help with trojans..

ZumaZuma Rio de Janeiro - Brazil
edited November 2005 in Spyware & Virus Removal
Hi.. I think i got trojans again.. help me plz

here the log

Logfile of HijackThis v1.99.1
Scan saved at 20:15:25, on 23/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\Arquivos de programas\D-Tools\daemon.exe
C:\Arquivos de programas\QuickTime\qttask.exe
C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\rundll32.exe
C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Messenger\msmsgs.exe
c:\arquiv~1\intern~1\iexplore.exe
C:\Arquivos de programas\Google\Google Talk\googletalk.exe
C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
C:\Arquivos de programas\Hamachi\hamachi.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\wisptis.exe
C:\Arquivos de programas\WinRAR\WinRAR.exe
C:\Documents and Settings\Administrador\Meus documentos\antivirus\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://tnolydlxdrktdtwbazjki.com/yEQP8DVFHYrqhWDkdWTCPzjBoAdwpIUajvsmMhDiMFS0F9qUcFbwpYJ1V0/9MbDa.cgi
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pjlunpswyma.com/yEQP8DVFHYrUAvkeI55aJKoJDZgtt5NBivJiBjT/PAA.html
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Arquivos de programas\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Arquivos de programas\NewDotNet\newdotnet6_98.dll
O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\ARQUIV~1\INSTAF~1\INSTAF~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\01.02.4000.1001\pt-br\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C2638289-7648-3DFC-BC30-A1012EBEA543} - C:\DOCUME~1\ADMINI~1\DADOSD~1\IDLESA~1\Army 64.exe
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Arquivos de programas\NavExcel Search Toolbar\NavExcelBar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Arquivos de programas\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Arquivos de programas\NavExcel Search Toolbar\NavExcelBar.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\01.02.4000.1001\pt-br\msntb.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NAV Agent] C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [WFXSwtch] C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARQUIV~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [dupe first bait camp] C:\Documents and Settings\All Users\Dados de aplicativos\show eq dupe first\Flaw Deaf.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\ARQUIV~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Steam] C:\Arquivos de programas\Steam\Steam.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Free Download Manager] C:\Arquivos de programas\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Peak knob] C:\DOCUME~1\ADMINI~1\DADOSD~1\UpPile01\Creative Plus.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Icatch(VI) SnapDetect.lnk = ?
O4 - Global Startup: hamachi.lnk = C:\Arquivos de programas\Hamachi\hamachi.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B15D4DBA-B393-4A25-9955-A3541602D326}: NameServer = 201.10.120.4 201.10.120.2
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Serviço de Auto-Protect do Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARQUIV~1\ARQUIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe

Comments

  • TroganTrogan London, UK
    edited November 2005
    Hi,

    Please move HJT to its own folder on your C: so backups can be created. Do this before continuing.
    ===


    Please follow the instructions here to remove NewDotNet
    ===


    Go to Add/Remove programs in Control Panel and look for the following

    MyWay
    NavExcel Search Toolbar

    If found, please uninstall.
    ===


    Check the following in HJT and click 'Fix Checked'

    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Arquivos de programas\MyWay\myBar\1.bin\MYBAR.DLL
    O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\ARQUIV~1\INSTAF~1\INSTAF~1.DLL
    O2 - BHO: (no name) - {C2638289-7648-3DFC-BC30-A1012EBEA543} - C:\DOCUME~1\ADMINI~1\DADOSD~1\IDLESA~1\Army 64.exe
    O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - C:\Arquivos de programas\NavExcel Search Toolbar\NavExcelBar.dll

    O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Arquivos de programas\MyWay\myBar\1.bin\MYBAR.DLL
    O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - C:\Arquivos de programas\NavExcel Search Toolbar\NavExcelBar.dll
    ===


    Find and Delete:

    C:\Arquivos de programas\NavExcel Search Toolbar << this folder
    C:\Arquivos de programas\MyWay << this folder
    ===


    Run full scans with Ad-Aware and SpyBot
    ===


    Reboot and post a new HJT log :)
  • ZumaZuma Rio de Janeiro - Brazil
    edited November 2005
    Hi

    Thank you for the help.. I did what you said, but I still got that casino thing when i use my iexplorer

    This is the new log:

    Logfile of HijackThis v1.99.1
    Scan saved at 02:10:37, on 25/11/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
    C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\Arquivos de programas\D-Tools\daemon.exe
    C:\Arquivos de programas\QuickTime\qttask.exe
    C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe
    C:\Arquivos de programas\Internet Explorer\iexplore.exe
    C:\Arquivos de programas\Messenger\msmsgs.exe
    c:\arquiv~1\intern~1\iexplore.exe
    C:\Arquivos de programas\Google\Google Talk\googletalk.exe
    C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
    C:\Arquivos de programas\Hamachi\hamachi.exe
    C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
    C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\sessmgr.exe
    C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
    C:\WINDOWS\system32\RDSHOST.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
    C:\HjT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.rwhgwtevxkhmt.net/yEQP8DVFHYrqhWDkdWTCPzjBoAdwpIUajvsmMhDiMFS0Qv2Eks_qXoJ1V0/9MbDa.cgi
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NAV Agent] C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [WFXSwtch] C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARQUIV~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [dupe first bait camp] C:\Documents and Settings\All Users\Dados de aplicativos\show eq dupe first\Flaw Deaf.exe
    O4 - HKCU\..\Run: [Steam] C:\Arquivos de programas\Steam\Steam.exe
    O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Free Download Manager] C:\Arquivos de programas\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [Peak knob] C:\DOCUME~1\ADMINI~1\DADOSD~1\UpPile01\Creative Plus.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Icatch(VI) SnapDetect.lnk = ?
    O4 - Global Startup: hamachi.lnk = C:\Arquivos de programas\Hamachi\hamachi.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
    O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B15D4DBA-B393-4A25-9955-A3541602D326}: NameServer = 201.10.120.4 200.96.255.198
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Serviço de Auto-Protect do Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARQUIV~1\ARQUIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
  • TroganTrogan London, UK
    edited November 2005
    I'm going to need your help now.

    Do you know what these are?

    C:\Arquivos de programas\Hamachi\hamachi.exe
    C:\WINDOWS\system32\RDSHOST.exe
    C:\Documents and Settings\All Users\Dados de aplicativos\show eq dupe first\Flaw Deaf.exe
    C:\DOCUME~1\ADMINI~1\DADOSD~1\UpPile01\Creative Plus.exe
    ===


    Download CWShredder 2.19 from here. Check for updates first and then Run it and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.
    ===


    Check the following in HJT and click 'Fix Checked'

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.rwhgwtevxkhmt.net/yEQP8D...oJ1V0/9MbDa.cgi

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)
    ===


    Download Ewido Security Suite
    1. Install ewido security suite
    2. When installing the program, under "Additonal Options" uncheck..
      • Install background guard
      • Install scan via context menu
    3. Launch ewido, there should now be an icon on your desktop, double-click it.
    4. The program will now open to the main screen.
    5. When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
    6. You will need to update ewido to the latest definition files:
      • On the left hand side of the main screen click update.
      • Then click on Start Update.
    7. The update will start and a progress bar will show the updates being installed.
      (the status bar at the bottom will display "Update successful")

    If you are having problems with the updater, you can use this link to manually update ewido.
    Ewido Manual Updates

    Once the updates are installed, do the following:
    1. Click on scanner.
    2. Click on Complete System Scan, the scan will now begin.
    3. While the scan is in progress you will be promted to clean files, click OK.
    4. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.
    5. Once the scan has completed, there will be a button located at the bottom of the screen named Save Report.
    6. Click Save Report.
    7. Now save the report .txt file to your desktop.

    Now close ewido security suite.
    ===


    Reboot and post a new HJT log :)
  • ZumaZuma Rio de Janeiro - Brazil
    edited November 2005
    Hi.. Many thanks again bro ;)

    This is my girlfriend's pc.. I'm trying to help her by remote assistence since it'd take a whole week for her to follow those steps :D

    Anyway lemme see..


    hamachi.exe is a program that creates a virtual network (LAN) between computers with a normal internet conn.. It's safe I have it here

    RDSHOST.exe is apparently a normal windows process.. I found it here at This LINK

    Flaw Deaf.exe I have no idea..

    Creative Plus.exe must be something with creative sound drivers..?


    I'll do everything you said when i get home from the work...

    Million thanks again for your help :thumbsup:
  • TroganTrogan London, UK
    edited November 2005
    Cool...

    I thought I better ask because those were in your language and I didnt want to remove anything you needed. :)


    Post a new HJT log when your done :D
  • ZumaZuma Rio de Janeiro - Brazil
    edited November 2005
    Hi.. I finally did all that you said :)

    This is my new log:

    Logfile of HijackThis v1.99.1
    Scan saved at 02:15:02, on 26/11/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
    C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\Arquivos de programas\D-Tools\daemon.exe
    C:\Arquivos de programas\QuickTime\qttask.exe
    C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe
    C:\Arquivos de programas\Messenger\msmsgs.exe
    C:\Arquivos de programas\Google\Google Talk\googletalk.exe
    C:\Arquivos de programas\Hamachi\hamachi.exe
    C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
    C:\Arquivos de programas\ewido\security suite\ewidoctrl.exe
    C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\sessmgr.exe
    C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
    C:\WINDOWS\system32\RDSHOST.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
    C:\HjT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cmgkvkyydmhunvmhlhbaoza.com/yEQP8DVFHYrqhWDkdWTCPzjBoAdwpIUajvsmMhDiMFRzr0PZwJZEXoJ1V0/9MbDa.jsp
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NAV Agent] C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [WFXSwtch] C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARQUIV~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKCU\..\Run: [Steam] C:\Arquivos de programas\Steam\Steam.exe
    O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Free Download Manager] C:\Arquivos de programas\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: hamachi.lnk = C:\Arquivos de programas\Hamachi\hamachi.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B15D4DBA-B393-4A25-9955-A3541602D326}: NameServer = 201.10.120.4 200.96.255.198
    O23 - Service: ewido security suite control - ewido networks - C:\Arquivos de programas\ewido\security suite\ewidoctrl.exe
    O23 - Service: Serviço de Auto-Protect do Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARQUIV~1\ARQUIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
  • TroganTrogan London, UK
    edited November 2005
    Please go here and download OmegaKillerSM v1.2.

    Open the program and check the two boxes on the left. Then click GO
    ===


    Scan with these:

    BitDefender Free Online Virus Scan
    http://www.bitdefender.com/scan/licence.php
    Make sure you tick AutoClean under Scan Options.

    Panda ActiveScan
    http://www.pandasoftware.com/activescan/com/activescan_principal.htm
    Make sure you tick Disinfect automatically under Scan Options.
    ===


    Post a new HJT log :)
  • ZumaZuma Rio de Janeiro - Brazil
    edited November 2005
    Hi.. did all that you said

    here the new log:

    Logfile of HijackThis v1.99.1
    Scan saved at 13:42:02, on 26/11/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
    C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
    C:\WINDOWS\system32\wfxsnt40.exe
    C:\Arquivos de programas\D-Tools\daemon.exe
    C:\Arquivos de programas\QuickTime\qttask.exe
    C:\Arquivos de programas\Messenger\msmsgs.exe
    C:\Arquivos de programas\Google\Google Talk\googletalk.exe
    C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
    C:\Arquivos de programas\Hamachi\hamachi.exe
    C:\Arquivos de programas\ewido\security suite\ewidoctrl.exe
    C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\HjT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cmgkvkyydmhunvmhlhbaoza.com/yEQP8DVFHYrqhWDkdWTCPzjBoAdwpIUajvsmMhDiMFRzr0PZwJZEXoJ1V0/9MbDa.jsp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O1 - Hosts: 127.0.0.67 search.active-max.com
    O1 - Hosts: 127.0.0.98 allaboutsearching.com
    O1 - Hosts: 127.0.0.24 www.allaboutsearching.com
    O1 - Hosts: 127.0.0.7 amazingautossearch.com
    O1 - Hosts: 127.0.0.20 www.amazingautossearch.com
    O1 - Hosts: 127.0.0.34 www.contexualsearch.com
    O1 - Hosts: 127.0.0.43 www.crap2.com
    O1 - Hosts: 127.0.0.0 www.dialup2.com
    O1 - Hosts: 127.0.0.22 ecpm.com
    O1 - Hosts: 127.0.0.241 find-quick.com
    O1 - Hosts: 127.0.0.79 lop.com
    O1 - Hosts: 127.0.0.2 ayb.lop.com
    O1 - Hosts: 127.0.0.82 img.lop.com
    O1 - Hosts: 127.0.0.94 srch.lop.com
    O1 - Hosts: 127.0.0.3 www1.lop.com
    O1 - Hosts: 127.0.0.33 www.lop.com
    O1 - Hosts: 127.0.0.80 maxexp.com
    O1 - Hosts: 127.0.0.221 www.mp3search.com
    O1 - Hosts: 127.0.0.250 netsearchsoft.com
    O1 - Hosts: 127.0.0.219 www.omegasearch.com
    O1 - Hosts: 127.0.0.227 prosearching.com
    O1 - Hosts: 127.0.0.217 www.rub.to
    O1 - Hosts: 127.0.0.95 sbvr.com
    O1 - Hosts: 127.0.0.67 www.sbvr.com
    O1 - Hosts: 127.0.0.223 searchexe.com
    O1 - Hosts: 127.0.0.213 www.searchexe.com
    O1 - Hosts: 127.0.0.205 www.searchweb2.com
    O1 - Hosts: 127.0.0.91 www.spawnet.com
    O1 - Hosts: 127.0.0.46 tdmy.com
    O1 - Hosts: 127.0.0.72 tefs.com
    O1 - Hosts: 127.0.0.54 tfil.com
    O1 - Hosts: 127.0.0.74 www.tfil.com
    O1 - Hosts: 127.0.0.76 tdko.com
    O1 - Hosts: 127.0.0.212 wrn.net
    O1 - Hosts: 127.0.0.79 www.wrn.net
    O1 - Hosts: 127.0.0.220 www.mp3search.com
    O1 - Hosts: 127.0.0.9 best.omega-search.com
    O1 - Hosts: 127.0.0.217 www.omega-search.com
    O1 - Hosts: 127.0.0.44 trinityacquisitions.com
    O1 - Hosts: 127.0.0.247 www.wethere.com
    O1 - Hosts: 127.0.0.61 asearchforyou.org
    O1 - Hosts: 127.0.0.63 www.asearchforyou.org
    O1 - Hosts: 127.0.0.224 www.errorfreesearch.com
    O1 - Hosts: 127.0.0.43 isearchhere.com
    O1 - Hosts: 127.0.0.240 www.isearchhere.com
    O1 - Hosts: 127.0.0.25 iwantosearch.com
    O1 - Hosts: 127.0.0.54 searchhotsex.com
    O1 - Hosts: 127.0.0.229 www.searchhotsex.com
    O1 - Hosts: 127.0.0.70 mastersearcher.com
    O1 - Hosts: 127.0.0.247 www.mastersearcher.com
    O1 - Hosts: 127.0.0.215 www.look-today.com
    O1 - Hosts: 127.0.0.220 www.aavc.com
    O1 - Hosts: 127.0.0.220 www.acjp.com
    O1 - Hosts: 127.0.0.98 ecmh.com
    O1 - Hosts: 127.0.0.40 www.wabu.com
    O1 - Hosts: 127.0.0.44 wabq.com
    O1 - Hosts: 127.0.0.27 www.maximumexperience.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NAV Agent] C:\ARQUIV~1\NORTON~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [WFXSwtch] C:\ARQUIV~1\NORTON~1\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Arquivos de programas\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARQUIV~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [Steam] C:\Arquivos de programas\Steam\Steam.exe
    O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Free Download Manager] C:\Arquivos de programas\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Arquivos de programas\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: hamachi.lnk = C:\Arquivos de programas\Hamachi\hamachi.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B15D4DBA-B393-4A25-9955-A3541602D326}: NameServer = 200.96.255.198 201.10.120.4
    O20 - AppInit_DLLs: MsgPlusLoader.dll
    O23 - Service: ewido security suite control - ewido networks - C:\Arquivos de programas\ewido\security suite\ewidoctrl.exe
    O23 - Service: Serviço de Auto-Protect do Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Arquivos de programas\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARQUIV~1\ARQUIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\ARQUIV~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\Security Center\SymWSC.exe
  • TroganTrogan London, UK
    edited November 2005
    Check for Updates with EWIDO but don't do a scan yet...
    ===


    Go into Safe Mode - explained here
    ===


    Check the following in HJT and click 'Fix Checked'

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cmgkvkyydmhunvmhlhbaoza.com/...oJ1V0/9MbDa.jsp

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    O1 - Hosts: 127.0.0.67 search.active-max.com
    O1 - Hosts: 127.0.0.98 allaboutsearching.com
    O1 - Hosts: 127.0.0.24 www.allaboutsearching.com
    O1 - Hosts: 127.0.0.7 amazingautossearch.com
    O1 - Hosts: 127.0.0.20 www.amazingautossearch.com
    O1 - Hosts: 127.0.0.34 www.contexualsearch.com
    O1 - Hosts: 127.0.0.43 www.crap2.com
    O1 - Hosts: 127.0.0.0 www.dialup2.com
    O1 - Hosts: 127.0.0.22 ecpm.com
    O1 - Hosts: 127.0.0.241 find-quick.com
    O1 - Hosts: 127.0.0.79 lop.com
    O1 - Hosts: 127.0.0.2 ayb.lop.com
    O1 - Hosts: 127.0.0.82 img.lop.com
    O1 - Hosts: 127.0.0.94 srch.lop.com
    O1 - Hosts: 127.0.0.3 www1.lop.com
    O1 - Hosts: 127.0.0.33 www.lop.com
    O1 - Hosts: 127.0.0.80 maxexp.com
    O1 - Hosts: 127.0.0.221 www.mp3search.com
    O1 - Hosts: 127.0.0.250 netsearchsoft.com
    O1 - Hosts: 127.0.0.219 www.omegasearch.com
    O1 - Hosts: 127.0.0.227 prosearching.com
    O1 - Hosts: 127.0.0.217 www.rub.to
    O1 - Hosts: 127.0.0.95 sbvr.com
    O1 - Hosts: 127.0.0.67 www.sbvr.com
    O1 - Hosts: 127.0.0.223 searchexe.com
    O1 - Hosts: 127.0.0.213 www.searchexe.com
    O1 - Hosts: 127.0.0.205 www.searchweb2.com
    O1 - Hosts: 127.0.0.91 www.spawnet.com
    O1 - Hosts: 127.0.0.46 tdmy.com
    O1 - Hosts: 127.0.0.72 tefs.com
    O1 - Hosts: 127.0.0.54 tfil.com
    O1 - Hosts: 127.0.0.74 www.tfil.com
    O1 - Hosts: 127.0.0.76 tdko.com
    O1 - Hosts: 127.0.0.212 wrn.net
    O1 - Hosts: 127.0.0.79 www.wrn.net
    O1 - Hosts: 127.0.0.220 www.mp3search.com
    O1 - Hosts: 127.0.0.9 best.omega-search.com
    O1 - Hosts: 127.0.0.217 www.omega-search.com
    O1 - Hosts: 127.0.0.44 trinityacquisitions.com
    O1 - Hosts: 127.0.0.247 www.wethere.com
    O1 - Hosts: 127.0.0.61 asearchforyou.org
    O1 - Hosts: 127.0.0.63 www.asearchforyou.org
    O1 - Hosts: 127.0.0.224 www.errorfreesearch.com
    O1 - Hosts: 127.0.0.43 isearchhere.com
    O1 - Hosts: 127.0.0.240 www.isearchhere.com
    O1 - Hosts: 127.0.0.25 iwantosearch.com
    O1 - Hosts: 127.0.0.54 searchhotsex.com
    O1 - Hosts: 127.0.0.229 www.searchhotsex.com
    O1 - Hosts: 127.0.0.70 mastersearcher.com
    O1 - Hosts: 127.0.0.247 www.mastersearcher.com
    O1 - Hosts: 127.0.0.215 www.look-today.com
    O1 - Hosts: 127.0.0.220 www.aavc.com
    O1 - Hosts: 127.0.0.220 www.acjp.com
    O1 - Hosts: 127.0.0.98 ecmh.com
    O1 - Hosts: 127.0.0.40 www.wabu.com
    O1 - Hosts: 127.0.0.44 wabq.com
    O1 - Hosts: 127.0.0.27 www.maximumexperience.com

    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    ===


    Now do a Full System Scan with EWIDO



    Reboot in Normal Mode and post a new HJT log :)
Sign In or Register to comment.