Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Pop-ups, Major Lag, And New Browser Homepages


  • This topic is locked This topic is locked
16 replies to this topic

#1 EvanTheMagician

EvanTheMagician

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 16 June 2007 - 08:33 AM

I am having major lag, many pop-ups, and new homepages on my Firefox, and IE. Below is my HijackThis log. I appreciate all of your help. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 9:31:20 AM, on 6/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\All Users\Application Data\szarkrmf.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Evan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOfficeUpdate?clid=1033
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Program Files\Power Translator\Applications\LEC IE Translation Extension.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [command] C:\WINDOWS\SYSTEM32\command.exe
O4 - HKLM\..\Run: [cmd64] C:\WINDOWS\SYSTEM32\cmd64.exe
O4 - HKLM\..\Run: [wzcpbf] C:\WINDOWS\system32\wzcpbf.exe
O4 - HKLM\..\Run: [irxd] C:\WINDOWS\system32\irxd.exe
O4 - HKLM\..\Run: [js] C:\WINDOWS\system32\js.exe
O4 - HKLM\..\Run: [osxrtdkcor] C:\WINDOWS\system32\osxrtdkcor.exe
O4 - HKLM\..\Run: [esc] C:\WINDOWS\system32\esc.exe
O4 - HKLM\..\Run: [qyhrxahab] C:\WINDOWS\system32\qyhrxahab.exe
O4 - HKLM\..\Run: [iqykub] C:\WINDOWS\system32\iqykub.exe
O4 - HKLM\..\Run: [phnyd] C:\WINDOWS\system32\phnyd.exe
O4 - HKLM\..\Run: [mxejwwh] C:\WINDOWS\system32\mxejwwh.exe
O4 - HKLM\..\Run: [c] C:\WINDOWS\system32\c.exe
O4 - HKLM\..\Run: [dsukaswovuib] C:\WINDOWS\system32\dsukaswovuib.exe
O4 - HKLM\..\Run: [xzbivknrqv] C:\WINDOWS\system32\xzbivknrqv.exe
O4 - HKLM\..\Run: [kjih] C:\WINDOWS\system32\kjih.exe
O4 - HKLM\..\Run: [iiomyvty] C:\WINDOWS\system32\iiomyvty.exe
O4 - HKLM\..\Run: [dwgewamyby] C:\WINDOWS\system32\dwgewamyby.exe
O4 - HKLM\..\Run: [fkfwtnhhbcg] C:\WINDOWS\system32\fkfwtnhhbcg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [wocy] C:\WINDOWS\system32\wocy.exe
O4 - HKLM\..\Run: [pvtp] C:\WINDOWS\system32\pvtp.exe
O4 - HKLM\..\Run: [fyzrh] C:\WINDOWS\system32\fyzrh.exe
O4 - HKLM\..\Run: [hrddgynimy] C:\WINDOWS\system32\hrddgynimy.exe
O4 - HKLM\..\Run: [negpohuztnx] C:\WINDOWS\system32\negpohuztnx.exe
O4 - HKLM\..\Run: [lsw] C:\WINDOWS\system32\lsw.exe
O4 - HKLM\..\Run: [bm] C:\WINDOWS\system32\bm.exe
O4 - HKLM\..\Run: [wkmdeq] C:\WINDOWS\system32\wkmdeq.exe
O4 - HKLM\..\Run: [sdtbik] C:\WINDOWS\system32\sdtbik.exe
O4 - HKLM\..\Run: [ojnrrlbczspb] C:\WINDOWS\system32\ojnrrlbczspb.exe
O4 - HKLM\..\Run: [dxexazjijgsa] C:\WINDOWS\system32\dxexazjijgsa.exe
O4 - HKLM\..\Run: [sk] C:\WINDOWS\system32\sk.exe
O4 - HKLM\..\Run: [ka] C:\WINDOWS\system32\ka.exe
O4 - HKLM\..\Run: [gftc] C:\WINDOWS\system32\gftc.exe
O4 - HKLM\..\Run: [cdnriuapcayq] C:\WINDOWS\system32\cdnriuapcayq.exe
O4 - HKLM\..\Run: [ab] C:\WINDOWS\system32\ab.exe
O4 - HKLM\..\Run: [y] C:\WINDOWS\system32\y.exe
O4 - HKLM\..\Run: [vvbspmfa] C:\WINDOWS\system32\vvbspmfa.exe
O4 - HKLM\..\Run: [t] C:\WINDOWS\system32\t.exe
O4 - HKLM\..\Run: [hvsbquk] C:\WINDOWS\system32\hvsbquk.exe
O4 - HKLM\..\Run: [vguiayywhwgl] C:\WINDOWS\system32\vguiayywhwgl.exe
O4 - HKLM\..\Run: [cdxmwtx] C:\WINDOWS\system32\cdxmwtx.exe
O4 - HKLM\..\Run: [lfrnkn] C:\WINDOWS\system32\lfrnkn.exe
O4 - HKLM\..\Run: [brpwknz] C:\WINDOWS\system32\brpwknz.exe
O4 - HKLM\..\Run: [wbxuqxhpoke] C:\WINDOWS\system32\wbxuqxhpoke.exe
O4 - HKLM\..\Run: [vuodlrc] C:\WINDOWS\system32\vuodlrc.exe
O4 - HKLM\..\Run: [zrhgzewnd] C:\WINDOWS\system32\zrhgzewnd.exe
O4 - HKLM\..\Run: [q] C:\WINDOWS\system32\q.exe
O4 - HKLM\..\Run: [mltylxqha] C:\WINDOWS\system32\mltylxqha.exe
O4 - HKLM\..\Run: [jyrat] C:\WINDOWS\system32\jyrat.exe
O4 - HKLM\..\Run: [jnyftim] C:\WINDOWS\system32\jnyftim.exe
O4 - HKLM\..\Run: [txllzoepgqpr] C:\WINDOWS\system32\txllzoepgqpr.exe
O4 - HKLM\..\Run: [lkueyabqi] C:\WINDOWS\system32\lkueyabqi.exe
O4 - HKLM\..\Run: [cmscbyacu] C:\WINDOWS\system32\cmscbyacu.exe
O4 - HKLM\..\Run: [gwuqxg] C:\WINDOWS\system32\gwuqxg.exe
O4 - HKLM\..\Run: [r] C:\WINDOWS\system32\r.exe
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [szarkrmf.exe] C:\Documents and Settings\All Users\Application Data\szarkrmf.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000272.exe 61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [smgr] smgr.exe
O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\xbmbkons.dll",realset
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab
O16 - DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} (Photosynth Class) - http://media.labs.live.com/all/ps/_code_/Photosynth.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Print Spooler Service (ae4ezyaeyormd) - Unknown owner - C:\WINDOWS\system32\m.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbt_device - Unknown owner - C:\WINDOWS\system32\dlbtcoms.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Machine Debug (MDM_SVC) - Unknown owner - C:\WINDOWS\pchealth\mdm.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

BC AdBot (Login to Remove)

 


#2 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 16 June 2007 - 11:54 AM

Hello there and welcome to BleepingComputer. My name is Charles and I will be dealing with your log today.
You have quite a heavily infected computer, it is likely that we will need to perform a few scans before you will be completely clean from malware, so please bear with me.

Please move HijackThis to a permanent folder. Anywhere is fine, other than your Desktop or a temporary folder. If it is in one of these locations, there is a risk that you may accidentally delete the backups; which may be needed if we fix something we're not meant to.
If you use Windows XP it may be that you just double clicked on the HijackThis.exe file, but this only extracts the file to a temporary folder. If you right click on it and select Extract, you can choose a folder to place it in.

How to make a permanent folder:
Click Start | My Computer | Local Disk (C: ) | Program Files.
In the menu bar at the top, go to File | New | Folder.
That will create a folder named "New Folder", which you can rename to "HijackThis". You have now created C:\Program Files\HijackThis.
Now get your HijackThis.exe file and place it in your folder.
Right-click on HijackThis.exe.
Select "Rename", call it fluffybunny and press enter.
Use fluffybunny.exe from now on.

Please download VundoFix to your Desktop.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt in your next reply.
Note: It is possible that VundoFix encountered a file it could not remove.
VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

Please include VundoFix.txt and a new HijackThis log in your next reply.
Thanks,
Charles

Edited by rookie147, 16 June 2007 - 11:55 AM.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#3 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 16 June 2007 - 01:44 PM

I did what you've said so far and below is my VundoFix Text followed by the HJT Log. Thanks!


VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 1:44:24 PM 6/16/2007

Listing files found while scanning....

C:\WINDOWS\system32\gebaayw.dll
C:\WINDOWS\system32\hhkmp.bak1
C:\WINDOWS\system32\hhkmp.bak2
C:\WINDOWS\system32\hhkmp.ini
C:\WINDOWS\system32\pmkhh.dll
C:\windows\system32\ssqroli.dll
C:\windows\system32\ttutv.ini
C:\windows\system32\vtutt.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\gebaayw.dll
C:\WINDOWS\system32\gebaayw.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\hhkmp.bak1
C:\WINDOWS\system32\hhkmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\hhkmp.bak2
C:\WINDOWS\system32\hhkmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\hhkmp.ini
C:\WINDOWS\system32\hhkmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmkhh.dll
C:\WINDOWS\system32\pmkhh.dll Has been deleted!

Attempting to delete C:\windows\system32\ssqroli.dll
C:\windows\system32\ssqroli.dll Has been deleted!

Attempting to delete C:\windows\system32\ttutv.ini
C:\windows\system32\ttutv.ini Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\gebaayw.dll
C:\WINDOWS\system32\gebaayw.dll Has been deleted!

Performing Repairs to the registry.
Done!


AND MY HJT LOG:

Logfile of HijackThis v1.99.1
Scan saved at 2:43:53 PM, on 6/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\All Users\Application Data\szarkrmf.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\fluffybunny.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOfficeUpdate?clid=1033
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4C7CD69E-926A-4706-A4F8-90B4A9A93E32} - C:\WINDOWS\system32\pmkhh.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\yonbbnwx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7FF279EE-47FA-4EDF-9BE8-EC266AF22519} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Program Files\Power Translator\Applications\LEC IE Translation Extension.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [command] C:\WINDOWS\SYSTEM32\command.exe
O4 - HKLM\..\Run: [cmd64] C:\WINDOWS\SYSTEM32\cmd64.exe
O4 - HKLM\..\Run: [wzcpbf] C:\WINDOWS\system32\wzcpbf.exe
O4 - HKLM\..\Run: [irxd] C:\WINDOWS\system32\irxd.exe
O4 - HKLM\..\Run: [js] C:\WINDOWS\system32\js.exe
O4 - HKLM\..\Run: [osxrtdkcor] C:\WINDOWS\system32\osxrtdkcor.exe
O4 - HKLM\..\Run: [esc] C:\WINDOWS\system32\esc.exe
O4 - HKLM\..\Run: [qyhrxahab] C:\WINDOWS\system32\qyhrxahab.exe
O4 - HKLM\..\Run: [iqykub] C:\WINDOWS\system32\iqykub.exe
O4 - HKLM\..\Run: [phnyd] C:\WINDOWS\system32\phnyd.exe
O4 - HKLM\..\Run: [mxejwwh] C:\WINDOWS\system32\mxejwwh.exe
O4 - HKLM\..\Run: [c] C:\WINDOWS\system32\c.exe
O4 - HKLM\..\Run: [dsukaswovuib] C:\WINDOWS\system32\dsukaswovuib.exe
O4 - HKLM\..\Run: [xzbivknrqv] C:\WINDOWS\system32\xzbivknrqv.exe
O4 - HKLM\..\Run: [kjih] C:\WINDOWS\system32\kjih.exe
O4 - HKLM\..\Run: [iiomyvty] C:\WINDOWS\system32\iiomyvty.exe
O4 - HKLM\..\Run: [dwgewamyby] C:\WINDOWS\system32\dwgewamyby.exe
O4 - HKLM\..\Run: [fkfwtnhhbcg] C:\WINDOWS\system32\fkfwtnhhbcg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [wocy] C:\WINDOWS\system32\wocy.exe
O4 - HKLM\..\Run: [pvtp] C:\WINDOWS\system32\pvtp.exe
O4 - HKLM\..\Run: [fyzrh] C:\WINDOWS\system32\fyzrh.exe
O4 - HKLM\..\Run: [hrddgynimy] C:\WINDOWS\system32\hrddgynimy.exe
O4 - HKLM\..\Run: [negpohuztnx] C:\WINDOWS\system32\negpohuztnx.exe
O4 - HKLM\..\Run: [lsw] C:\WINDOWS\system32\lsw.exe
O4 - HKLM\..\Run: [bm] C:\WINDOWS\system32\bm.exe
O4 - HKLM\..\Run: [wkmdeq] C:\WINDOWS\system32\wkmdeq.exe
O4 - HKLM\..\Run: [sdtbik] C:\WINDOWS\system32\sdtbik.exe
O4 - HKLM\..\Run: [ojnrrlbczspb] C:\WINDOWS\system32\ojnrrlbczspb.exe
O4 - HKLM\..\Run: [dxexazjijgsa] C:\WINDOWS\system32\dxexazjijgsa.exe
O4 - HKLM\..\Run: [sk] C:\WINDOWS\system32\sk.exe
O4 - HKLM\..\Run: [ka] C:\WINDOWS\system32\ka.exe
O4 - HKLM\..\Run: [gftc] C:\WINDOWS\system32\gftc.exe
O4 - HKLM\..\Run: [cdnriuapcayq] C:\WINDOWS\system32\cdnriuapcayq.exe
O4 - HKLM\..\Run: [ab] C:\WINDOWS\system32\ab.exe
O4 - HKLM\..\Run: [y] C:\WINDOWS\system32\y.exe
O4 - HKLM\..\Run: [vvbspmfa] C:\WINDOWS\system32\vvbspmfa.exe
O4 - HKLM\..\Run: [t] C:\WINDOWS\system32\t.exe
O4 - HKLM\..\Run: [hvsbquk] C:\WINDOWS\system32\hvsbquk.exe
O4 - HKLM\..\Run: [vguiayywhwgl] C:\WINDOWS\system32\vguiayywhwgl.exe
O4 - HKLM\..\Run: [cdxmwtx] C:\WINDOWS\system32\cdxmwtx.exe
O4 - HKLM\..\Run: [lfrnkn] C:\WINDOWS\system32\lfrnkn.exe
O4 - HKLM\..\Run: [brpwknz] C:\WINDOWS\system32\brpwknz.exe
O4 - HKLM\..\Run: [wbxuqxhpoke] C:\WINDOWS\system32\wbxuqxhpoke.exe
O4 - HKLM\..\Run: [vuodlrc] C:\WINDOWS\system32\vuodlrc.exe
O4 - HKLM\..\Run: [zrhgzewnd] C:\WINDOWS\system32\zrhgzewnd.exe
O4 - HKLM\..\Run: [q] C:\WINDOWS\system32\q.exe
O4 - HKLM\..\Run: [mltylxqha] C:\WINDOWS\system32\mltylxqha.exe
O4 - HKLM\..\Run: [jyrat] C:\WINDOWS\system32\jyrat.exe
O4 - HKLM\..\Run: [jnyftim] C:\WINDOWS\system32\jnyftim.exe
O4 - HKLM\..\Run: [txllzoepgqpr] C:\WINDOWS\system32\txllzoepgqpr.exe
O4 - HKLM\..\Run: [lkueyabqi] C:\WINDOWS\system32\lkueyabqi.exe
O4 - HKLM\..\Run: [cmscbyacu] C:\WINDOWS\system32\cmscbyacu.exe
O4 - HKLM\..\Run: [gwuqxg] C:\WINDOWS\system32\gwuqxg.exe
O4 - HKLM\..\Run: [r] C:\WINDOWS\system32\r.exe
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [szarkrmf.exe] C:\Documents and Settings\All Users\Application Data\szarkrmf.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [smgr] smgr.exe
O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\xbmbkons.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab
O16 - DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} (Photosynth Class) - http://media.labs.live.com/all/ps/_code_/Photosynth.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: winbue32 - winbue32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbt_device - Unknown owner - C:\WINDOWS\system32\dlbtcoms.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Machine Debug (MDM_SVC) - Unknown owner - C:\WINDOWS\pchealth\mdm.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#4 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 16 June 2007 - 01:57 PM

Hi again,
I'd like to take a look at one of the files you have on your computer.
Go to this page.
Where it says "Browse to the file you want to submit", copy and paste the filepath below into the box:

C:\WINDOWS\system32\negpohuztnx.exe

Then click the Send File button below.

Please let me know when you have done so.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#5 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 16 June 2007 - 02:18 PM

I sent the file, Charles!

#6 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 16 June 2007 - 04:30 PM

Thanks, I'll take a look at it and get back to you as soon as I can.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#7 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 16 June 2007 - 04:41 PM

Ok, look forward to hearing from you soon.

#8 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 16 June 2007 - 04:49 PM

Hello there,
Please print off a copy of these instructions, and also save them to a Notepad file on your desktop, so they are easily accessible.
We are going to boot into Safe Mode later in the fix, and there is no internet access.

Please download AVG Anti-Spyware to your Desktop.
Start the set-up program by double clicking the installer.
Follow the on screen instructions to install the program, making sure that "Launch AVG Anti-Spyware" is checked.
Click the Update tab then select Start update; a progress bar will show the updates being installed.
Now press the Scanner icon, and click the Settings tab.
Click Recommended actions, then set it to Quarantine.
Close the program now, we will scan with it later on.

Download ATF Cleaner to your Desktop.
Don't run it yet.

Scan again with HijackThis and put a checkmark next to each of the following entries (if present):

O2 - BHO: (no name) - {4C7CD69E-926A-4706-A4F8-90B4A9A93E32} - C:\WINDOWS\system32\pmkhh.dll (file missing)
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\yonbbnwx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7FF279EE-47FA-4EDF-9BE8-EC266AF22519} - (no file)
O4 - HKLM\..\Run: [command] C:\WINDOWS\SYSTEM32\command.exe
O4 - HKLM\..\Run: [cmd64] C:\WINDOWS\SYSTEM32\cmd64.exe
O4 - HKLM\..\Run: [wzcpbf] C:\WINDOWS\system32\wzcpbf.exe
O4 - HKLM\..\Run: [irxd] C:\WINDOWS\system32\irxd.exe
O4 - HKLM\..\Run: [js] C:\WINDOWS\system32\js.exe
O4 - HKLM\..\Run: [osxrtdkcor] C:\WINDOWS\system32\osxrtdkcor.exe
O4 - HKLM\..\Run: [esc] C:\WINDOWS\system32\esc.exe
O4 - HKLM\..\Run: [qyhrxahab] C:\WINDOWS\system32\qyhrxahab.exe
O4 - HKLM\..\Run: [iqykub] C:\WINDOWS\system32\iqykub.exe
O4 - HKLM\..\Run: [phnyd] C:\WINDOWS\system32\phnyd.exe
O4 - HKLM\..\Run: [mxejwwh] C:\WINDOWS\system32\mxejwwh.exe
O4 - HKLM\..\Run: [c] C:\WINDOWS\system32\c.exe
O4 - HKLM\..\Run: [dsukaswovuib] C:\WINDOWS\system32\dsukaswovuib.exe
O4 - HKLM\..\Run: [xzbivknrqv] C:\WINDOWS\system32\xzbivknrqv.exe
O4 - HKLM\..\Run: [kjih] C:\WINDOWS\system32\kjih.exe
O4 - HKLM\..\Run: [iiomyvty] C:\WINDOWS\system32\iiomyvty.exe
O4 - HKLM\..\Run: [dwgewamyby] C:\WINDOWS\system32\dwgewamyby.exe
O4 - HKLM\..\Run: [fkfwtnhhbcg] C:\WINDOWS\system32\fkfwtnhhbcg.exe
O4 - HKLM\..\Run: [wocy] C:\WINDOWS\system32\wocy.exe
O4 - HKLM\..\Run: [pvtp] C:\WINDOWS\system32\pvtp.exe
O4 - HKLM\..\Run: [fyzrh] C:\WINDOWS\system32\fyzrh.exe
O4 - HKLM\..\Run: [hrddgynimy] C:\WINDOWS\system32\hrddgynimy.exe
O4 - HKLM\..\Run: [negpohuztnx] C:\WINDOWS\system32\negpohuztnx.exe
O4 - HKLM\..\Run: [lsw] C:\WINDOWS\system32\lsw.exe
O4 - HKLM\..\Run: [bm] C:\WINDOWS\system32\bm.exe
O4 - HKLM\..\Run: [wkmdeq] C:\WINDOWS\system32\wkmdeq.exe
O4 - HKLM\..\Run: [sdtbik] C:\WINDOWS\system32\sdtbik.exe
O4 - HKLM\..\Run: [ojnrrlbczspb] C:\WINDOWS\system32\ojnrrlbczspb.exe
O4 - HKLM\..\Run: [dxexazjijgsa] C:\WINDOWS\system32\dxexazjijgsa.exe
O4 - HKLM\..\Run: [sk] C:\WINDOWS\system32\sk.exe
O4 - HKLM\..\Run: [ka] C:\WINDOWS\system32\ka.exe
O4 - HKLM\..\Run: [gftc] C:\WINDOWS\system32\gftc.exe
O4 - HKLM\..\Run: [cdnriuapcayq] C:\WINDOWS\system32\cdnriuapcayq.exe
O4 - HKLM\..\Run: [ab] C:\WINDOWS\system32\ab.exe
O4 - HKLM\..\Run: [y] C:\WINDOWS\system32\y.exe
O4 - HKLM\..\Run: [vvbspmfa] C:\WINDOWS\system32\vvbspmfa.exe
O4 - HKLM\..\Run: [t] C:\WINDOWS\system32\t.exe
O4 - HKLM\..\Run: [hvsbquk] C:\WINDOWS\system32\hvsbquk.exe
O4 - HKLM\..\Run: [vguiayywhwgl] C:\WINDOWS\system32\vguiayywhwgl.exe
O4 - HKLM\..\Run: [cdxmwtx] C:\WINDOWS\system32\cdxmwtx.exe
O4 - HKLM\..\Run: [lfrnkn] C:\WINDOWS\system32\lfrnkn.exe
O4 - HKLM\..\Run: [brpwknz] C:\WINDOWS\system32\brpwknz.exe
O4 - HKLM\..\Run: [wbxuqxhpoke] C:\WINDOWS\system32\wbxuqxhpoke.exe
O4 - HKLM\..\Run: [vuodlrc] C:\WINDOWS\system32\vuodlrc.exe
O4 - HKLM\..\Run: [zrhgzewnd] C:\WINDOWS\system32\zrhgzewnd.exe
O4 - HKLM\..\Run: [q] C:\WINDOWS\system32\q.exe
O4 - HKLM\..\Run: [mltylxqha] C:\WINDOWS\system32\mltylxqha.exe
O4 - HKLM\..\Run: [jyrat] C:\WINDOWS\system32\jyrat.exe
O4 - HKLM\..\Run: [jnyftim] C:\WINDOWS\system32\jnyftim.exe
O4 - HKLM\..\Run: [txllzoepgqpr] C:\WINDOWS\system32\txllzoepgqpr.exe
O4 - HKLM\..\Run: [lkueyabqi] C:\WINDOWS\system32\lkueyabqi.exe
O4 - HKLM\..\Run: [cmscbyacu] C:\WINDOWS\system32\cmscbyacu.exe
O4 - HKLM\..\Run: [gwuqxg] C:\WINDOWS\system32\gwuqxg.exe
O4 - HKLM\..\Run: [r] C:\WINDOWS\system32\r.exe
O4 - HKLM\..\Run: [szarkrmf.exe] C:\Documents and Settings\All Users\Application Data\szarkrmf.exe
O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\xbmbkons.dll",realset
O20 - Winlogon Notify: winbue32 - winbue32.dll (file missing)


Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix checked button.

Download KillBox from the following link :
http://www.bleepingcomputer.com/files/killbox.php
Unzip the folder to your desktop.

Start Killbox.exe
Select the "Delete on Reboot" option.
Click on the "All Files" button (!important!),which will then flash green.
Copy the complete text in bold below to the clipboard by highlighting the filepaths and pressing Control + C:

C:\WINDOWS\SYSTEM32\cmd64.exe
C:\WINDOWS\system32\wzcpbf.exe
C:\WINDOWS\system32\irxd.exe
C:\WINDOWS\system32\js.exe
C:\WINDOWS\system32\osxrtdkcor.exe
C:\WINDOWS\system32\esc.exe
C:\WINDOWS\system32\qyhrxahab.exe
C:\WINDOWS\system32\iqykub.exe
C:\WINDOWS\system32\phnyd.exe
C:\WINDOWS\system32\mxejwwh.exe
C:\WINDOWS\system32\c.exe
C:\WINDOWS\system32\dsukaswovuib.exe
C:\WINDOWS\system32\xzbivknrqv.exe
C:\WINDOWS\system32\kjih.exe
C:\WINDOWS\system32\iiomyvty.exe
C:\WINDOWS\system32\dwgewamyby.exe
C:\WINDOWS\system32\fkfwtnhhbcg.exe
C:\WINDOWS\system32\wocy.exe
C:\WINDOWS\system32\pvtp.exe
C:\WINDOWS\system32\fyzrh.exe
C:\WINDOWS\system32\hrddgynimy.exe
C:\WINDOWS\system32\negpohuztnx.exe
C:\WINDOWS\system32\lsw.exe
C:\WINDOWS\system32\bm.exe
C:\WINDOWS\system32\wkmdeq.exe
C:\WINDOWS\system32\sdtbik.exe
C:\WINDOWS\system32\ojnrrlbczspb.exe
C:\WINDOWS\system32\dxexazjijgsa.exe
C:\WINDOWS\system32\sk.exe
C:\WINDOWS\system32\ka.exe
C:\WINDOWS\system32\gftc.exe
C:\WINDOWS\system32\cdnriuapcayq.exe
C:\WINDOWS\system32\ab.exe
C:\WINDOWS\system32\y.exe
C:\WINDOWS\system32\vvbspmfa.exe
C:\WINDOWS\system32\t.exe
C:\WINDOWS\system32\hvsbquk.exe
C:\WINDOWS\system32\vguiayywhwgl.exe
C:\WINDOWS\system32\cdxmwtx.exe
C:\WINDOWS\system32\lfrnkn.exe
C:\WINDOWS\system32\brpwknz.exe
C:\WINDOWS\system32\wbxuqxhpoke.exe
C:\WINDOWS\system32\vuodlrc.exe
C:\WINDOWS\system32\zrhgzewnd.exe
C:\WINDOWS\system32\q.exe
C:\WINDOWS\system32\mltylxqha.exe
C:\WINDOWS\system32\jyrat.exe
C:\WINDOWS\system32\jnyftim.exe
C:\WINDOWS\system32\txllzoepgqpr.exe
C:\WINDOWS\system32\lkueyabqi.exe
C:\WINDOWS\system32\cmscbyacu.exe
C:\WINDOWS\system32\gwuqxg.exe
C:\WINDOWS\system32\r.exe
C:\Documents and Settings\All Users\Application Data\szarkrmf.exe
C:\WINDOWS\system32\scchk32.exe
C:\WINDOWS\system32\xbmbkons.dll


Open 'file' in the killbox menu on top and choose Paste from clipboard
You must use the file menu--pasting by right-clicking the mouse will only enter one file.
Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to reboot now, click "yes".
Click OK at any Pending File Rename Operations prompts, let me know if there appear.
Your computer should reboot now, please reboot into Safe Mode by pressing F8 at boot/Windows startup, usually right after the beep.
Then select Safe Mode from the list.
Make sure you choose the option without Networking Support.

Double click ATF-Cleaner.exe to run the program.
Under Main choose Select All
Click the Empty Selected button.

If you use Firefox browser
Click Firefox at the top and choose Select All
Click the Empty Selected button.
Note: If you would like to keep your saved passwords, please click "No" at the prompt.

If you use Opera browser
Click Opera at the top and choose: Select All
Click the Empty Selected button.
Note: If you would like to keep your saved passwords, please click "No" at the prompt.

Click Exit on the main menu to close the program.

Launch AVG Anti-Spyware by double clicking the icon on your Desktop.
Press the Scanner icon.
Then click on the Complete System Scan button.
If any infections are found, you will be asked for an action; select Apply all actions.
Now press the Reports icon at the top.
Choose Save report as and save the text file to your Desktop.
Please post this log in your next reply.

Reboot into Normal Mode again.

Scan once more with HijackThis and post back the log, along with the AVG report.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#9 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 16 June 2007 - 08:49 PM

Charles, the scan was running for two plus hours and suddenly my laptop shut down, so that scan has to restart. Also, I had to run he scan in normal mode the second time around because it would'vd taken literally days to scan in Safe Mode- I hope that is okay. I will hopefully post the results by tomorrow.

Edited by EvanTheMagician, 16 June 2007 - 08:52 PM.


#10 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 17 June 2007 - 04:50 AM

Yes, that's fine. :thumbsup:
I await your reply ...

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#11 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 17 June 2007 - 08:28 AM

Below is HJT LOG: pLogfile of HijackThis v1.99.1
Scan saved at 9:27:45 AM, on 6/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\fluffybunny.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://r.office.microsoft.com/r/rlidOfficeUpdate?clid=1033
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Program Files\Power Translator\Applications\LEC IE Translation Extension.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [smgr] smgr.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab
O16 - DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} (Photosynth Class) - http://media.labs.live.com/all/ps/_code_/Photosynth.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Machine Debug (MDM_SVC) - Unknown owner - C:\WINDOWS\pchealth\mdm.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

AND here is my AVG report

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 9:26:14 AM 6/17/2007

+ Scan result:



C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP224\A0034872.exe/crack.exe -> Adware.Virtumonde : Ignored.
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040203.dll -> Adware.Virtumonde : Ignored.
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040207.exe/crack.exe -> Adware.Virtumonde : Ignored.
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0041847.dll -> Adware.Virtumonde : Ignored.
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0041856.dll -> Adware.Virtumonde : Ignored.
C:\VundoFix Backups\gebaayw.dll.bad -> Adware.Virtumonde : Ignored.
C:\VundoFix Backups\ssqroli.dll.bad -> Adware.Virtumonde : Ignored.
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP224\A0034873.exe -> Downloader.Agent.brf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040205.exe -> Downloader.Agent.brf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040109.exe -> Downloader.Alphabet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040694.exe -> Downloader.Alphabet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040200.exe -> Downloader.Alphabet.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040705.exe -> Downloader.Alphabet.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP224\A0034872.exe/keygen.exe -> Downloader.LoadAdv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040206.exe -> Downloader.LoadAdv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP227\A0040207.exe/keygen.exe -> Downloader.LoadAdv : Cleaned with backup (quarantined).
C:\Program Files\music_now\inetchk.exe -> Hijacker.Small : Cleaned with backup (quarantined).
:mozilla.6:C:\Documents and Settings\Evan\Application Data\Mozilla\Firefox\Profiles\xe3bxu1l.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036972.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036975.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036976.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036977.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036978.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036991.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036992.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036993.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040709.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040710.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040713.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040717.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040718.exe -> Trojan.Agent.ame : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0038004.exe -> Trojan.Agent.anr : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040715.dll -> Trojan.Dialer.qn : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036960.exe -> Trojan.Pakes.q : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP226\A0036964.exe -> Trojan.Pakes.q : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040711.exe -> Trojan.Pakes.q : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040712.exe -> Trojan.Pakes.q : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040714.exe -> Trojan.Pakes.q : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{66398529-D73B-4984-AA87-1182733E7FA1}\RP231\A0040719.exe -> Trojan.Pakes.q : Cleaned with backup (quarantined).


::Report end

THANKS!

#12 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 17 June 2007 - 09:25 AM

Hi there,
Delete the following folder:

C:\VundoFix Backups

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start | All Programs | Accessories | System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Reboot again and let me know how everything seems to be running now.
Thanks,
Charles

Edited by rookie147, 17 June 2007 - 09:28 AM.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#13 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 17 June 2007 - 10:37 AM

Everything seems to be working just fine now. Thank you very much it was really appreciated. -Evan

#14 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:12:17 PM

Posted 17 June 2007 - 12:16 PM

Great job! Now that you're free from malware, please follow these simple steps to decrease the likelihood of getting re-infected again:

Set your system to not show all files.
Navigate to Start | My Computer | Tools | Folder Options.
Select the View tab. Under the "Hidden Files and Folders" heading, select "Show hidden files and folders".
Check: Hide file extensions for known file types
Check the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.
Either enable 'Automatic Updates' under Start | Control Panel | Automatic Updates, or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

In order to protect yourself against spyware, you should consider installing and running the following free programs:
Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.
Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.
SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.
Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

Please also read Tony Klein's excellent article: How I got Infected in the First Place
Thanks and happy computing,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#15 EvanTheMagician

EvanTheMagician
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Local time:06:17 AM

Posted 17 June 2007 - 01:53 PM

Thank you very much Charles!! I really appreciate it! -Evan




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users