Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HJT log


  • This topic is locked This topic is locked
10 replies to this topic

#1 verybigtrees

verybigtrees

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:12:35 PM

Posted 23 May 2005 - 09:08 PM

I know there is some virus in here but I dont know what it is....please, someone figure it out, thanks


Logfile of HijackThis v1.99.1
Scan saved at 9:00:15 PM, on 5/23/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\atllq32.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\sdknb32.exe
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Advanced Browser\browser.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Blake\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {88204317-4193-5465-3672-D014877AA017} - C:\WINDOWS\iewb.dll
O2 - BHO: Class - {EB63E320-5E1D-A1CC-878B-832365F1D0E3} - C:\WINDOWS\mfcnt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Overnet] C:\Program Files\Overnet\Overnet.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [sdknb32.exe] C:\WINDOWS\system32\sdknb32.exe
O4 - HKLM\..\Run: [MPSExe] C:\Program Files\McAfee.com\MPS\mscifapp.exe /embedding
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Blake\Local Settings\Temp\{A2627B8C-D790-45E6-84D6-9C3F28913F17}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMREMIND.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11F#`I) - Unknown owner - C:\WINDOWS\atllq32.exe
O23 - Service: McAfee AntiSpyware Real-Time Scanner (McAfeeAntiSpyware) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

BC AdBot (Login to Remove)

 


#2 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:11:35 AM

Posted 24 May 2005 - 04:36 PM

Hello verybigtrees and welcome to BleepingComputer.


Please download CWShredder.exe to your desktop.
- Open CWShedder.exe.
- Click on Check for Update to be sure you have the most current version.
- Close CWShredder, we will use it later.

Download AboutBuster.zip to your desktop.
- Unzip the contents of AboutBuster.zip and an AboutBuster folder will be created.
- Navigate to the AboutBuster folder and double-click on AboutBuster.exe.
- Click OK at the prompt with instructions.
- Click Update and then Check For Update to begin the update process.
- If any updates exist please download them by clicking Download Update.
- Close AboutBuster by clicking on Exit. AboutBuster will be used later.


Open Notepad, (Start button, click on Run, type in Notepad, and click OK) copy & pastes the following block of text into Notepad.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_11F#`I]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\11F#`I]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_11F#`I]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\11F#`I]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

Click on 'File', then 'Save as'
Select 'Save as type:' as All Files,
Save the file to the desktop as fix.reg. Close Notepad. This file will be used later.


Configure Windows to enable viewing of Hidden and System files.

Click on Start, then Run and type in services.msc.
- Locate and double click on Remote Procedure Call (RPC) Helper.
- Set the Startup type: to Disabled, click Apply.
- Click on Stop and OK your way out.

Reboot into Safe Mode.


Open CWShredder.
- Run CWShredder by clicking on the FIX button, and allow it to complete.


Start HJT and click on the SCAN button. Put a check mark in front of the following lines if they still show:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zuxpa.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing

O2 - BHO: Class - {88204317-4193-5465-3672-D014877AA017} - C:\WINDOWS\iewb.dll
O2 - BHO: Class - {EB63E320-5E1D-A1CC-878B-832365F1D0E3} - C:\WINDOWS\mfcnt.dll

O4 - HKLM\..\Run: [sdknb32.exe] C:\WINDOWS\system32\sdknb32.exe

O23 - Service: Remote Procedure Call (RPC) Helper ( 11F#`I) - Unknown owner - C:\WINDOWS\atllq32.exe

With ALL OTHER WINDOWS CLOSED, click on Fix Checked.


Open Windows Explorer (Windows key+e), navigate to and delete the following files (Don't be concerned if they can not be found):

C:\WINDOWS\zuxpa.dll
C:\WINDOWS\iewb.dll
C:\WINDOWS\mfcnt.dll
C:\WINDOWS\atllq32.exe
C:\WINDOWS\system32\sdknb32.exe


Then double-click on the fix.reg file previously saved to the desktop.
- When it prompts to add or merge, say yes. This will clear some registry entries left behind by the malware.


Browse to where you saved AboutBuster and run AboutBuster.exe.
- Click OK at the directions prompt.
- Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
- Click Yes to allow it to shutdown explorer.exe.
- It will begin to scan your computer. If it asks to do a second pass, allow it to do so.
- When it has finished, click Save Log.


Reboot normally and post the AboutBuster log along with a fresh HJT log.
Derfram
~~~~~~

#3 verybigtrees

verybigtrees
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:12:35 PM

Posted 25 May 2005 - 03:44 PM

Sorry im taking long but When I try to open the Aboutbuster a message pops up stating that the component "MsConCtl.ocx" is missing

#4 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:11:35 AM

Posted 25 May 2005 - 04:27 PM

For missing MSCOMCTL.OCX, download and run this program from Javacool Software. http://www.spywareinfo.com/downloads/tools...ngfilesetup.exe
Derfram
~~~~~~

#5 verybigtrees

verybigtrees
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:12:35 PM

Posted 31 May 2005 - 04:05 PM

Scanned at: 1:07:58 AM on: 5/28/2005


-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 26


Removed Data Streams:
C:\WINDOWS\addlo.dll:lacqo
C:\WINDOWS\javaoz.dll:izmwa
C:\WINDOWS\javapg32.dll:tbppx
C:\WINDOWS\javapz32.dll:vuaat
C:\WINDOWS\netsm32.dll:oeyrk
C:\WINDOWS\netss.dll:gerfe
C:\WINDOWS\nettc.dll:rfkkg
C:\WINDOWS\nettv32.dll:cgnvc
C:\WINDOWS\nettv32.dll:cgnvc
C:\WINDOWS\TWUNK_32.EXE:gfqln
C:\WINDOWS\unvise32qt.exe:zgjqp
C:\WINDOWS\WINNT.BMP:asdam


Removed 4 Random Key Entries
Removed! : C:\WINDOWS\addds32.exe
Removed! : C:\WINDOWS\adddt.dll
Removed! : C:\WINDOWS\addjo.dll
Removed! : C:\WINDOWS\addmz32.dll
Removed! : C:\WINDOWS\addvc32.dll
Removed! : C:\WINDOWS\ajwhj.dat
Removed! : C:\WINDOWS\apiay32.dll
Removed! : C:\WINDOWS\apibb32.dll
Removed! : C:\WINDOWS\apigi.dll
Removed! : C:\WINDOWS\apigp32.dll
Removed! : C:\WINDOWS\apigr32.dll
Removed! : C:\WINDOWS\apiia32.dll
Removed! : C:\WINDOWS\apilk32.dll
Removed! : C:\WINDOWS\apimm.dll
Removed! : C:\WINDOWS\apipn32.exe
Removed! : C:\WINDOWS\apisq32.dll
Removed! : C:\WINDOWS\apiws32.exe
Removed! : C:\WINDOWS\apiyx32.dll
Removed! : C:\WINDOWS\apizk32.dll
Removed! : C:\WINDOWS\appdz32.dll
Removed! : C:\WINDOWS\appey.exe
Removed! : C:\WINDOWS\apptp32.dll
Removed! : C:\WINDOWS\appvh.dll
Removed! : C:\WINDOWS\appxy.dll
Removed! : C:\WINDOWS\appyq32.exe
Removed! : C:\WINDOWS\atlbr.dll
Removed! : C:\WINDOWS\atlgu.dll
Removed! : C:\WINDOWS\atlhr32.dll
Removed! : C:\WINDOWS\atlkj.dll
Removed! : C:\WINDOWS\atlmk32.dll
Removed! : C:\WINDOWS\atlms32.dll
Removed! : C:\WINDOWS\atlra32.dll
Removed! : C:\WINDOWS\atlvk.dll
Removed! : C:\WINDOWS\bpgvo.dat
Removed! : C:\WINDOWS\chtxy.dat
Removed! : C:\WINDOWS\chtxy.dll
Removed! : C:\WINDOWS\cjjvs.dat
Removed! : C:\WINDOWS\cjjvs.dll
Removed! : C:\WINDOWS\clftg.dat
Removed! : C:\WINDOWS\crlb.dll
Removed! : C:\WINDOWS\crnj.dll
Removed! : C:\WINDOWS\crpa.dll
Removed! : C:\WINDOWS\cruz32.dll
Removed! : C:\WINDOWS\crvy.dll
Removed! : C:\WINDOWS\cvzbl.dat
Removed! : C:\WINDOWS\d3dz.dll
Removed! : C:\WINDOWS\d3eo32.dll
Removed! : C:\WINDOWS\d3gy.dll
Removed! : C:\WINDOWS\d3lb32.dll
Removed! : C:\WINDOWS\d3lf32.exe
Removed! : C:\WINDOWS\d3li32.dll
Removed! : C:\WINDOWS\d3lk.dll
Removed! : C:\WINDOWS\d3lp.exe
Removed! : C:\WINDOWS\d3mc.exe
Removed! : C:\WINDOWS\d3oz32.dll
Removed! : C:\WINDOWS\d3qt.dll
Removed! : C:\WINDOWS\d3rv.dll
Removed! : C:\WINDOWS\d3ve32.dll
Removed! : C:\WINDOWS\dkylz.dat
Removed! : C:\WINDOWS\drsjo.dat
Removed! : C:\WINDOWS\duguh.dll
Removed! : C:\WINDOWS\eawac.dat
Removed! : C:\WINDOWS\fpmojz.dat
Removed! : C:\WINDOWS\fqhpc.dat
Removed! : C:\WINDOWS\fqqbn.dat
Removed! : C:\WINDOWS\fqqbn.dll
Removed! : C:\WINDOWS\fwkix.dat
Removed! : C:\WINDOWS\grdzh.dat
Removed! : C:\WINDOWS\gxorm.dat
Removed! : C:\WINDOWS\hnpbx.dll
Removed! : C:\WINDOWS\idqzjw.dat
Removed! : C:\WINDOWS\ieag.dll
Removed! : C:\WINDOWS\iefv32.dll
Removed! : C:\WINDOWS\iegq32.dll
Removed! : C:\WINDOWS\iekw32.dll
Removed! : C:\WINDOWS\ienb.dll
Removed! : C:\WINDOWS\iene.dll
Removed! : C:\WINDOWS\ieza32.dll
Removed! : C:\WINDOWS\ipbh32.dll
Removed! : C:\WINDOWS\ipdo32.exe
Removed! : C:\WINDOWS\ipep32.dll
Removed! : C:\WINDOWS\ipgt.dll
Removed! : C:\WINDOWS\iprr.dll
Removed! : C:\WINDOWS\ipts.dll
Removed! : C:\WINDOWS\ipxw32.dll
Removed! : C:\WINDOWS\isxcy.dat
Removed! : C:\WINDOWS\ittdk.dat
Removed! : C:\WINDOWS\javabz32.dll
Removed! : C:\WINDOWS\javahf32.dll
Removed! : C:\WINDOWS\javahu.dll
Removed! : C:\WINDOWS\javahw.dll
Removed! : C:\WINDOWS\javajx.dll
Removed! : C:\WINDOWS\javang.dll
Removed! : C:\WINDOWS\javate.dll
Removed! : C:\WINDOWS\javaxa32.dll
Removed! : C:\WINDOWS\javazc32.dll
Removed! : C:\WINDOWS\jeniz.dat
Removed! : C:\WINDOWS\jjxli.dat
Removed! : C:\WINDOWS\kacfhz.dat
Removed! : C:\WINDOWS\kbcft.dat
Removed! : C:\WINDOWS\kesne.dat
Removed! : C:\WINDOWS\kesne.dll
Removed! : C:\WINDOWS\kfdkrd.dat
Removed! : C:\WINDOWS\kjhqb.dat
Removed! : C:\WINDOWS\kwkke.dat
Removed! : C:\WINDOWS\lcmkm.dat
Removed! : C:\WINDOWS\lcvrf.dat
Removed! : C:\WINDOWS\lesrz.dll
Removed! : C:\WINDOWS\mfcfs32.dll
Removed! : C:\WINDOWS\mfcor32.dll
Removed! : C:\WINDOWS\mfcpo32.dll
Removed! : C:\WINDOWS\mfctn32.dll
Removed! : C:\WINDOWS\mfcup.exe
Removed! : C:\WINDOWS\mfcvq.dll
Removed! : C:\WINDOWS\mrgor.dat
Removed! : C:\WINDOWS\mrgor.dll
Removed! : C:\WINDOWS\mskv.dll
Removed! : C:\WINDOWS\msla.exe
Removed! : C:\WINDOWS\msmh32.dll
Removed! : C:\WINDOWS\msrx.dll
Removed! : C:\WINDOWS\mste.dll
Removed! : C:\WINDOWS\mswj32.dll
Removed! : C:\WINDOWS\mswl32.dll
Removed! : C:\WINDOWS\nceek.dat
Removed! : C:\WINDOWS\nervy.dat
Removed! : C:\WINDOWS\nervy.dll
Removed! : C:\WINDOWS\netjp32.exe
Removed! : C:\WINDOWS\netkp.dll
Removed! : C:\WINDOWS\netvw.exe
Removed! : C:\WINDOWS\njxmz.dat
Removed! : C:\WINDOWS\njxmz.dll
Removed! : C:\WINDOWS\nqskp.dat
Removed! : C:\WINDOWS\ntfu32.exe
Removed! : C:\WINDOWS\nthf32.dll
Removed! : C:\WINDOWS\ntlt.dll
Removed! : C:\WINDOWS\nussh.dat
Removed! : C:\WINDOWS\nussh.dll
Removed! : C:\WINDOWS\nxkga.dat
Removed! : C:\WINDOWS\ocwfq.dat
Removed! : C:\WINDOWS\pabmd.dat
Removed! : C:\WINDOWS\pktmvh.dat
Removed! : C:\WINDOWS\pmkia.dat
Removed! : C:\WINDOWS\ppjsp.dat
Removed! : C:\WINDOWS\ppjsp.dll
Removed! : C:\WINDOWS\qceln.dat
Removed! : C:\WINDOWS\qooly.dat
Removed! : C:\WINDOWS\ruijt.dll
Removed! : C:\WINDOWS\rulok.dat
Removed! : C:\WINDOWS\sdkjq.exe
Removed! : C:\WINDOWS\sdkmk32.dll
Removed! : C:\WINDOWS\sdkrq32.exe
Removed! : C:\WINDOWS\sdksf.dll
Removed! : C:\WINDOWS\sdkyc32.dll
Removed! : C:\WINDOWS\sqaef.dat
Removed! : C:\WINDOWS\sysbg32.dll
Removed! : C:\WINDOWS\syscc.dll
Removed! : C:\WINDOWS\sysjp32.dll
Removed! : C:\WINDOWS\sysoz.dll
Removed! : C:\WINDOWS\ugaoz.dll
Removed! : C:\WINDOWS\ujhmx.dat
Removed! : C:\WINDOWS\ujhmx.dll
Removed! : C:\WINDOWS\weuds.dat
Removed! : C:\WINDOWS\winbc.dll
Removed! : C:\WINDOWS\windw.dll
Removed! : C:\WINDOWS\winio32.dll
Removed! : C:\WINDOWS\winju.dll
Removed! : C:\WINDOWS\winlh.dll
Removed! : C:\WINDOWS\winma32.dll
Removed! : C:\WINDOWS\winmb.dll
Removed! : C:\WINDOWS\winmi32.exe
Removed! : C:\WINDOWS\winnx.dll
Removed! : C:\WINDOWS\winvc32.dll
Removed! : C:\WINDOWS\xitap.dat
Removed! : C:\WINDOWS\xnqit.dat
Removed! : C:\WINDOWS\xrjjv.dat
Removed! : C:\WINDOWS\ygslze.dat
Removed! : C:\WINDOWS\ynzrbr.dat
Removed! : C:\WINDOWS\ypmzfm.dat
Removed! : C:\WINDOWS\yrkniq.dat
Removed! : C:\WINDOWS\zjvwn.dat
Removed! : C:\WINDOWS\zlzua.dat
Removed! : C:\WINDOWS\System32\addfg32.dll
Removed! : C:\WINDOWS\System32\addfu32.dll
Removed! : C:\WINDOWS\System32\addin.dll
Removed! : C:\WINDOWS\System32\addjo32.dll
Removed! : C:\WINDOWS\System32\addpt32.dll
Removed! : C:\WINDOWS\System32\addrd.exe
Removed! : C:\WINDOWS\System32\adyrt.dat
Removed! : C:\WINDOWS\System32\apibd.dll
Removed! : C:\WINDOWS\System32\apihx.dll
Removed! : C:\WINDOWS\System32\apiii.dll
Removed! : C:\WINDOWS\System32\apimg32.dll
Removed! : C:\WINDOWS\System32\apiqb.exe
Removed! : C:\WINDOWS\System32\apiuy.dll
Removed! : C:\WINDOWS\System32\apiwx32.dll
Removed! : C:\WINDOWS\System32\appct32.dll
Removed! : C:\WINDOWS\System32\appeh.dll
Removed! : C:\WINDOWS\System32\appgj32.dll
Removed! : C:\WINDOWS\System32\appjr32.dll
Removed! : C:\WINDOWS\System32\appmh.dll
Removed! : C:\WINDOWS\System32\appvi.dll
Removed! : C:\WINDOWS\System32\appxn32.dll
Removed! : C:\WINDOWS\System32\atlet.exe
Removed! : C:\WINDOWS\System32\atlgg.dll
Removed! : C:\WINDOWS\System32\atlgw.dll
Removed! : C:\WINDOWS\System32\atlhd.exe
Removed! : C:\WINDOWS\System32\atlhe.dll
Removed! : C:\WINDOWS\System32\atlhe32.dll
Removed! : C:\WINDOWS\System32\atliv32.dll
Removed! : C:\WINDOWS\System32\atljb.dll
Removed! : C:\WINDOWS\System32\atljz32.dll
Removed! : C:\WINDOWS\System32\atlnn.dll
Removed! : C:\WINDOWS\System32\atlpd32.exe
Removed! : C:\WINDOWS\System32\atlpy.dll
Removed! : C:\WINDOWS\System32\atlrs.dll
Removed! : C:\WINDOWS\System32\atlwh.dll
Removed! : C:\WINDOWS\System32\atlxi32.dll
Removed! : C:\WINDOWS\System32\atlxs.dll
Removed! : C:\WINDOWS\System32\atlyp.exe
Removed! : C:\WINDOWS\System32\awaam.dat
Removed! : C:\WINDOWS\System32\baazd.dat
Removed! : C:\WINDOWS\System32\bbbjt.dat
Removed! : C:\WINDOWS\System32\brebi.dat
Removed! : C:\WINDOWS\System32\bzbsm.dat
Removed! : C:\WINDOWS\System32\cbaaf.dat
Removed! : C:\WINDOWS\System32\cmhdd.dll
Removed! : C:\WINDOWS\System32\cphgm.dat
Removed! : C:\WINDOWS\System32\cphgm.dll
Removed! : C:\WINDOWS\System32\crdq.dll
Removed! : C:\WINDOWS\System32\crgl.dll
Removed! : C:\WINDOWS\System32\crin32.dll
Removed! : C:\WINDOWS\System32\crmc.exe
Removed! : C:\WINDOWS\System32\crmn.dll
Removed! : C:\WINDOWS\System32\croq.dll
Removed! : C:\WINDOWS\System32\croz32.dll
Removed! : C:\WINDOWS\System32\crsj32.exe
Removed! : C:\WINDOWS\System32\crsu.dll
Removed! : C:\WINDOWS\System32\crtm.dll
Removed! : C:\WINDOWS\System32\crut.dll
Removed! : C:\WINDOWS\System32\d3cq.dll
Removed! : C:\WINDOWS\System32\d3ei.dll
Removed! : C:\WINDOWS\System32\d3nf32.dll
Removed! : C:\WINDOWS\System32\d3tn32.exe
Removed! : C:\WINDOWS\System32\desvq.dll
Removed! : C:\WINDOWS\System32\dfbed.dat
Removed! : C:\WINDOWS\System32\egryy.dll
Removed! : C:\WINDOWS\System32\ejpml.dat
Removed! : C:\WINDOWS\System32\esjum.dat
Removed! : C:\WINDOWS\System32\exkzl.dat
Removed! : C:\WINDOWS\System32\floww.dat
Removed! : C:\WINDOWS\System32\floww.dll
Removed! : C:\WINDOWS\System32\gallq.dat
Removed! : C:\WINDOWS\System32\genli.dat
Removed! : C:\WINDOWS\System32\ggbkp.dll
Removed! : C:\WINDOWS\System32\gvkzm.dat
Removed! : C:\WINDOWS\System32\hpwjd.dat
Removed! : C:\WINDOWS\System32\iehy32.dll
Removed! : C:\WINDOWS\System32\ielz.dll
Removed! : C:\WINDOWS\System32\iepj.dll
Removed! : C:\WINDOWS\System32\iexm32.dll
Removed! : C:\WINDOWS\System32\ieyj32.exe
Removed! : C:\WINDOWS\System32\ipbo.dll
Removed! : C:\WINDOWS\System32\ipjk.dll
Removed! : C:\WINDOWS\System32\ipoi32.dll
Removed! : C:\WINDOWS\System32\ipta.dll
Removed! : C:\WINDOWS\System32\ipue32.dll
Removed! : C:\WINDOWS\System32\ipzf32.dll
Removed! : C:\WINDOWS\System32\javabg32.dll
Removed! : C:\WINDOWS\System32\javadz32.dll
Removed! : C:\WINDOWS\System32\javahb.dll
Removed! : C:\WINDOWS\System32\javaip32.dll
Removed! : C:\WINDOWS\System32\javamv.dll
Removed! : C:\WINDOWS\System32\javaov.dll
Removed! : C:\WINDOWS\System32\javatw.dll
Removed! : C:\WINDOWS\System32\javavr.exe
Removed! : C:\WINDOWS\System32\jhewd.dll
Removed! : C:\WINDOWS\System32\jlzyv.dll
Removed! : C:\WINDOWS\System32\jumtt.dat
Removed! : C:\WINDOWS\System32\jzbor.dat
Removed! : C:\WINDOWS\System32\kihpd.dat
Removed! : C:\WINDOWS\System32\klnwx.dat
Removed! : C:\WINDOWS\System32\kogvv.dat
Removed! : C:\WINDOWS\System32\lgtmh.dat
Removed! : C:\WINDOWS\System32\lupcj.dat
Removed! : C:\WINDOWS\System32\lwmkv.dat
Removed! : C:\WINDOWS\System32\mfcfm32.dll
Removed! : C:\WINDOWS\System32\mfciv32.dll
Removed! : C:\WINDOWS\System32\mfcld32.dll
Removed! : C:\WINDOWS\System32\mfcte.dll
Removed! : C:\WINDOWS\System32\mfctp.dll
Removed! : C:\WINDOWS\System32\mfcxo32.dll
Removed! : C:\WINDOWS\System32\mfcyp.exe
Removed! : C:\WINDOWS\System32\mfczu32.dll
Removed! : C:\WINDOWS\System32\mkdls.dat
Removed! : C:\WINDOWS\System32\mseo.dll
Removed! : C:\WINDOWS\System32\mskw.exe
Removed! : C:\WINDOWS\System32\msor32.dll
Removed! : C:\WINDOWS\System32\msqr.dll
Removed! : C:\WINDOWS\System32\mszt32.exe
Removed! : C:\WINDOWS\System32\mympn.dat
Removed! : C:\WINDOWS\System32\netbq32.dll
Removed! : C:\WINDOWS\System32\netbt.dll
Removed! : C:\WINDOWS\System32\netew.dll
Removed! : C:\WINDOWS\System32\netgs.dll
Removed! : C:\WINDOWS\System32\netil32.dll
Removed! : C:\WINDOWS\System32\netkx32.dll
Removed! : C:\WINDOWS\System32\netln.dll
Removed! : C:\WINDOWS\System32\netqh.dll
Removed! : C:\WINDOWS\System32\netvo32.dll
Removed! : C:\WINDOWS\System32\netxi32.exe
Removed! : C:\WINDOWS\System32\netyf32.dll
Removed! : C:\WINDOWS\System32\nfxop.dat
Removed! : C:\WINDOWS\System32\ntau32.dll
Removed! : C:\WINDOWS\System32\ntfi.dll
Removed! : C:\WINDOWS\System32\ntfx32.dll
Removed! : C:\WINDOWS\System32\nthu.dll
Removed! : C:\WINDOWS\System32\ntkc32.dll
Removed! : C:\WINDOWS\System32\ntrf.dll
Removed! : C:\WINDOWS\System32\ntym32.dll
Removed! : C:\WINDOWS\System32\nyqew.dat
Removed! : C:\WINDOWS\System32\oxeqe.dat
Removed! : C:\WINDOWS\System32\pnzml.dat
Removed! : C:\WINDOWS\System32\pqvyf.dat
Removed! : C:\WINDOWS\System32\pzfpe.dat
Removed! : C:\WINDOWS\System32\qcchi.dat
Removed! : C:\WINDOWS\System32\qcgma.dat
Removed! : C:\WINDOWS\System32\qjpng.dat
Removed! : C:\WINDOWS\System32\rytfj.dat
Removed! : C:\WINDOWS\System32\rytfj.dll
Removed! : C:\WINDOWS\System32\sdkcu32.dll
Removed! : C:\WINDOWS\System32\sdkdj32.dll
Removed! : C:\WINDOWS\System32\sdkip32.dll
Removed! : C:\WINDOWS\System32\sdkmj.dll
Removed! : C:\WINDOWS\System32\sdkph32.dll
Removed! : C:\WINDOWS\System32\sdkzc.dll
Removed! : C:\WINDOWS\System32\sdkzl32.dll
Removed! : C:\WINDOWS\System32\sxelx.dll
Removed! : C:\WINDOWS\System32\sysam.dll
Removed! : C:\WINDOWS\System32\sysbc32.dll
Removed! : C:\WINDOWS\System32\sysex32.dll
Removed! : C:\WINDOWS\System32\sysft32.dll
Removed! : C:\WINDOWS\System32\syshh32.exe
Removed! : C:\WINDOWS\System32\syshz32.dll
Removed! : C:\WINDOWS\System32\syskg.exe
Removed! : C:\WINDOWS\System32\sysku32.exe
Removed! : C:\WINDOWS\System32\sysky.dll
Removed! : C:\WINDOWS\System32\sysms32.exe
Removed! : C:\WINDOWS\System32\sysqu.dll
Removed! : C:\WINDOWS\System32\syswg.dll
Removed! : C:\WINDOWS\System32\tdqsn.dat
Removed! : C:\WINDOWS\System32\ubkss.dll
Removed! : C:\WINDOWS\System32\vgyma.dat
Removed! : C:\WINDOWS\System32\wfotn.dat
Removed! : C:\WINDOWS\System32\wfotn.dll
Removed! : C:\WINDOWS\System32\winkr32.dll
Removed! : C:\WINDOWS\System32\winkw.dll
Removed! : C:\WINDOWS\System32\winql.dll
Removed! : C:\WINDOWS\System32\winsi32.dll
Removed! : C:\WINDOWS\System32\wintn.exe
Removed! : C:\WINDOWS\System32\wnbrd.dat
Removed! : C:\WINDOWS\System32\wswch.dat
Removed! : C:\WINDOWS\System32\wygyn.dat
Removed! : C:\WINDOWS\System32\xfwcw.dll
Removed! : C:\WINDOWS\System32\xwhxv.dat
Removed! : C:\WINDOWS\System32\ybiua.dat
Removed! : C:\WINDOWS\System32\ybyva.dll
Removed! : C:\WINDOWS\System32\yvbtj.dll
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 26


Removed Data Streams:
C:\WINDOWS\addlo.dll:lacqo
C:\WINDOWS\javaoz.dll:izmwa
C:\WINDOWS\javapg32.dll:tbppx
C:\WINDOWS\javapz32.dll:vuaat
C:\WINDOWS\netsm32.dll:oeyrk
C:\WINDOWS\netss.dll:gerfe
C:\WINDOWS\nettc.dll:rfkkg
C:\WINDOWS\nettv32.dll:cgnvc
C:\WINDOWS\nettv32.dll:cgnvc
C:\WINDOWS\TWUNK_32.EXE:gfqln
C:\WINDOWS\unvise32qt.exe:zgjqp
C:\WINDOWS\WINNT.BMP:asdam


Attempted Clean Of Temp folder.
Pages Reset... Done!






Scanned at: 3:44:10 PM on: 5/31/2005


-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 26

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!
Logfile of HijackThis v1.99.1
Scan saved at 4:03:05 PM, on 5/31/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Advanced Browser\browser.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\addth32.exe
C:\WINDOWS\winho.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Blake\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F9CE4E9E-3BBE-0D76-2070-5593678A3953} - C:\WINDOWS\system32\crii.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Overnet] C:\Program Files\Overnet\Overnet.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [sdknb32.exe] C:\WINDOWS\system32\sdknb32.exe
O4 - HKLM\..\Run: [MPSExe] C:\Program Files\McAfee.com\MPS\mscifapp.exe /embedding
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [winho.exe] C:\WINDOWS\winho.exe
O4 - HKLM\..\RunOnce: [addth32.exe] C:\WINDOWS\system32\addth32.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Blake\Local Settings\Temp\{A2627B8C-D790-45E6-84D6-9C3F28913F17}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMREMIND.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11F#`I) - Unknown owner - C:\WINDOWS\atllq32.exe (file missing)
O23 - Service: McAfee AntiSpyware Real-Time Scanner (McAfeeAntiSpyware) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#6 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:11:35 AM

Posted 31 May 2005 - 07:46 PM

You have HijackThis running from a temporary or zip folder. Any backup files HJT creates during the repair process will not be secure if left in this folder.

Create a folder on the C: drive called "C:\HJT". You can do this by opening My Computer then double click on Local Disk (C:). In a clear area right click and select New then Folder and name it "HJT". Unzip HijackThis into this folder. Please delete any other copies of HijackThis and run HJT only from this new folder.


Click on Start, then Run, and type in regedit. Click on OK.
- Navigate to the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
- Expand 'Services'.
- In the list below 'Services', locate "11F#`I".
- Right click on it and select Delete.


Start HJT and click on the SCAN button. Put a check mark in front of the following lines if they still show:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wavfs.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing

O2 - BHO: Class - {F9CE4E9E-3BBE-0D76-2070-5593678A3953} - C:\WINDOWS\system32\crii.dll

O4 - HKLM\..\Run: [sdknb32.exe] C:\WINDOWS\system32\sdknb32.exe
O4 - HKLM\..\Run: [winho.exe] C:\WINDOWS\winho.exe
O4 - HKLM\..\RunOnce: [addth32.exe] C:\WINDOWS\system32\addth32.exe

O23 - Service: Remote Procedure Call (RPC) Helper ( 11F#`I) - Unknown owner - C:\WINDOWS\atllq32.exe (file missing)

With ALL OTHER WINDOWS CLOSED, click on Fix Checked.


Open Windows Explorer (Windows key+e), navigate to and delete the following files (Don't be concerned if they can not be found):

C:\WINDOWS\winho.exe
C:\WINDOWS\wavfs.dll
C:\WINDOWS\system32\crii.dll
C:\WINDOWS\system32\sdknb32.exe
C:\WINDOWS\system32\addth32.exe

If any of these resist being deleted, boot into Safe Mode and try from there.


Reboot and please post a fresh HJT log. Are we making progress?
Derfram
~~~~~~

#7 verybigtrees

verybigtrees
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:12:35 PM

Posted 01 June 2005 - 10:21 AM

Logfile of HijackThis v1.99.1
Scan saved at 10:17:02 AM, on 6/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Advanced Browser\browser.exe
C:\Documents and Settings\Blake\Local Settings\Temp\Temporary Directory 1 for hjt.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Overnet] C:\Program Files\Overnet\Overnet.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] C:\Program Files\McAfee.com\MPS\mscifapp.exe /embedding
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Blake\Local Settings\Temp\{A2627B8C-D790-45E6-84D6-9C3F28913F17}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMREMIND.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: McAfee AntiSpyware Real-Time Scanner (McAfeeAntiSpyware) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#8 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:11:35 AM

Posted 01 June 2005 - 11:51 AM

Log looks clean. How are things running?
Derfram
~~~~~~

#9 verybigtrees

verybigtrees
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Local time:12:35 PM

Posted 01 June 2005 - 12:13 PM

It does seem to be running much quicker. I want to thank you for helping, this is the second time yall helped me and I definantly plan to donate, thanks.

#10 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:11:35 AM

Posted 01 June 2005 - 12:17 PM

Log looks clean...great job!

Keep HijackThis along with it's backup folder for a bit just in case there arises a need for the backup files it has created. Any other tools we downloaded or files we created can be uninstalled or deleted. If we have enabled viewing of Hidden and System files, go back and re-hide these files.

If this is a Windows XP system: After you have used your machine a while, and are confident that all is well, we can do a little final cleanup.

Purge Restore points:

XP System Restore periodically creates a partial system backup. It is quite likely that some of the now removed malware has been 'backed up' in those files.

Disable System Restore by following the instructions here,
Reboot,
Re-enble System Restore by following the instructions here.

Run Disk Cleanup

Click on the Start button and then on Run. Type in cleanmgr then click on OK. Be sure the (C:) drive is selected and click OK. It may take a bit for "Compress old files" to complete. Check all the boxes and click on OK, then OK again.

Alternately, a more thorough Disk Cleanup utility can be downloaded:
http://downloads.stevengould.org/cleanup/CleanUp40.exe


Now that you are clean, please follow these steps in order to keep your computer safe and secure:

How did I get infected?, With steps so it does not happen again!
Simple and easy ways to keep your computer safe and secure on the Internet
Derfram
~~~~~~

#11 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,736 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:11:35 AM

Posted 09 June 2005 - 11:54 AM

Since your problem appears to be resolved, this thread will now be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.
Derfram
~~~~~~




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users