Options

Problem + Hijackthis log

Unknown
edited May 2007 in Spyware & Virus Removal
Hello, lately I have been getting a lot of pop ups. Through adaware, spybot, and spyblaster many of these have stopped. But pop ups automatically start coming up on my screen randomly. Most of these are on internet explorer even though I use firefox as my default browser. Sometimes an IE pop up comes on and begins to automatically create new tabs in IE therefore increasing the ram usage and stalling my computer. All help would be greatly appreciated, I have included my hijackthis log file.

Logfile of HijackThis v1.99.1
Scan saved at 9:07:28 PM, on 4/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.129.10:3128
O1 - Hosts: 127.0.0.2 www.runescape.com
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [fbdirect] C:\Program Files\ScanSoft\PaperPort\fbdirect.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rxfgjfvu.dll",setvm
O4 - HKCU\..\Run: [Steam] "c:\steam1\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Comments

  • peku006
    edited April 2007
    Hi jusama14 and welcome to Short-Media. I'm checking your log, so please be patient.
  • peku006
    edited April 2007
    :smiles: Hi jusama14

    Lets start with this:
    Rename HijackThis.exe to scanner.exe

    Please download
    VundoFix.exe to your desktop.
    * Double-click VundoFix.exe to run it.
    * Click the Scan for Vundo button.
    * Once it's done scanning, click the Remove Vundo button.
    * You will receive a prompt asking if you want to remove the files, click YES
    * Once you click yes, your desktop will go blank as it starts removing Vundo.
    * When completed, it will prompt that it will reboot your computer, click OK.
    * Please post the contents of C:\vundofix.txt and a new HiJackThis log.:wink:

    Important note -- It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
  • jusama14
    edited April 2007
    Hello, thank you for your reply now when i start up windows I get an error saying "cannot open c:/windows/system32/rxfgjfvu.dll
    here is the vundofix log along with the new hijack this log:


    VundoFix V6.3.20

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 3:06:47 PM 4/25/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\dbjuqaef.dll
    C:\WINDOWS\system32\ddcbyxx.dll
    C:\WINDOWS\system32\feipfsqe.dll
    C:\WINDOWS\system32\jewufysu.dll
    C:\WINDOWS\system32\prqss.bak1
    C:\WINDOWS\system32\prqss.bak2
    C:\WINDOWS\system32\prqss.ini
    C:\WINDOWS\system32\prqss.ini2
    C:\WINDOWS\system32\prqss.tmp
    C:\WINDOWS\system32\rwfiyffg.dll
    C:\WINDOWS\system32\rxfgjfvu.dll
    C:\WINDOWS\system32\sjmjybnp.dll
    C:\WINDOWS\system32\ssqrp.dll
    C:\WINDOWS\system32\tjlrfrqn.dll
    C:\WINDOWS\system32\uvfjgfxr.ini
    C:\WINDOWS\system32\xqcsmymp.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\dbjuqaef.dll
    C:\WINDOWS\system32\dbjuqaef.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ddcbyxx.dll
    C:\WINDOWS\system32\ddcbyxx.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\feipfsqe.dll
    C:\WINDOWS\system32\feipfsqe.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jewufysu.dll
    C:\WINDOWS\system32\jewufysu.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\prqss.bak1
    C:\WINDOWS\system32\prqss.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\prqss.bak2
    C:\WINDOWS\system32\prqss.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\prqss.ini
    C:\WINDOWS\system32\prqss.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\prqss.ini2
    C:\WINDOWS\system32\prqss.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\prqss.tmp
    C:\WINDOWS\system32\prqss.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rwfiyffg.dll
    C:\WINDOWS\system32\rwfiyffg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rxfgjfvu.dll
    C:\WINDOWS\system32\rxfgjfvu.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\sjmjybnp.dll
    C:\WINDOWS\system32\sjmjybnp.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ssqrp.dll
    C:\WINDOWS\system32\ssqrp.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\tjlrfrqn.dll
    C:\WINDOWS\system32\tjlrfrqn.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\uvfjgfxr.ini
    C:\WINDOWS\system32\uvfjgfxr.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xqcsmymp.dll
    C:\WINDOWS\system32\xqcsmymp.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\ddcbyxx.dll
    C:\WINDOWS\system32\ddcbyxx.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ssqrp.dll
    C:\WINDOWS\system32\ssqrp.dll Has been deleted!

    Performing Repairs to the registry.
    Done!


    Logfile of HijackThis v1.99.1
    Scan saved at 3:21:23 PM, on 4/25/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\HijackThis\scanner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.129.10:3128
    O1 - Hosts: 127.0.0.2 www.runescape.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\yjrxilpf.dll (file missing)
    O2 - BHO: (no name) - {26EC3110-F1D7-497A-A27F-05700F853D89} - C:\WINDOWS\system32\xywbshxa.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
    O2 - BHO: (no name) - {DAA8B54E-42F8-496A-9553-083BE14B907D} - C:\WINDOWS\system32\ssqrp.dll (file missing)
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [fbdirect] C:\Program Files\ScanSoft\PaperPort\fbdirect.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rxfgjfvu.dll",setvm
    O4 - HKCU\..\Run: [Steam] "c:\steam1\steam.exe" -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  • peku006
    edited April 2007
    :)Hi jusama14

    Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)
    O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\yjrxilpf.dll (file missing)
    O2 - BHO: (no name) - {26EC3110-F1D7-497A-A27F-05700F853D89} - C:\WINDOWS\system32\xywbshxa.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
    O2 - BHO: (no name) - {DAA8B54E-42F8-496A-9553-083BE14B907D} - C:\WINDOWS\system32\ssqrp.dll (file missing)
    O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rxfgjfvu.dll",setvm
    Close ALL open windows
    Click Fix Checked
    Close HijackThis

    Press Scan for Vundo next, continue to instruction from this point:
    Once the scan is complete, Right Click inside the listbox (white box) and click add more files
    Copy&Paste the 2 entries below into the top 2 boxes

    C:\WINDOWS\system32\xywbshxa.dll
    C:\WINDOWS\system32\axhsbwyx.*

    Click Add Files and Click Close Window
    Click the Remove Vundo button.
    You will receive a prompt asking if you want to remove the files, click YES
    Once you click yes, your desktop will go blank as it starts removing Vundo.
    When completed, it will prompt that it will shutdown your computer, click OK.
    Turn your computer back on.

    Please post the contents of C:\vundofix.txt and a new HijackThis log.;)
  • jusama14
    edited April 2007
    Hello thank you for all your help. 2 days ago I received helped from another person he told me to uninstall java, download the new one and use a program known as "Combofix" I did all this and my computer seems to run perfect. I have included the new hijackthis log after I did all of that just to make sure it's all clean. Again thank you.

    Logfile of HijackThis v1.99.1
    Scan saved at 3:48:09 PM, on 4/25/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\WINDOWS\eHome\ehmsas.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\HijackThis\scanner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.129.10:3128
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\yjrxilpf.dll (file missing)
    O2 - BHO: (no name) - {26EC3110-F1D7-497A-A27F-05700F853D89} - C:\WINDOWS\system32\xywbshxa.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
    O2 - BHO: (no name) - {DAA8B54E-42F8-496A-9553-083BE14B907D} - C:\WINDOWS\system32\ssqrp.dll (file missing)
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [fbdirect] C:\Program Files\ScanSoft\PaperPort\fbdirect.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKCU\..\Run: [Steam] "c:\steam1\steam.exe" -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  • peku006
    edited April 2007
    :smiles: Hi jusama14

    Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)
    O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\yjrxilpf.dll (file missing)
    O2 - BHO: (no name) - {26EC3110-F1D7-497A-A27F-05700F853D89} - C:\WINDOWS\system32\xywbshxa.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {DAA8B54E-42F8-496A-9553-083BE14B907D} - C:\WINDOWS\system32\ssqrp.dll (file missing)

    Close ALL open windows
    Click Fix Checked
    Close HijackThis

    Double click combofix.exe and follow the prompts.
    * When finished, it shall produce a log for you.

    In your next reply please post the following logs: vundofix.txt, Combofix.txt and a new HijackThis log.:wink:
  • jusama14
    edited April 2007
    Thank you for all your help.


    VundoFix V6.3.20

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 4:25:16 PM 4/27/2007

    Listing files found while scanning....

    No infected files were found.


    "Usama J" - 07-04-27 16:30:56 Service Pack 2
    ComboFix 07-04-25.4V - Running from: "C:\Downloads\Programs\cleaners\"


    ((((((((((((((((((((((((((((((( Files Created from 2007-03-27 to 2007-04-27 ))))))))))))))))))))))))))))))))))


    2007-04-27 16:25 <DIR> d
    C:\VundoFix Backups
    2007-04-25 15:46 49,152 --a
    C:\WINDOWS\nircmd.exe
    2007-04-24 19:37 <DIR> d
    C:\Program Files\Windows Live Safety Center
    2007-04-23 19:41 <DIR> d
    C:\Program Files\SpywareBlaster
    2007-04-19 17:40 68,888 --a
    C:\WINDOWS\system32\xinput1_3.dll
    2007-04-19 17:40 62,744 --a
    C:\WINDOWS\system32\xinput1_2.dll
    2007-04-19 17:40 3,426,072 --a
    C:\WINDOWS\system32\d3dx9_32.dll
    2007-04-19 17:40 251,672 --a
    C:\WINDOWS\system32\xactengine2_5.dll
    2007-04-19 17:40 237,848 --a
    C:\WINDOWS\system32\xactengine2_4.dll
    2007-04-19 17:40 236,824 --a
    C:\WINDOWS\system32\xactengine2_3.dll
    2007-04-19 17:40 2,414,360 --a
    C:\WINDOWS\system32\d3dx9_31.dll
    2007-04-19 17:40 2,297,552 --a
    C:\WINDOWS\system32\d3dx9_26.dll
    2007-04-19 17:40 15,128 --a
    C:\WINDOWS\system32\x3daudio1_1.dll
    2007-04-19 17:22 <DIR> d
    C:\Program Files\THQ
    2007-04-18 18:24 <DIR> d
    C:\Program Files\FitSoft
    2007-04-18 18:18 <DIR> d
    C:\DOCUME~1\USAMAJ~1\.housecall6.6
    2007-04-18 18:14 <DIR> d
    C:\WINDOWS\system32\ActiveScan
    2007-04-18 16:56 <DIR> d
    C:\WINDOWS\pss
    2007-04-18 15:50 94,552 --a
    C:\WINDOWS\system32\drivers\aswmon2.sys
    2007-04-18 15:50 90,112 --a
    C:\WINDOWS\system32\AVASTSS.scr
    2007-04-18 15:50 85,952 --a
    C:\WINDOWS\system32\drivers\aswmon.sys
    2007-04-18 15:50 733,824 --a
    C:\WINDOWS\system32\aswBoot.exe
    2007-04-18 15:50 43,176 --a
    C:\WINDOWS\system32\drivers\aswTdi.sys
    2007-04-18 15:50 26,888 --a
    C:\WINDOWS\system32\drivers\aavmker4.sys
    2007-04-18 15:50 23,416 --a
    C:\WINDOWS\system32\drivers\aswRdr.sys
    2007-04-18 15:50 <DIR> d
    C:\Program Files\Alwil Software
    2007-04-18 15:33 <DIR> d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\ErrorProtector Free
    2007-04-18 15:23 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\ErrorProtector Free
    2007-04-17 17:19 <DIR> d
    C:\Program Files\GCFScape
    2007-04-17 17:12 <DIR> d
    C:\srcds
    2007-04-17 16:37 <DIR> d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\FlashFXP
    2007-04-16 23:17 1,556,496 --a
    C:\WINDOWS\screengenie.scr
    2007-04-16 23:17 <DIR> d
    C:\Program Files\CinemaForge
    2007-04-16 20:10 124,142 --a
    C:\WINDOWS\b136.exe
    2007-04-12 21:39 <DIR> d
    C:\Program Files\The iPod Application Installer II
    2007-04-12 21:39 <DIR> d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\InstallShield
    2007-04-11 19:11 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\4D
    2007-04-11 16:17 <DIR> d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\Viewpoint
    2007-04-09 19:13 <DIR> d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\CodecX
    2007-04-09 19:12 <DIR> d
    C:\Program Files\CodecX
    2007-04-09 18:13 36,480 --a
    C:\WINDOWS\system32\drivers\verysplit.sys
    2007-04-09 18:13 16,896 --a
    C:\WINDOWS\system32\drivers\vsaudio.sys
    2007-04-09 18:13 <DIR> d
    C:\Program Files\WebCamSplitter
    2007-04-08 19:49 <DIR> d
    C:\download
    2007-04-07 23:53 <DIR> d
    C:\UnrealTournament
    2007-04-04 22:44 190,976
    C:\WINDOWS\eiunin2.exe
    2007-04-04 22:39 <DIR> d-a
    C:\Program Files\?????
    2007-04-03 21:23 <DIR> d
    C:\Program Files\XBCD
    2007-04-03 17:15 <DIR> d
    C:\Program Files\cs1.6
    2007-03-29 17:40 <DIR> d
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
    2007-03-29 17:39 <DIR> d
    C:\Program Files\Symantec
    2007-03-29 17:39 <DIR> d
    C:\Program Files\Common Files\Symantec Shared
    2007-03-28 17:52 304,128 --a
    C:\WINDOWS\IsUn0411.exe
    2007-03-28 16:50 98,304 --a
    C:\WINDOWS\system32\msir3jp.dll
    2007-03-28 16:50 838,144 --a
    C:\WINDOWS\system32\chtbrkr.dll
    2007-03-28 16:50 70,656 --a
    C:\WINDOWS\system32\korwbrkr.dll
    2007-03-28 16:50 6,144 --a
    C:\WINDOWS\system32\kbd101a.dll
    2007-03-28 16:50 218,112 --a
    C:\WINDOWS\system32\c_g18030.dll
    2007-03-28 16:50 1,677,824 --a
    C:\WINDOWS\system32\chsbrkr.dll
    2007-03-28 16:49 9,216 --a
    C:\WINDOWS\system32\kbdnecAT.dll
    2007-03-28 16:49 7,680 --a
    C:\WINDOWS\system32\kbdnecNT.dll
    2007-03-28 16:49 7,168 --a
    C:\WINDOWS\system32\kbdnec95.dll
    2007-03-28 16:49 7,168 --a
    C:\WINDOWS\system32\kbdibm02.dll
    2007-03-28 16:49 7,168 --a
    C:\WINDOWS\system32\f3ahvoas.dll
    2007-03-28 16:49 6,656 --a
    C:\WINDOWS\system32\kbdlk41a.dll
    2007-03-28 16:49 6,656 --a
    C:\WINDOWS\system32\c_is2022.dll
    2007-03-28 16:49 6,144 --a
    C:\WINDOWS\system32\kbdlk41j.dll
    2007-03-28 16:49 6,144 --a
    C:\WINDOWS\system32\kbdax2.dll
    2007-03-28 16:49 6,144 --a
    C:\WINDOWS\system32\kbd106n.dll
    2007-03-28 16:49 6,144 --a
    C:\WINDOWS\system32\kbd101.dll


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2007-04-27 16:15
    d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\sopcast
    2007-04-27 16:13
    d
    C:\Program Files\sopcast
    2007-04-26 20:42
    d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\utorrent
    2007-04-25 15:41
    d-a
    C:\Program Files\?????
    2007-04-24 21:10
    d
    C:\Program Files\mirc
    2007-04-24 19:38
    d
    C:\Program Files\nsvtools
    2007-04-22 21:02
    d
    C:\Program Files\gamespy arcade
    2007-04-18 16:40
    d
    C:\Program Files\rgb
    2007-04-13 18:00
    d--h
    C:\Program Files\installshield installation information
    2007-04-13 16:04
    d
    C:\Program Files\microsoft games
    2007-04-07 22:37
    d
    C:\Program Files\xbc
    2007-03-31 00:22
    d
    C:\Program Files\ephpod
    2007-03-26 16:32
    d
    C:\Program Files\virtual earth 3d
    2007-03-23 21:21
    d
    C:\Program Files\videolan
    2007-03-22 20:16
    d
    C:\Program Files\intel desktop boards
    2007-03-20 19:05 163644 --a
    C:\WINDOWS\system32\drivers\secdrv.sys
    2007-03-20 18:53
    d
    C:\Program Files\maxis
    2007-03-17 08:43 292864 --a
    C:\WINDOWS\system32\winsrv.dll
    2007-03-16 22:01
    d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\real
    2007-03-14 16:07
    d
    C:\Program Files\smart projects
    2007-03-13 00:26 1849036 --a
    C:\Program Files\nsvtools.rar
    2007-03-10 22:36
    d
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\dvdcss
    2007-03-10 22:35 3584 --a
    C:\DOCUME~1\USAMAJ~1\APPLIC~1\dvd.bmk
    2007-03-08 15:23 98240 --ah
    C:\WINDOWS\system32\mlfcache.dat
    2007-03-08 10:36 577536 --a
    C:\WINDOWS\system32\user32.dll
    2007-03-08 10:36 40960 --a
    C:\WINDOWS\system32\mf3216.dll
    2007-03-08 10:36 281600 --a
    C:\WINDOWS\system32\gdi32.dll
    2007-03-08 08:47 1843584 --a
    C:\WINDOWS\system32\win32k.sys
    2007-03-03 16:06
    d
    C:\Program Files\msn messenger
    2007-02-27 19:11
    d
    C:\Program Files\wmr11
    2007-02-22 20:36 2516 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
    2007-02-18 16:51 2903 --a
    C:\WINDOWS\mozver.dat
    2007-02-05 15:17 185344 --a
    C:\WINDOWS\system32\upnphost.dll
    2007-01-27 13:30 4096 --a
    C:\WINDOWS\d3dx.dat


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    {5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    {CA6319C0-31B7-401E-A518-A07C3DB8F777} c:\Program Files\BAE\BAE.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
    "ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
    "DMXLauncher"="C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe"
    "DLA"="C:\\WINDOWS\\System32\\DLA\\DLACTRLW.EXE"
    "fbdirect"="C:\\Program Files\\ScanSoft\\PaperPort\\fbdirect.exe"
    "SigmatelSysTrayApp"="sttray.exe"
    "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
    "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
    "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "Steam"="\"c:\\steam1\\steam.exe\" -silent"
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
    63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
    6d,73,73,74,79,6c,65,73,00
    "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
    73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoCDBurning"=dword:00000000

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    @=&quot;"
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
    "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
    "PPWebCap"="C:\\Program Files\\ScanSoft\\PaperPort\\PPWebCap.exe"
    "Veoh"="\"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe\" /VeohHide"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe\""
    "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
    "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe"
    "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "MSKDetectorExe"="C:\\Program Files\\McAfee\\SpamKiller\\MSKDetct.exe /uninstall"
    "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
    "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
    "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
    "WinDVR SchSvr"="\"C:\\Program Files\\Common Files\\InterVideo\\SchSvr\\SchSvr.exe\""

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0
    WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


    [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
    Shell\AutoRun\command E:\setup.exe

    ********************************************************************

    catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-04-27 16:33:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    ********************************************************************

    Completion time: 07-04-27 16:33:59
    C:\ComboFix-quarantined-files.txt ... 07-04-27 16:33

    Logfile of HijackThis v1.99.1
    Scan saved at 4:34:50 PM, on 4/27/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\HijackThis\scanner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.129.10:3128
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [fbdirect] C:\Program Files\ScanSoft\PaperPort\fbdirect.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKCU\..\Run: [Steam] "c:\steam1\steam.exe" -silent
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://download.sopcast.com/download/SOPCORE.CAB
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  • peku006
    edited May 2007
    :)Hi jusama14
    sorry it took me so long to respond!:(

    Please visit Virustotal
    * Click the Browse... button
    * Navigate to the file C:\WINDOWS\b136.exe
    * Click the Open button
    * Click the Send button
    * Copy and paste the results back here


    Click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following,( if present)
    ErrorProtector Free

    Please delete these files using WindowsExplorer(ifpresent):
    C:\WINDOWS\eiunin2.exe

    Please, delete this folder folder using WindowsExplorer(ifpresent):
    C:\VundoFix\Backups

    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
    This program is for XP and Windows 2000 only!

    Double-click ATF Cleaner.exe to open it.
    Under Main select the following:
    * Windows Temp
    * Current User Temp
    * All Users Temp
    * Temporary Internet Files
    * Prefetch
    * Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.
    Click Exit on the Main menu to close the program.


    Please run Panda's ActiveScan You will need to use Internet Explorer to run it.

    * Once you are on the Panda site click the Scan your PC button
    * A new window will open...click the Check Now button
    * Enter your Country
    * Enter your State/Province
    * Enter your e-mail address and click send
    * Select either Home User or Company
    * Click the big Scan Now button
    * If it wants to install an ActiveX component allow it
    * It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    * When download is complete, click on My Computer to start the scan
    * When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
    Post fresh HijackThis log and, the Panda's ActiveScan Report
    to your next reply.;)
Sign In or Register to comment.