Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HijackThis Log: Please help diagnose.


  • This topic is locked This topic is locked
2 replies to this topic

#1 revenantkioku

revenantkioku

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:12 AM

Posted 10 August 2005 - 05:14 PM

Family friends are having a rough time with their PC, I did the standard treatment of adaware, spybot, and so on, but its still pretty ugly.
Here's the log:
Logfile of HijackThis v1.99.1
Scan saved at 6:08:35 PM, on 8/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\qbgmycc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\windows\system32\rpdxregq.exe
C:\WINDOWS\System32\4m3ve8pt.exe
C:\DOCUME~1\Andrew\LOCALS~1\Temp\sysnet.exe
C:\Program Files\CMAPP\Client\cmappclient.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\tsysrs2r.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lauren\Desktop\Crush Bugs plz thx bye\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.microsoft.com/isapi/redir.dll?p...er=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {04FAEA9D-08CA-34CB-E9A7-B82F264F457D} - C:\WINDOWS\System32\xaafhnji\demoqhdy.dll (file missing)
O2 - BHO: (no name) - {10B1DB98-FFF7-0C8D-06E3-0C527372D6B2} - C:\WINDOWS\System32\stlutesa\qvkaylvs.dll
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\Lauren\Desktop\CRUSHB~1\SPYBOT~1\SDHelper.dll
O2 - BHO: LANBridge Class - {71D1708F-973D-4600-AF01-AD86688403AE} - C:\WINDOWS\System32\lfvozohid.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: (no name) - {BEBC3FF2-CD81-A807-C1FC-3462F40CD3EB} - C:\WINDOWS\System32\fqfsvtmm\kcwtmrit.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\System32\richedtr.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Winsecure Antivirus] SECUREANTIVIRUS.EXE
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [5sof32X] daolegih.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [bwnsy] C:\WINDOWS\System32\ilqn\bwnsy.exe
O4 - HKLM\..\Run: [rcfg] C:\WINDOWS\System32\dlvvnpb\rcfg.exe
O4 - HKLM\..\Run: [lwhflqw] C:\WINDOWS\System32\xmon\lwhflqw.exe
O4 - HKLM\..\Run: [gtxafvna] C:\WINDOWS\System32\pgyj\gtxafvna.exe
O4 - HKLM\..\Run: [bdtoxu] C:\WINDOWS\System32\vuxesjl\bdtoxu.exe
O4 - HKLM\..\Run: [iipf] C:\WINDOWS\System32\mmucttch\iipf.exe
O4 - HKLM\..\Run: [pdwwmitq] C:\WINDOWS\System32\oqkjn\pdwwmitq.exe
O4 - HKLM\..\Run: [anbssi] C:\WINDOWS\System32\dyooi\anbssi.exe
O4 - HKLM\..\Run: [lprt] C:\WINDOWS\System32\yxlpagg\lprt.exe
O4 - HKLM\..\Run: [wqeer] C:\WINDOWS\System32\pfeyswhf\wqeer.exe
O4 - HKLM\..\Run: [wuwthwpq] C:\WINDOWS\System32\ttaxq\wuwthwpq.exe
O4 - HKLM\..\Run: [toelcwrt] C:\WINDOWS\System32\nqjev\toelcwrt.exe
O4 - HKLM\..\Run: [jdovl] C:\WINDOWS\System32\valhckq\jdovl.exe
O4 - HKLM\..\Run: [enpctfnv] C:\WINDOWS\System32\ufgxuu\enpctfnv.exe
O4 - HKLM\..\Run: [ymouuvc] C:\WINDOWS\System32\elmncnhe\ymouuvc.exe
O4 - HKLM\..\Run: [7I4CiZF5] C:\WINDOWS\kqwjgn.exe
O4 - HKLM\..\Run: [Tsl2] C:\PROGRA~1\COMMON~1\tsa\tsl2.exe
O4 - HKLM\..\Run: [oaklf] C:\WINDOWS\System32\ixnwv\oaklf.exe
O4 - HKLM\..\Run: [nauwgga] C:\WINDOWS\System32\ttcu\nauwgga.exe
O4 - HKLM\..\Run: [uecjskd] C:\WINDOWS\System32\xcdfj\uecjskd.exe
O4 - HKLM\..\Run: [kiou] C:\WINDOWS\System32\kolslxhu\kiou.exe
O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Megan\LOCALS~1\Temp\tfhul.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [ZStart] C:\windows\system32\rpdxregq.exe run32
O4 - HKLM\..\Run: [SysStart] C:\WINDOWS\System32\tsysrs2r.exe run32
O4 - HKLM\..\Run: [mddwqwf] C:\WINDOWS\System32\veswyxi\mddwqwf.exe
O4 - HKLM\..\Run: [cfbwj] C:\WINDOWS\System32\fsemo\cfbwj.exe
O4 - HKLM\..\Run: [lbuolnh] C:\WINDOWS\System32\ntbnfm\lbuolnh.exe
O4 - HKLM\..\Run: [eigr] C:\WINDOWS\System32\gbmyj\eigr.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Andrew\LOCALS~1\Temp\pgsytlx.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [4m3ve8pt] C:\WINDOWS\System32\4m3ve8pt.exe
O4 - HKLM\..\Run: [3tehh6re] C:\WINDOWS\System32\3tehh6re.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Andrew\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\System32\lanbrup.exe
O4 - HKLM\..\Run: [sjlxfsg] c:\windows\system32\qbgmycc.exe r
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [bootpd.exe] C:\WINDOWS\System32\bootpd.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\tsysrs2r.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\calsp.dll' missing
O12 - Plugin for .au: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971C...e/bridge-c8.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O16 - DPF: {C0B285F6-DB2B-4908-9C58-F6D95397D747} - http://www.pacimedia.com/install/pcs_0015.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: CWShredder Service - Unknown owner - K:\CWShredder.exe (file missing)
O23 - Service: gtxafvnapgyj - Unknown owner - C:\WINDOWS\System32\pgyj\gtxafvna.exe (file missing)
O23 - Service: kioukolslxhu - Unknown owner - C:\WINDOWS\System32\kolslxhu\kiou.exe (file missing)
O23 - Service: mddwqwfveswyxi - Unknown owner - C:\WINDOWS\System32\veswyxi\mddwqwf.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe
O23 - Service: wqeerpfeyswhf - Unknown owner - C:\WINDOWS\System32\pfeyswhf\wqeer.exe (file missing)
O23 - Service: ymouuvcelmncnhe - Unknown owner - C:\WINDOWS\System32\elmncnhe\ymouuvc.exe (file missing)

Thanks in advance.

BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:11:12 AM

Posted 11 August 2005 - 07:53 AM

Hello,
This sure is a nasty log. But it seems like most is already deleted, however, I'll let you doublecheck afterwards.

It's better to print out the next instructions or save it in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.
It is also important you don't miss a step and perform everything in the right order!!

Uninstall via add/remove next programs if still present:

LanBridge
SurfAccuracy
Tsa
WebRebates
Vbrundll


REBOOT afterwards.

* Download and install CCleaner
Do not use it yet.

* Download Nail/Aurora Spyware Fix
Do not use it yet.

* Download ewido security suite here: http://www.ewido.net/en/download/
Install and update it. Don't let it scan yet!!

Please set your system to show all files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.


* Reboot into Safe Mode`:
°To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key.

* Once in Safe Mode, please double-click on nailfix.exe. Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish". Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: (no name) - {04FAEA9D-08CA-34CB-E9A7-B82F264F457D} - C:\WINDOWS\System32\xaafhnji\demoqhdy.dll (file missing)
O2 - BHO: (no name) - {10B1DB98-FFF7-0C8D-06E3-0C527372D6B2} - C:\WINDOWS\System32\stlutesa\qvkaylvs.dll
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\System32\vbrundll.dll (file missing)
O2 - BHO: LANBridge Class - {71D1708F-973D-4600-AF01-AD86688403AE} - C:\WINDOWS\System32\lfvozohid.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: (no name) - {BEBC3FF2-CD81-A807-C1FC-3462F40CD3EB} - C:\WINDOWS\System32\fqfsvtmm\kcwtmrit.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\System32\richedtr.dll
O4 - HKLM\..\Run: [Winsecure Antivirus] SECUREANTIVIRUS.EXE
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [bwnsy] C:\WINDOWS\System32\ilqn\bwnsy.exe
O4 - HKLM\..\Run: [rcfg] C:\WINDOWS\System32\dlvvnpb\rcfg.exe
O4 - HKLM\..\Run: [lwhflqw] C:\WINDOWS\System32\xmon\lwhflqw.exe
O4 - HKLM\..\Run: [gtxafvna] C:\WINDOWS\System32\pgyj\gtxafvna.exe
O4 - HKLM\..\Run: [bdtoxu] C:\WINDOWS\System32\vuxesjl\bdtoxu.exe
O4 - HKLM\..\Run: [iipf] C:\WINDOWS\System32\mmucttch\iipf.exe
O4 - HKLM\..\Run: [pdwwmitq] C:\WINDOWS\System32\oqkjn\pdwwmitq.exe
O4 - HKLM\..\Run: [anbssi] C:\WINDOWS\System32\dyooi\anbssi.exe
O4 - HKLM\..\Run: [lprt] C:\WINDOWS\System32\yxlpagg\lprt.exe
O4 - HKLM\..\Run: [wqeer] C:\WINDOWS\System32\pfeyswhf\wqeer.exe
O4 - HKLM\..\Run: [wuwthwpq] C:\WINDOWS\System32\ttaxq\wuwthwpq.exe
O4 - HKLM\..\Run: [toelcwrt] C:\WINDOWS\System32\nqjev\toelcwrt.exe
O4 - HKLM\..\Run: [jdovl] C:\WINDOWS\System32\valhckq\jdovl.exe
O4 - HKLM\..\Run: [enpctfnv] C:\WINDOWS\System32\ufgxuu\enpctfnv.exe
O4 - HKLM\..\Run: [ymouuvc] C:\WINDOWS\System32\elmncnhe\ymouuvc.exe
O4 - HKLM\..\Run: [7I4CiZF5] C:\WINDOWS\kqwjgn.exe
O4 - HKLM\..\Run: [Tsl2] C:\PROGRA~1\COMMON~1\tsa\tsl2.exe
O4 - HKLM\..\Run: [oaklf] C:\WINDOWS\System32\ixnwv\oaklf.exe
O4 - HKLM\..\Run: [nauwgga] C:\WINDOWS\System32\ttcu\nauwgga.exe
O4 - HKLM\..\Run: [uecjskd] C:\WINDOWS\System32\xcdfj\uecjskd.exe
O4 - HKLM\..\Run: [kiou] C:\WINDOWS\System32\kolslxhu\kiou.exe
O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Megan\LOCALS~1\Temp\tfhul.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [ZStart] C:\windows\system32\rpdxregq.exe run32
O4 - HKLM\..\Run: [SysStart] C:\WINDOWS\System32\tsysrs2r.exe run32
O4 - HKLM\..\Run: [mddwqwf] C:\WINDOWS\System32\veswyxi\mddwqwf.exe
O4 - HKLM\..\Run: [cfbwj] C:\WINDOWS\System32\fsemo\cfbwj.exe
O4 - HKLM\..\Run: [lbuolnh] C:\WINDOWS\System32\ntbnfm\lbuolnh.exe
O4 - HKLM\..\Run: [eigr] C:\WINDOWS\System32\gbmyj\eigr.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Andrew\LOCALS~1\Temp\pgsytlx.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [4m3ve8pt] C:\WINDOWS\System32\4m3ve8pt.exe
O4 - HKLM\..\Run: [3tehh6re] C:\WINDOWS\System32\3tehh6re.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Andrew\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\System32\lanbrup.exe
O4 - HKLM\..\Run: [sjlxfsg] c:\windows\system32\qbgmycc.exe r
O4 - HKCU\..\Run: [bootpd.exe] C:\WINDOWS\System32\bootpd.exe
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\tsysrs2r.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971C...e/bridge-c8.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O16 - DPF: {C0B285F6-DB2B-4908-9C58-F6D95397D747} - http://www.pacimedia.com/install/pcs_0015.exe
O23 - Service: CWShredder Service - Unknown owner - K:\CWShredder.exe (file missing)
O23 - Service: gtxafvnapgyj - Unknown owner - C:\WINDOWS\System32\pgyj\gtxafvna.exe (file missing)
O23 - Service: kioukolslxhu - Unknown owner - C:\WINDOWS\System32\kolslxhu\kiou.exe (file missing)
O23 - Service: mddwqwfveswyxi - Unknown owner - C:\WINDOWS\System32\veswyxi\mddwqwf.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe
O23 - Service: wqeerpfeyswhf - Unknown owner - C:\WINDOWS\System32\pfeyswhf\wqeer.exe (file missing)
O23 - Service: ymouuvcelmncnhe - Unknown owner - C:\WINDOWS\System32\elmncnhe\ymouuvc.exe (file missing)


* Click on Fix Checked when finished and exit HijackThis.

* Using Windows Explorer, locate the following folders, and delete them if still present:

C:\WINDOWS\System32\xaafhnji
C:\WINDOWS\System32\stlutesa
C:\WINDOWS\System32\fqfsvtmm
C:\WINDOWS\System32\ilqn
C:\WINDOWS\System32\dlvvnpb
C:\WINDOWS\System32\xmon
C:\WINDOWS\System32\pgyj
C:\WINDOWS\System32\vuxesjl
C:\WINDOWS\System32\mmucttch
C:\WINDOWS\System32\oqkjn
C:\WINDOWS\System32\dyooi
C:\WINDOWS\System32\yxlpagg
C:\WINDOWS\System32\ttaxq
C:\WINDOWS\System32\nqjev
C:\WINDOWS\System32\valhckq
C:\WINDOWS\System32\ufgxuu
C:\WINDOWS\System32\ixnwv
C:\WINDOWS\System32\ttcu
C:\WINDOWS\System32\xcdfj
C:\WINDOWS\System32\veswyxi
C:\WINDOWS\System32\fsemo
C:\WINDOWS\System32\ntbnfm
C:\WINDOWS\System32\gbmyj
C:\Program Files\SurfAccuracy
C:\WINDOWS\System32\pgyj
C:\WINDOWS\System32\kolslxhu
C:\WINDOWS\System32\veswyxi
C:\WINDOWS\System32\pfeyswhf
C:\WINDOWS\System32\elmncnhe
C:\Program Files\Web_Rebates
C:\Program Files\SurfAccuracy
C:\Program Files\CMAPP
C:\PROGRAM FILES\COMMON FILES\WinTools
C:\PROGRAM FILES\COMMON FILES\tsa

* Using Windows Explorer, locate the following files, and delete them if still present:

c:\windows\redir.txt
c:\windows\dsr.exe
c:\windows\dinst.exe
c:\windows\dsr.dll
C:\windows\system32\rpdxregq.exe
C:\WINDOWS\System32\4m3ve8pt.exe
C:\WINDOWS\System32\tsysrs2r.exe
C:\WINDOWS\cfgmgr52.dll
C:\WINDOWS\System32\pacis.exe
C:\WINDOWS\System32\gah95on6.exe
C:\WINDOWS\kqwjgn.exe
C:\WINDOWS\System32\3tehh6re.exe
C:\WINDOWS\System32\richup.exe
C:\WINDOWS\System32\lanbrup.exe
C:\WINDOWS\System32\lanbruns.exe
C:\WINDOWS\System32\wirelanb.dll
C:\WINDOWS\System32\bootpd.exe

* Run Ccleaner and click Run Cleaner (bottom right)

* Go to start > run and copy next in the field, line by line:

sc delete ymouuvcelmncnhe click OK
sc delete wqeerpfeyswhf click OK
sc delete mddwqwfveswyxi click OK
sc delete kioukolslxhu click OK
sc delete gtxafvnapgyj click OK

* Still in safe mode; open Ewido Security Suite
Click on scanner

* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop
Close Ewido

* Reboot your system back to normal mode.

Post a new HijackThis Log and the Ewido Log by using Add Reply.
Let us know if any problems persist.

Edited by miekiemoes, 11 August 2005 - 07:54 AM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:11:12 AM

Posted 22 August 2005 - 06:59 AM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users