.r.o. -
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) -
    Symantec Corporation - C:\Program Files\Common
    Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program
    Files\Kaspersky Lab\Kaspersky Anti-Virus
    Personal\kavsvc.exe
    O23 - Service: ScriptBlocking Service (SBService) -
    Symantec Corporation -
    C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: WAN Miniport (ATW) Service
    (WANMiniportService) - America Online, Inc. -
    C:\WINDOWS\wanmpsvc.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Launch Notepad, and copy/paste the box below into a new text file. Save it as FindFile.bat and save it on your Desktop.
    dir C:\WINDOWS\system32\??plorer.exe /a h > files.txt
    notepad files.txt


    Locate FindFile.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text here along with a new hijackthis log.
Sign In or Register to comment.