Options

Many Issues, W?nlogon.exe etc. - Jessper

Unknown
edited November 2006 in Spyware & Virus Removal
Usually I'm fairly spyware free but recently something happened and I got a lot of issues all at once(this was before I got IE7.0, if that helps). I used Adaware and Spybot - SD to clean most of them, through a few other programs I think I've sloved most of my issues.

I am looking for a more solid idea of if stuff is still around though. I looked through my HijackThis log and I couldn't tell if everything was as it should be.

I tried my best to follow your posting formatting, hope this is up to snuff.

If you can help me I would really appreciate it. Thanks for taking the time to read my post either way though. =)


UPDATE: I have worked through at least a fair bit more of the problems with some random tools I googled, but as I stated above, I would like a better idea of my current spyware/virus status if possible.



Logfile of HijackThis v1.99.1
Scan saved at 9:57:24 PM, on 11/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\ZoneAlarm\zlclient.exe
D:\Steam\Steam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wallpaper Cycle\Change Wallpaper.exe
C:\Trillian\trillian.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Diskeeper\DkService.exe
C:\NetLimiter\nlsvc.exe
d:\oracle\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
C:\NetLimiter\NLClient.exe
D:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\Windows Live Mail desktop\wlmail.exe
C:\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Winamp\winampa.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Zone Labs Client] "C:\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] D:\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [Rduw] "C:\PROGRA~1\FNTS~1\explorer.exe" -vt yazb
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Change Wallpaper.lnk = C:\Program Files\Wallpaper Cycle\Change Wallpaper.exe
O4 - Startup: Trillian.lnk = C:\Trillian\trillian.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: hamachi.lnk = C:\Hamachi\hamachi.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.malummentis.com
O15 - Trusted Zone: http://www.*.malummentis.com
O15 - Trusted Zone: http://www.misfile.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1) -
O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\Admin\LOCALS~1\Temp\winfix.chm::/SystemDoctor2006FreeInstall.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live Mail desktop\mailcomm.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\NetLimiter\nlsvc.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - D:\Oracle\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
O23 - Service: OracleServiceXE - Oracle Corporation - d:\oracle\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
O23 - Service: OracleXEClrAgent - Unknown owner - D:\Oracle\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
O23 - Service: OracleXETNSListener - Unknown owner - D:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2006
    Can you please do the following.


    ===============

    Scan with HijackThis and then place a check next to all the following, if present:


    R3 - Default URLSearchHook is missing

    O4 - HKCU\..\Run: [Rduw] "C:\PROGRA~1\FNTS~1\explorer.exe" -vt yazb

    O11 - Options group: [INTERNATIONAL] International*

    O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\Admin\LOCALS~1\Temp\winf ix.chm::/SystemDoctor2006FreeInstall.cab


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

    folders...

    C:\PROGRA~1\FNTS~1

    -

    Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
    • Instead of Windows loading as normal, a menu should appear.
    Select the first option to run Windows in Safe Mode hit enter.

    -

    Reboot.

    ===============

    To help protect your system from hostile ActiveX content, or special 'downloadable' files:

    Download, install and keep updated, SpywareBlaster. If you've installed it for the first time:

    1) Check for any available updates; if present, they'll be automatically downloaded and installed.
    2) Next, "Enable all protection".
    3) Exit the program.

    -

    Note: Remember to regularly check for updates.

    ===============

    After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
  • Jessper
    edited November 2006
    Hi Crunchie, thanks for replying =)

    My new log is below. I havn't had many issues recently but that was even with what ever was on my computer that you saw in the log. So I most likely won't be able to notice if there are still problems, at least for a bit.

    Edit: Oh ya, R3 - Default URLSearchHook is missing , wasn't there to be removed when I checked but a few new "R3" items are. As you can see in the log.

    Anyways, the log:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:32:02 AM, on 11/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Winamp\winampa.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Messenger\msmsgs.exe
    D:\Steam\Steam.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Admin\My Documents\T?sks\r?gedit.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Diskeeper\DkService.exe
    C:\NetLimiter\nlsvc.exe
    C:\Program Files\Wallpaper Cycle\Change Wallpaper.exe
    C:\Trillian\trillian.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\NetLimiter\NLClient.exe
    D:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R3 - URLSearchHook: (no name) - {A0CB0F90-CC5B-988B-2D76-C8896D283298} - C:\WINDOWS\system32\oqtz.dll (file missing)
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - {FB9B5E9F-9E59-9B89-7E76-C8896D2833C2} - C:\WINDOWS\system32\ugi.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SDHelper.dll
    O2 - BHO: (no name) - {A0CB0F90-CC5B-988B-2D76-C8896D283298} - C:\WINDOWS\system32\oqtz.dll (file missing)
    O2 - BHO: (no name) - {FB9B5E9F-9E59-9B89-7E76-C8896D2833C2} - C:\WINDOWS\system32\ugi.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Winamp\winampa.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Steam] D:\Steam\Steam.exe -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Nvdofqjb] C:\Documents and Settings\Admin\My Documents\T?sks\r?gedit.exe
    O4 - Startup: Change Wallpaper.lnk = C:\Program Files\Wallpaper Cycle\Change Wallpaper.exe
    O4 - Startup: Trillian.lnk = C:\Trillian\trillian.exe
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: hamachi.lnk = C:\Hamachi\hamachi.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.malummentis.com
    O15 - Trusted Zone: http://www.*.malummentis.com
    O15 - Trusted Zone: http://www.misfile.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1) -
    O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live Mail desktop\mailcomm.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
    O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\NetLimiter\nlsvc.exe
    O23 - Service: OracleMTSRecoveryService - Oracle Corporation - D:\Oracle\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
    O23 - Service: OracleServiceXE - Oracle Corporation - d:\oracle\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
    O23 - Service: OracleXEClrAgent - Unknown owner - D:\Oracle\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
    O23 - Service: OracleXETNSListener - Unknown owner - D:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2006
    Can you please do the following.

    Please run the PurityScan uninstaller.

    ===============

    Scan with HijackThis and then place a check next to all the following, if present:


    R3 - URLSearchHook: (no name) - {A0CB0F90-CC5B-988B-2D76-C8896D283298} - C:\WINDOWS\system32\oqtz.dll (file missing)
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - {FB9B5E9F-9E59-9B89-7E76-C8896D2833C2} - C:\WINDOWS\system32\ugi.dll

    O2 - BHO: (no name) - {A0CB0F90-CC5B-988B-2D76-C8896D283298} - C:\WINDOWS\system32\oqtz.dll (file missing)
    O2 - BHO: (no name) - {FB9B5E9F-9E59-9B89-7E76-C8896D2833C2} - C:\WINDOWS\system32\ugi.dll

    O4 - HKCU\..\Run: [Nvdofqjb] C:\Documents and Settings\Admin\My Documents\T?sks\r?gedit.exe

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

    files...

    C:\WINDOWS\system32\ugi.dll

    -

    Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
    • Instead of Windows loading as normal, a menu should appear.
    Select the first option to run Windows in Safe Mode hit enter.

    -

    Reboot.

    ===============

    Run hijackthis and hit the Open the Misc Tools Section and then the Open Uninstall Manager.

    Then hit the Save List button. Save to the desktop for easy access. Open the log file and copy the entire list and paste it here please.

    ===========

    Copy the bold text below and paste it into notepad. Save it to your desktop as find.bat and make sure type is set to All Files.


    cd\
    cd Program Files
    DIR /AD /B /P > ProgramFiles.txt
    start ProgramFiles.txt
    cls
    exit


    Double click find.bat and let it run for a minute. It will open up a report in notepad. Please copy that text and post it here in your next reply.
  • Jessper
    edited November 2006
    Crunchie wrote:
    ===============

    Run hijackthis and hit the Open the Misc Tools Section and then the Open Uninstall Manager.

    Then hit the Save List button. Save to the desktop for easy access. Open the log file and copy the entire list and paste it here please.

    ===========

    Ad-Aware SE Personal
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Download Manager 2.0 (Remove Only)
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Reader 7.0.7
    Adobe Stock Photos 1.0
    Adobe® Photoshop® Album Starter Edition 3.0
    AGEIA PhysX v2.3.3
    Alcohol 120% (Trial Version)
    AquaMark3
    Armadillo Run Version 1.0.1
    ATI Display Driver (Omega 3.8.252)
    AVG Anti-Spyware 7.5
    AVG Free Edition
    BitComet 0.74
    BSPlayer
    Combined Community Codec Pack 2005-07-26 (Remove Only)
    Diskeeper Professional Edition
    DivX
    DivX Player
    FileZilla (remove only)
    Galactic Civilizations II
    Ghost Recon Advanced Warfighter
    GiPo@MoveOnBoot 1.9.5
    Hamachi 0.9.9.9
    Hijackthis 1.99.1
    HijackThis 1.99.1
    Hotfix for Windows XP (KB896344)
    Hotfix for Windows XP (KB915865)
    J2SE Development Kit 5.0 Update 6
    Java Web Start
    Kaspersky Online Scanner
    Macromedia Flash Player 8
    Master of Defense
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB886903)
    Microsoft .NET Framework 2.0
    Microsoft Device Emulator version 1.0 - ENU
    Microsoft Document Explorer 2005
    Microsoft Document Explorer 2005
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Visio Professional 2003
    Microsoft Office XP Professional with FrontPage
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
    Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
    Microsoft SQL Server 2005 Tools Express Edition
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Visual J# 2.0 Redistributable Package
    Microsoft Visual Studio 2005 Premier Partner Edition - ENU
    Microsoft Visual Studio 2005 Professional Edition - ENU
    Microsoft Visual Studio 2005 Team Explorer - ENU
    Microsoft Visual Studio 2005 Tools for Office Runtime
    Microsoft Visual Studio 2005 Tools for Office Runtime
    Mozilla Firefox (1.5.0.8)
    Mozilla Firefox (2.0)
    MSXML 6.0 Parser (KB927977)
    MultiRes (remove only)
    NetLimiter 2 Pro (remove only)
    Oracle Data Provider for .NET Help
    Oracle Database 10g Express Edition
    Radeon Omega Drivers v3.8.205 Setup Files and Tools
    Radeon Omega Drivers v3.8.252 Setup Files and Tools
    Realtek AC'97 Audio
    Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
    Security Update for Microsoft .NET Framework 2.0 (KB917283)
    Security Update for Microsoft .NET Framework 2.0 (KB922770)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893066)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899589)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB905915)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB908531)
    Security Update for Windows XP (KB911280)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911567)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912812)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917159)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB918899)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920214)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921883)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922760)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB925486)
    Spybot - Search & Destroy 1.4
    SpywareBlaster v3.5.1
    StarForge
    Steam
    TeamSpeak 2 RC2
    Trillian
    Update for Windows XP (KB894391)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB900930)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Ventrilo Client
    VideoLAN VLC media player 0.8.4a
    Wallpaper Cycle
    WC3Banlist
    Winamp (remove only)
    Windows Genuine Advantage v1.3.0254.0
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Live Mail desktop
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB885884
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB887797
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB891781
    WinPcap 3.1
    WinRAR archiver
    Xfire (remove only)
    XviD MPEG-4 Video Codec
    ZoneAlarm

    Double click find.bat and let it run for a minute. It will open up a report in notepad. Please copy that text and post it here in your next reply.

    Adobe
    AGEIA Technologies
    AquaMark3
    AvRack
    BitComet
    CE Remote Tools
    Common Files
    ComPlus Applications
    DAEMON Tools
    Diskeeper
    Diskeeper Setup
    DivX
    GiPo@Utilities
    Grisoft
    HTML Help Workshop
    InstallShield Installation Information
    Internet Explorer
    Java
    Java Web Start
    Messenger
    Microsoft ActiveSync
    Microsoft Device Emulator
    microsoft frontpage
    Microsoft Office
    Microsoft SQL Server
    Microsoft SQL Server 2005 Mobile Edition
    Microsoft Visual Studio .NET
    Microsoft Visual Studio 8
    Microsoft.NET
    MoveOnBoot
    Movie Maker
    Mozilla Firefox
    MSBuild
    MSN
    MSN Gaming Zone
    MultiRes
    NetMeeting
    Online Services
    Outlook Express
    QuickTime
    Radeon Omega Drivers
    Realtek Sound Manager
    s?curity
    s?mbols
    Uninstall Information
    Ventrilo
    Wallpaper Cycle
    Windows Live Mail desktop
    Windows Media Player
    Windows NT
    WindowsUpdate
    WinPcap
    WinRAR
    xerox
    Xfire


    NOTE:

    O4 - HKCU\..\Run: [Nvdofqjb] C:\Documents and Settings\Admin\My Documents\T?sks\r?gedit.exe

    Was not on the HijackThis log, however the file was in the location listed above, I removed the file with no "in use" errors or anything...

    Thanks again for the help.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2006
    Ok. Can I get you to delete the following folders;

    s?curity
    s?mbols

    Both can be found in your Program Files folder.
    Also delete this folder;

    C:\Documents and Settings\Admin\My Documents\T?sks

    Reboot when done and post another log from hijackthis please.
  • Jessper
    edited November 2006
    Crunchie wrote:
    Ok. Can I get you to delete the following folders;

    s?curity
    s?mbols

    Done.
    Also delete this folder;

    C:\Documents and Settings\Admin\My Documents\T?sks

    Reboot when done and post another log from hijackthis please.

    Logfile of HijackThis v1.99.1
    Scan saved at 2:00:59 PM, on 11/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Winamp\winampa.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    D:\Steam\Steam.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live Mail desktop\wlmail.exe
    C:\Program Files\Wallpaper Cycle\Change Wallpaper.exe
    C:\Trillian\trillian.exe
    C:\Program Files\Xfire\Xfire.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\Diskeeper\DkService.exe
    C:\NetLimiter\nlsvc.exe
    C:\NetLimiter\NLClient.exe
    D:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SDHelper.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinampAgent] C:\Winamp\winampa.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Steam] D:\Steam\Steam.exe -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: Change Wallpaper.lnk = C:\Program Files\Wallpaper Cycle\Change Wallpaper.exe
    O4 - Startup: Trillian.lnk = C:\Trillian\trillian.exe
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: hamachi.lnk = C:\Hamachi\hamachi.exe
    O4 - Global Startup: Windows Live Mail desktop.lnk = C:\Program Files\Windows Live Mail desktop\wlmail.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.malummentis.com
    O15 - Trusted Zone: http://www.*.malummentis.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1) -
    O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = students.cset.oit.edu
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live Mail desktop\mailcomm.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
    O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\NetLimiter\nlsvc.exe
    O23 - Service: OracleMTSRecoveryService - Oracle Corporation - D:\Oracle\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
    O23 - Service: OracleServiceXE - Oracle Corporation - d:\oracle\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
    O23 - Service: OracleXEClrAgent - Unknown owner - D:\Oracle\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
    O23 - Service: OracleXETNSListener - Unknown owner - D:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2006
    Looks good to me. How are things now?
  • Jessper
    edited November 2006
    Crunchie wrote:
    Looks good to me. How are things now?


    Everything seems back to normal, thanks a ton!
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2006
    You are welcome :).

    Now that your PC is clean you need to follow these easy steps to keeping it this way:

    Download CCleaner and install, then run it. It will clear out your temp folders.
    1. Uncheck "Cookies" under "Internet Explorer".
    2. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.
    3. Close when finished.

    Secure your Internet Explorer by going here and following the instructions there.

    Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.

    Use a firewall to help prevent your PC's control being usurped by undesireables. There is a link to a good, free firewall in my signature.

    Install and keep updated, Ewido anti-malware, Ad-Aware SE and Spybot S&D.
    Run them both on a regular basis, following the manufacturer's recommendations.

    Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.

    Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.


    Clear your Temp folders.
    Clear out your Temporary internet files and other temp files.
    Go to Start > Settings > Control Panel >Internet Options.
    Under the General tab click the Delete temporary internet files,
    delete all Offline content as well. Clear out Cookies.

    Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

    C:\Documents and Settings\username\Local Settings\Temp\

    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin.

    For XP users.
    After something like this it is a good idea to Flush the Restore Points and start fresh.
    To flush the XP system Restore Points.

    Go to Start>Run and type msconfig. Press enter.

    When msconfig opens, click the Launch System Restore Button.
    On the next page, click the System Restore Settings link on the left.

    Check the box labelled 'Turn off System restore'.

    Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.

    Note that all previous restore points will be lost.
Sign In or Register to comment.