Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HJT Log - Jonni


  • Please log in to reply
10 replies to this topic

#1 jonni

jonni

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:56 AM

Posted 21 March 2005 - 04:05 AM

Logfile of HijackThis v1.99.1
Scan saved at 09:04:25, on 3/21/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\ALISNDMG.EXE
C:\WINDOWS\SYSTEM\TPWRTRAY.EXE
C:\WINDOWS\SYSTEM\TFNCKY.EXE
C:\PROGRAM FILES\APOINT\APOINT.EXE
C:\PROGRAM FILES\USBDRIVE\SHWICON.EXE
C:\PROGRAM FILES\COMMON FILES\NOKIA\NCLTOOLS\NCLTRAY.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\IRXFER.EXE
C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\COMMON FILES\NOKIA\SERVICES\SERVICELAYER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://c:\windows\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {96452A3F-9785-11D9-9E22-00004471CDEA} - C:\WINDOWS\SYSTEM\NCCO.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ALiSndMgr] ALiSndMg.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [AlpsPoint] C:\Progra~1\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Drives Driver v1.19r020] "C:\Program Files\USBDRIVE\shwicon.exe" -t"Justrams\USB Drives Driver v1.19r020"
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {5938FEB1-3609-11D4-85CD-00902707DAE7} (MapCtl Class) - http://www.promapserver.co.uk/controls/latest/webmap.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 213.1.119.103,213.1.119.104
O18 - Filter: text/html - {E5216F44-97C7-11D9-9E22-0000997F9062} - C:\WINDOWS\SYSTEM\NCCO.DLL
O18 - Filter: text/plain - {E5216F44-97C7-11D9-9E22-0000997F9062} - C:\WINDOWS\SYSTEM\NCCO.DLL

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,640 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:56 PM

Posted 21 March 2005 - 09:09 AM

Please follow these steps:


1. Download: "StartDreck" from:

http://www.niksoft.at/download/startdreck.htm

2. Extract the file into c:\startdreck.

3. Navigate to c:\startdreck and double-click on Startdreck.exe

4. When the program opens click on the Config button.

5. Then click on the unmark all button.

6. Then put checkmarks in the following checkboxes:

Under Registry put a checkmark in the Run Keys checkbox.

Under System/Drivers put a check in the Running Proccess checkbox.

7. Press the OK button.

8. Press the Save button. Type in the location you want to save the log to, or use the defaults which will save the log into the directory you are running the program from. If you choose the defaults the filename for the log will be StartDreck.log.

9. Post a copy of the log as a reply to this post.

#3 jonni

jonni
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:56 AM

Posted 22 March 2005 - 04:14 AM

Grinler, Startdreck log as requested:

StartDreck (build 2.1.7 public stable) - 2005-03-22 @ 09:12:12 (GMT +00:00)
Platform: Windows 98 SE (Win 4.10.2222 A)
Internet Explorer: 6.0.2800.1106
Logged in as mserridge at TOSHIBA

舞egistry
舞un Keys
翟urrent User
舞un
*Taskbar Display Controls=RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
*SpyKiller=C:\Program Files\SpyKiller\spykiller.exe /startup
*BestPopUpKiller=C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
舞unOnce
聞efault User
舞un
*Taskbar Display Controls=RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
舞unOnce
腿ocal Machine
舞un
*ScanRegistry=c:\windows\scanregw.exe /autorun
*TaskMonitor=c:\windows\taskmon.exe
*SystemTray=SysTray.Exe
*IrMon=IrMon.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*ALiSndMgr=ALiSndMg.exe
*Tpwrtray=TPWRTRAY.EXE
*TFncKy=TFncKy.exe
*AlpsPoint=C:\Progra~1\Apoint\Apoint.exe
*ShowIcon_Justrams_USB Drives Driver v1.19r020="C:\Program Files\USBDRIVE\shwicon.exe" -t"Justrams\USB Drives Driver v1.19r020"
*Nokia Tray Application=C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
*RegShave=C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
*APVXDWIN="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
+OptionalComponents
+IMAIL
*Installed=1
+MAPI
*NoChange=1
*Installed=1
+MAPI
*NoChange=1
*Installed=1
舞unOnce
舞unServices
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SchedulingAgent=mstask.exe
*Machine Debug Manager=C:\WINDOWS\SYSTEM\MDM.EXE
*PavProc="C:\Program Files\Common Files\Panda Software\PavShld\PavPrS9x.exe"
*PAVFNSVR="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe"
*PSIMSVC="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSIMSVC.exe"
*PAVFIRES="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe"
*Pavprot9="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavprot9.exe"
*Panda Preventium+ Service="C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PREVSRV.EXE"
舞unServicesOnce
**w=rundll32 C:\WINDOWS\HLPSTEJ1.GIF,DllGetClassObject
舞unOnceEx
舞unServicesOnceEx
肇iles
艋ystem/Drivers
舞unning Processes
+FFEF64AF=C:\WINDOWS\SYSTEM\KERNEL32.DLL
+FFFFA4CF=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
+FFFFACD7=C:\WINDOWS\SYSTEM\SPOOL32.EXE
+FFFF9A07=C:\WINDOWS\SYSTEM\MPREXE.EXE
+FFFE151F=C:\WINDOWS\SYSTEM\MSTASK.EXE
+FFFE0507=C:\WINDOWS\SYSTEM\MDM.EXE
+FFFE6E3B=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PAVFNSVR.EXE
+FFFE42DB=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PSIMSVC.EXE
+FFFE48FF=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\FIREWALL\PAVFIRES.EXE
+FFFEEA1B=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PAVPROT9.EXE
+FFE13547=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PREVSRV.EXE
+FFE1485F=C:\WINDOWS\RUNDLL32.EXE
+FFE19DDB=C:\WINDOWS\SYSTEM\mmtask.tsk
+FFE34283=C:\WINDOWS\EXPLORER.EXE
+FFE498DF=C:\WINDOWS\TASKMON.EXE
+FFE48EF7=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
+FFE4DF9F=C:\WINDOWS\SYSTEM\IRMON.EXE
+FFE7BA63=C:\WINDOWS\SYSTEM\ALISNDMG.EXE
+FFE76543=C:\WINDOWS\SYSTEM\TPWRTRAY.EXE
+FFE74D57=C:\WINDOWS\SYSTEM\TFNCKY.EXE
+FFE7F82F=C:\PROGRAM FILES\APOINT\APOINT.EXE
+FFE63AF7=C:\PROGRAM FILES\USBDRIVE\SHWICON.EXE
+FFE6046F=C:\PROGRAM FILES\COMMON FILES\NOKIA\NCLTOOLS\NCLTRAY.EXE
+FFE923B7=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\APVXDWIN.EXE
+FFE9B8F3=C:\WINDOWS\RunDLL.exe
+FFE9C7C3=C:\WINDOWS\IRXFER.EXE
+FFE8389F=C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE
+FFE8D473=C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
+FFEA0A53=C:\PROGRAM FILES\COMMON FILES\NOKIA\SERVICES\SERVICELAYER.EXE
+FFEA4F57=C:\WINDOWS\SYSTEM\WMIEXE.EXE
+FFE09F0B=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\WEBPROXY.EXE
+FFEF32E7=C:\STARTDRECK\STARTDRECK.EXE
翠pplication specific

#4 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,640 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:56 PM

Posted 22 March 2005 - 10:57 AM

Please download and extract the following file.

http://www.derbilk.de/SpSeHjfix_Beta9.zip

Then run it and post the resulting log along with a new startdreck log.

#5 jonni

jonni
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:56 AM

Posted 23 March 2005 - 04:14 AM

(3/23/05 09:04:20) SPSeHjFix started v1.1.0
(3/23/05 09:04:20) OS: Win98SE A (4.10.2222)
(3/23/05 09:04:20) Language: english
(3/23/05 09:04:27) Disinfect started
(3/23/05 09:04:27) Bad-Dll(IEP): se.dll
(3/23/05 09:04:27) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\SYSTEM\IFC.DLL
(3/23/05 09:04:27) Searchassistant Uninstaller - Keys Deleted
(3/23/05 09:04:27) UBF: 6
(3/23/05 09:04:27) UBB: 1
(3/23/05 09:04:27) FilterKey: HKCR\text/html (deleted)
(3/23/05 09:04:27) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(3/23/05 09:04:27) FilterKey: HKCR\CLSID\{C26257C0-9AC5-11D9-9E22-00002BB41723} (deleted)
(3/23/05 09:04:27) FilterKey: HKCR\text/plain (deleted)
(3/23/05 09:04:27) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(3/23/05 09:04:27) FilterKey: HKCR\CLSID\{C26257C0-9AC5-11D9-9E22-00002BB41723} (error while deleting)
(3/23/05 09:04:27) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C26257C1-9AC5-11D9-9E22-000044F8B2B8} (deleted)
(3/23/05 09:04:27) BHO-Key: HKCR\CLSID\{C26257C1-9AC5-11D9-9E22-000044F8B2B8} (deleted)
(3/23/05 09:04:27) UBR: 25
(3/23/05 09:04:27) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall (deleted)
(3/23/05 09:04:27) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\TEMP\se.dll/sp.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(3/23/05 09:04:28) Stealth-String found: C:\WINDOWS\HLPSTEJ1.GIF
(3/23/05 09:04:28) Temp-Files delete on Reboot
(3/23/05 09:04:28) File added to delete: c:\windows\system\ifc.dll
(3/23/05 09:04:28) File added to delete: c:\windows\system\ifc.dll
(3/23/05 09:04:28) File added to delete: c:\windows\temp\se.dll
(3/23/05 09:04:28) File added to delete: c:\windows\hlpstej1.gif
(3/23/05 09:04:28) File added to delete: c:\windows\temp\~df9c05.tmp
(3/23/05 09:04:28) File added to delete: c:\windows\temp\wzse0.tmp
(3/23/05 09:04:28) Reboot
(3/23/05 09:07:19) SPSeHjFix 2nd Step
(3/23/05 09:07:19) Stealth-String not present. Disinfection succesfully
(3/23/05 09:07:23) Cleaned


Startdreck Log:

StartDreck (build 2.1.7 public stable) - 2005-03-23 @ 09:09:35 (GMT +00:00)
Platform: Windows 98 SE (Win 4.10.2222 A)
Internet Explorer: 6.0.2800.1106
Logged in as mserridge at TOSHIBA

舞egistry
舞un Keys
翟urrent User
舞un
*Taskbar Display Controls=RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
*SpyKiller=C:\Program Files\SpyKiller\spykiller.exe /startup
*BestPopUpKiller=C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
舞unOnce
聞efault User
舞un
*Taskbar Display Controls=RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
舞unOnce
腿ocal Machine
舞un
*ScanRegistry=c:\windows\scanregw.exe /autorun
*TaskMonitor=c:\windows\taskmon.exe
*SystemTray=SysTray.Exe
*IrMon=IrMon.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*ALiSndMgr=ALiSndMg.exe
*Tpwrtray=TPWRTRAY.EXE
*TFncKy=TFncKy.exe
*AlpsPoint=C:\Progra~1\Apoint\Apoint.exe
*ShowIcon_Justrams_USB Drives Driver v1.19r020="C:\Program Files\USBDRIVE\shwicon.exe" -t"Justrams\USB Drives Driver v1.19r020"
*Nokia Tray Application=C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
*RegShave=C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
*APVXDWIN="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
*sp=rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
+OptionalComponents
+IMAIL
*Installed=1
+MAPI
*NoChange=1
*Installed=1
+MAPI
*NoChange=1
*Installed=1
舞unOnce
舞unServices
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SchedulingAgent=mstask.exe
*Machine Debug Manager=C:\WINDOWS\SYSTEM\MDM.EXE
*PavProc="C:\Program Files\Common Files\Panda Software\PavShld\PavPrS9x.exe"
*PAVFNSVR="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe"
*PSIMSVC="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSIMSVC.exe"
*PAVFIRES="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe"
*Pavprot9="C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavprot9.exe"
*Panda Preventium+ Service="C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PREVSRV.EXE"
舞unServicesOnce
舞unOnceEx
舞unServicesOnceEx
肇ile Associations (CR)
+.bat
*batfile="%1" %*
+.com
*comfile="%1" %*
+.disabled
*SpybotSD.DisabledFile="C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\blindman.exe" "%1"
+.exe
*exefile="%1" %*
+.hta
*htafile=C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %*
+.htm
*FirefoxHTML=C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -url "%1"
+.html
*FirefoxHTML=C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -url "%1"
+.js
*JSFile=C:\PROGRA~1\PANDAS~1\PANDAT~1\PAVSCRIP.EXE "%1" %*
+.jse
*JSEFile=C:\PROGRA~1\PANDAS~1\PANDAT~1\PAVSCRIP.EXE "%1" %*
+.pif
*piffile="%1" %*
+.reg
*regfile=regedit.exe "%1"
+.scr
*scrfile="%1" /S
+.txt
*txtfile=c:\windows\NOTEPAD.EXE %1
+.vbs
*VBSFile=C:\PROGRA~1\PANDAS~1\PANDAT~1\PAVSCRIP.EXE "%1" %*
+.vbe
*VBEFile=C:\PROGRA~1\PANDAS~1\PANDAT~1\PAVSCRIP.EXE "%1" %*
+.wsh
*WSHFile=C:\PROGRA~1\PANDAS~1\PANDAT~1\PAVSCRIP.EXE "%1" %*
+.wsf
*WSFFile=C:\PROGRA~1\PANDAS~1\PANDAT~1\PAVSCRIP.EXE "%1" %*
+.lnk
`lnkfile= [key or value does not exist]
翡rowser Helper Objects (LM)
*{53707962-6F74-2D53-2644-206D7942484F}
`InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
肇iles
翠utostart Folders
翟urrent User
*C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Office.lnk
*C:\WINDOWS\Start Menu\Programs\StartUp\Exif Launcher.lnk
*C:\WINDOWS\Start Menu\Programs\StartUp\WinZip Quick Pick.lnk
聞efault User
*C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Office.lnk
*C:\WINDOWS\Start Menu\Programs\StartUp\Exif Launcher.lnk
*C:\WINDOWS\Start Menu\Programs\StartUp\WinZip Quick Pick.lnk
腿ocal Machine
膏NI-Files
蓄IN.INI\[windows]
*LOAD=
*RUN=
艋YSTEM.INI\[boot]
*SHELL=Explorer.exe
蓉ext Files
*C:\WINDOWS\msdos.sys
*C:\msdos.sys
*C:\config.sys
*C:\autoexec.bat
*C:\WINDOWS\wininit.bak
*C:\WINDOWS\dosstart.bat
艋ystem/Drivers
舞unning Processes
+FFEF6153=C:\WINDOWS\SYSTEM\KERNEL32.DLL
+FFFFA133=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
+FFFFACC3=C:\WINDOWS\SYSTEM\MPREXE.EXE
+FFFE3807=C:\WINDOWS\SYSTEM\mmtask.tsk
+FFFE295F=C:\WINDOWS\SYSTEM\MSTASK.EXE
+FFFE16FB=C:\WINDOWS\SYSTEM\MDM.EXE
+FFFE70AB=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PAVFNSVR.EXE
+FFFEB177=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PSIMSVC.EXE
+FFFEA17F=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\FIREWALL\PAVFIRES.EXE
+FFFEDEEF=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PAVPROT9.EXE
+FFFE0A5F=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PREVSRV.EXE
+FFE376E3=C:\WINDOWS\SYSTEM\PSTORES.EXE
+FFE361AB=C:\WINDOWS\EXPLORER.EXE
+FFE5C29F=C:\WINDOWS\TASKMON.EXE
+FFE4303F=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
+FFE34E73=C:\WINDOWS\SYSTEM\IRMON.EXE
+FFE4F607=C:\WINDOWS\SYSTEM\ALISNDMG.EXE
+FFE4DDF3=C:\WINDOWS\SYSTEM\TPWRTRAY.EXE
+FFE716CF=C:\WINDOWS\SYSTEM\TFNCKY.EXE
+FFE79E6F=C:\PROGRAM FILES\APOINT\APOINT.EXE
+FFE65863=C:\PROGRAM FILES\USBDRIVE\SHWICON.EXE
+FFE6E1AB=C:\PROGRAM FILES\COMMON FILES\NOKIA\NCLTOOLS\NCLTRAY.EXE
+FFE71F1B=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\APVXDWIN.EXE
+FFE6C097=C:\WINDOWS\IRXFER.EXE
+FFE9109B=C:\WINDOWS\RunDLL.exe
+FFE9B8FB=C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE
+FFE802D7=C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
+FFEB7DA3=C:\PROGRAM FILES\COMMON FILES\NOKIA\SERVICES\SERVICELAYER.EXE
+FFEB4C87=C:\WINDOWS\SYSTEM\WMIEXE.EXE
+FFE8F90F=C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\WEBPROXY.EXE
+FFEA90C3=C:\STARTDRECK\STARTDRECK.EXE
臧T Services
翠pplication specific


Hope this is what you wanted. Had a bit of trouble with the link.

#6 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,640 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:56 PM

Posted 23 March 2005 - 11:21 AM

Ok post a new hjt log and we will clean the rest

#7 jonni

jonni
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:56 AM

Posted 23 March 2005 - 12:05 PM

latest HJT log as requested

Logfile of HijackThis v1.99.1
Scan saved at 05:02:15, on 3/23/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ALiSndMgr] ALiSndMg.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [AlpsPoint] C:\Progra~1\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Drives Driver v1.19r020] "C:\Program Files\USBDRIVE\shwicon.exe" -t"Justrams\USB Drives Driver v1.19r020"
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH\MOUSE\AMOUMAIN.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [PavProc] "C:\Program Files\Common Files\Panda Software\PavShld\PavPrS9x.exe"
O4 - HKLM\..\RunServices: [PAVFNSVR] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe"
O4 - HKLM\..\RunServices: [PSIMSVC] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSIMSVC.exe"
O4 - HKLM\..\RunServices: [PAVFIRES] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe"
O4 - HKLM\..\RunServices: [Pavprot9] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavprot9.exe"
O4 - HKLM\..\RunServices: [Panda Preventium+ Service] "C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PREVSRV.EXE"
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {5938FEB1-3609-11D4-85CD-00902707DAE7} (MapCtl Class) - http://www.promapserver.co.uk/controls/latest/webmap.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 213.1.119.103,213.1.119.104

#8 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,640 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:56 PM

Posted 23 March 2005 - 10:54 PM

Print out these instructions and then close all windows including Internet Explorer.

Reboot your computer into Safe Mode

Then I want you to fix some of those entries. Please do the following:

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall


Then delete these files or directories (Do not be concerned if they do not exist)
C:\WINDOWS\TEMP\SE.DLL

Reboot your computer to go back to normal mode and post a new log.

#9 jonni

jonni
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:56 AM

Posted 29 March 2005 - 02:49 AM

Sorry about the delay in replying, Bank Holiday weekend got in the way.

Here is the latest and hopefully last log:

Logfile of HijackThis v1.99.1
Scan saved at 09:47:44, on 3/25/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ALiSndMgr] ALiSndMg.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [AlpsPoint] C:\Progra~1\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Drives Driver v1.19r020] "C:\Program Files\USBDRIVE\shwicon.exe" -t"Justrams\USB Drives Driver v1.19r020"
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH\MOUSE\AMOUMAIN.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [PavProc] "C:\Program Files\Common Files\Panda Software\PavShld\PavPrS9x.exe"
O4 - HKLM\..\RunServices: [PAVFNSVR] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe"
O4 - HKLM\..\RunServices: [PSIMSVC] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSIMSVC.exe"
O4 - HKLM\..\RunServices: [PAVFIRES] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe"
O4 - HKLM\..\RunServices: [Pavprot9] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavprot9.exe"
O4 - HKLM\..\RunServices: [Panda Preventium+ Service] "C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2005\PREVSRV.EXE"
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {5938FEB1-3609-11D4-85CD-00902707DAE7} (MapCtl Class) - http://www.promapserver.co.uk/controls/latest/webmap.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 213.1.119.103,213.1.119.104

Thanks for all your help

#10 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,640 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:56 PM

Posted 29 March 2005 - 10:44 AM

Log looks clean...great job!

Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Renable system restore with instructions from tutorial above


Next,

This process will clean out your Temp files and your Temporary Internet Files. Please do both steps:

Step 1:Delete Temp Files
To clean out your temp files, click on Start and then run, and type %temp% and press the ok button.

This should open up the temp directory that your machine uses. Please delete all files that are found there. If you get an error when deleting a file, skip that file and delete all the others. If you had trouble deleting a file, reboot into Safe Mode and follow this step again. You should now be able to delete all the files.

Step 2: Delete Temporary Internet Files
Now I want you to open up Internet Explorer, and click on the Tools menu and then Internet Options. At the General tab, which should be the first tab you are currently on, click on the Delete Files button and put a checkmark in Delete offline content. Then press the OK button. This may take quite a while, so do not be alarmed with how long it takes. When it is done, your Temporary Internet Files will now be deleted.

Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:

Simple and easy ways to keep your computer safe and secure on the Internet


Glad I was able to help.

#11 jonni

jonni
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:11:56 AM

Posted 29 March 2005 - 11:41 AM

So am I, thanks very much for your help. Computer is definitely running better and no more pop ups.

:thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users