Could You Take A Look Please?

Computer forums for help with removing malicious software (malware) and improving computer security

grin Welcome to What the Tech! ( Log In | Register ) What tech support ought to be... Fast, friendly and free! Once registered - you'll have the ability to post your question in the appropriate forum below. Additionally, if you can assist another member by sharing your tech knowledge, please post a reply! Best of all - Registration and all assistance is FREE! Once you've completed registration, simply choose the appropriate forum below, click on the "new topic" button, and post your question! What are you waiting for? Register today! *Registered users see NO ADVERTISING.

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

Could You Take A Look Please?

Options

lsehbruce View Member Profile	May 31 2007, 07:07 PM Post #1
Authentic Member Group: Authentic Member Posts: 50 Joined: 6-June 06 Member No.: 56,487 Operating System: windows xp	I know you guys are busy, but could yo take a look at my log. My computer keeps shutting down on me...Thanks Logfile of HijackThis v1.99.1 Scan saved at 9:04:00 PM, on 5/31/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Fonts\aolupd.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe C:\WINDOWS\System32\qogjmum.exe C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe C:\Program Files\Picaboo\Picaboo\PicabooMain.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [gdjefzhe] C:\WINDOWS\System32\gdjefzhe.exe O4 - HKLM\..\Run: [fb] C:\WINDOWS\System32\fb.exe O4 - HKLM\..\Run: [etm] C:\WINDOWS\System32\etm.exe O4 - HKLM\..\Run: [wbqkvixmdj] C:\WINDOWS\System32\wbqkvixmdj.exe O4 - HKLM\..\Run: [uymxibyvj] C:\WINDOWS\System32\uymxibyvj.exe O4 - HKLM\..\Run: [nffiopvusmj] C:\WINDOWS\System32\nffiopvusmj.exe O4 - HKLM\..\Run: [qogjmum] C:\WINDOWS\System32\qogjmum.exe O4 - HKLM\..\Run: [uiskkhsj] C:\WINDOWS\System32\uiskkhsj.exe O4 - HKLM\..\Run: [akhgbpiqscn] C:\WINDOWS\System32\akhgbpiqscn.exe O4 - HKLM\..\Run: [hfbdasdwgbjr] C:\WINDOWS\System32\hfbdasdwgbjr.exe O4 - HKLM\..\Run: [mefsj] C:\WINDOWS\System32\mefsj.exe O4 - HKLM\..\Run: [odamcj] C:\WINDOWS\System32\odamcj.exe O4 - HKLM\..\Run: [nfnrnscmhgo] C:\WINDOWS\System32\nfnrnscmhgo.exe O4 - HKLM\..\RunServices: [odamcj] C:\WINDOWS\System32\odamcj.exe O4 - HKLM\..\RunServices: [nfnrnscmhgo] C:\WINDOWS\System32\nfnrnscmhgo.exe O4 - HKLM\..\RunServices: [gdjefzhe] C:\WINDOWS\System32\gdjefzhe.exe O4 - HKLM\..\RunServices: [uiskkhsj] C:\WINDOWS\System32\uiskkhsj.exe O4 - HKLM\..\RunServices: [qogjmum] C:\WINDOWS\System32\qogjmum.exe O4 - HKCU\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: Camio Viewer 3.2.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUQualityAgent.exe O4 - Startup: Picaboo.lnk = C:\Program Files\Picaboo\Picaboo\PicabooMain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {E6C4420E-0669-4518-B825-F63CDDEF7D5D} (InitOcx Control) - http://cube.async.caltech.edu/init.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Smart Update Service (AOL-Updatr) - Unknown owner - C:\WINDOWS\Fonts\aolupd.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe O23 - Service: Print Spooler Service (ueexeuqspiyf) - Unknown owner - C:\WINDOWS\System32\fb.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

shelf life View Member Profile	Jun 1 2007, 05:25 PM Post #2
SuperMember Group: Malware Expert Posts: 3,181 Joined: 15-May 04 From: @localhost Member No.: 6,820 Operating System: Debian, Windows	hi lsehbruce, what is that? a honey pot? first lets stop a service: go to start>run and type in--> services.msc,<--in the list of services that comes up, under the name column look for: Print Spooler Service (there should be one called just-- Print Spooler,this one is legit leave it) right click on it and select properties. under the general tab: make sure that the service status is: Stopped and the Startup type is: disabled -------------------------------------------------- next we will use hjt, then boot into safe mode and last: get a antimalware app to scan with. you might want to copy/paste the part about safe mode into notepad and save it somewhere so you can find it in safe mode ---------------------------------------------------- next: scan with HJT, put a checkmark beside the items below, close all windows and click fix checked. O4 - HKLM\..\Run: [gdjefzhe] C:\WINDOWS\System32\gdjefzhe.exe O4 - HKLM\..\Run: [fb] C:\WINDOWS\System32\fb.exe O4 - HKLM\..\Run: [etm] C:\WINDOWS\System32\etm.exe O4 - HKLM\..\Run: [wbqkvixmdj] C:\WINDOWS\System32\wbqkvixmdj.exe O4 - HKLM\..\Run: [uymxibyvj] C:\WINDOWS\System32\uymxibyvj.exe O4 - HKLM\..\Run: [nffiopvusmj] C:\WINDOWS\System32\nffiopvusmj.exe O4 - HKLM\..\Run: [qogjmum] C:\WINDOWS\System32\qogjmum.exe O4 - HKLM\..\Run: [uiskkhsj] C:\WINDOWS\System32\uiskkhsj.exe O4 - HKLM\..\Run: [akhgbpiqscn] C:\WINDOWS\System32\akhgbpiqscn.exe O4 - HKLM\..\Run: [hfbdasdwgbjr] C:\WINDOWS\System32\hfbdasdwgbjr.exe O4 - HKLM\..\Run: [mefsj] C:\WINDOWS\System32\mefsj.exe O4 - HKLM\..\Run: [odamcj] C:\WINDOWS\System32\odamcj.exe O4 - HKLM\..\Run: [nfnrnscmhgo] C:\WINDOWS\System32\nfnrnscmhgo.exe O4 - HKLM\..\RunServices: [odamcj] C:\WINDOWS\System32\odamcj.exe O4 - HKLM\..\RunServices: [nfnrnscmhgo] C:\WINDOWS\System32\nfnrnscmhgo.exe O4 - HKLM\..\RunServices: [gdjefzhe] C:\WINDOWS\System32\gdjefzhe.exe O4 - HKLM\..\RunServices: [uiskkhsj] C:\WINDOWS\System32\uiskkhsj.exe O4 - HKLM\..\RunServices: [qogjmum] C:\WINDOWS\System32\qogjmum.exe ------------------------------------------------------------------------ safe mode part: boot computer into safe mode. to reach safe mode you would tap the f8 key during a computer restart. chose the first option form the list: safe mode once in safe mode, see all those 04 items you checked in hjt-- try to find and delete the .exe while in safe mode. luckily they are all in the system32 dir. if you cant find some of them dont worry about it, just get what you can. also in safe mode run your antivirus application. O4 - HKLM\..\Run: [gdjefzhe] C:\WINDOWS\System32\gdjefzhe.exe O4 - HKLM\..\Run: [fb] C:\WINDOWS\System32\fb.exe O4 - HKLM\..\Run: [etm] C:\WINDOWS\System32\etm.exe O4 - HKLM\..\Run: [wbqkvixmdj] C:\WINDOWS\System32\wbqkvixmdj.exe O4 - HKLM\..\Run: [uymxibyvj] C:\WINDOWS\System32\uymxibyvj.exe O4 - HKLM\..\Run: [nffiopvusmj] C:\WINDOWS\System32\nffiopvusmj.exe O4 - HKLM\..\Run: [qogjmum] C:\WINDOWS\System32\qogjmum.exe O4 - HKLM\..\Run: [uiskkhsj] C:\WINDOWS\System32\uiskkhsj.exe O4 - HKLM\..\Run: [akhgbpiqscn] C:\WINDOWS\System32\akhgbpiqscn.exe O4 - HKLM\..\Run: [hfbdasdwgbjr] C:\WINDOWS\System32\hfbdasdwgbjr.exe O4 - HKLM\..\Run: [mefsj] C:\WINDOWS\System32\mefsj.exe O4 - HKLM\..\Run: [odamcj] C:\WINDOWS\System32\odamcj.exe O4 - HKLM\..\Run: [nfnrnscmhgo] C:\WINDOWS\System32\nfnrnscmhgo.exe O4 - HKLM\..\RunServices: [odamcj] C:\WINDOWS\System32\odamcj.exe O4 - HKLM\..\RunServices: [nfnrnscmhgo] C:\WINDOWS\System32\nfnrnscmhgo.exe O4 - HKLM\..\RunServices: [gdjefzhe] C:\WINDOWS\System32\gdjefzhe.exe O4 - HKLM\..\RunServices: [uiskkhsj] C:\WINDOWS\System32\uiskkhsj.exe O4 - HKLM\..\RunServices: [qogjmum] C:\WINDOWS\System32\qogjmum.exe after the above, reboot computer normally- first stop is to download, install update (follow wizard) one of these, not both: avg antispyware: http://free.grisoft.com/freeweb.php/doc/20/lng/us/tpl/v5 super antispyware: http://www.superantispyware.com/ ---------------------------------------------------------- reboot computer after the scan (unless prompted to do so) rescan and post a new hjt log shelf life This post has been edited by shelf life: Jun 1 2007, 05:44 PM

lsehbruce View Member Profile	Jun 3 2007, 08:22 AM Post #3
Authentic Member Group: Authentic Member Posts: 50 Joined: 6-June 06 Member No.: 56,487 Operating System: windows xp	I hope I did it right! By the way, I didn't get the joke about the honey pot... Thanks so much!! Logfile of HijackThis v1.99.1 Scan saved at 10:19:54 AM, on 6/3/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe C:\Program Files\Picaboo\Picaboo\PicabooMain.exe C:\WINDOWS\Fonts\aolupd.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\STOPzilla!\STOPzilla.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\RunServices: [fb] C:\WINDOWS\System32\fb.exe O4 - HKLM\..\RunServices: [uymxibyvj] C:\WINDOWS\System32\uymxibyvj.exe O4 - HKLM\..\RunServices: [nffiopvusmj] C:\WINDOWS\System32\nffiopvusmj.exe O4 - HKLM\..\RunServices: [akhgbpiqscn] C:\WINDOWS\System32\akhgbpiqscn.exe O4 - HKLM\..\RunServices: [wbqkvixmdj] C:\WINDOWS\System32\wbqkvixmdj.exe O4 - HKLM\..\RunServices: [mefsj] C:\WINDOWS\System32\mefsj.exe O4 - HKCU\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: Camio Viewer 3.2.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUQualityAgent.exe O4 - Startup: Picaboo.lnk = C:\Program Files\Picaboo\Picaboo\PicabooMain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {E6C4420E-0669-4518-B825-F63CDDEF7D5D} (InitOcx Control) - http://cube.async.caltech.edu/init.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Smart Update Service (AOL-Updatr) - Unknown owner - C:\WINDOWS\Fonts\aolupd.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

shelf life View Member Profile	Jun 3 2007, 09:49 AM Post #4
SuperMember Group: Malware Expert Posts: 3,181 Joined: 15-May 04 From: @localhost Member No.: 6,820 Operating System: Debian, Windows	hi lsehbruce, ok good. we will use hjt again, but first disable avg "guard" so it dosnt interfere with hjt. like this: Launch AVG Anti-Spyware and in the main window click "Realtime protection" (in green indicating "Active") to change to inactive. when you looked for these files in the system32 dir last time, did you find them? i see many are gone now but some remain- although they might just be harmless registry entries showing in the hjt log ----------------------- scan with HJT, put a checkmark beside the items below, close all windows and click fix checked: O4 - HKLM\..\RunServices: [fb] C:\WINDOWS\System32\fb.exe O4 - HKLM\..\RunServices: [uymxibyvj] C:\WINDOWS\System32\uymxibyvj.exe O4 - HKLM\..\RunServices: [nffiopvusmj] C:\WINDOWS\System32\nffiopvusmj.exe O4 - HKLM\..\RunServices: [akhgbpiqscn] C:\WINDOWS\System32\akhgbpiqscn.exe O4 - HKLM\..\RunServices: [wbqkvixmdj] C:\WINDOWS\System32\wbqkvixmdj.exe O4 - HKLM\..\RunServices: [mefsj] C:\WINDOWS\System32\mefsj.exe take a look in the system32 dir and see if you can find the above .exe ------------------------- a honey pot is a computer thats used to attract malware. shelf life

lsehbruce View Member Profile	Jun 3 2007, 11:04 AM Post #5
Authentic Member Group: Authentic Member Posts: 50 Joined: 6-June 06 Member No.: 56,487 Operating System: windows xp	Here is my HJT log. Could you please tell me what I should install to prevent my computer from being a honey pot? I do not know if we even have antivirus software on this computer...Thanks Again Logfile of HijackThis v1.99.1 Scan saved at 1:00:51 PM, on 6/3/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe C:\Program Files\Picaboo\Picaboo\PicabooMain.exe C:\WINDOWS\Fonts\aolupd.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\STOPzilla!\STOPzilla.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: Camio Viewer 3.2.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUQualityAgent.exe O4 - Startup: Picaboo.lnk = C:\Program Files\Picaboo\Picaboo\PicabooMain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {E6C4420E-0669-4518-B825-F63CDDEF7D5D} (InitOcx Control) - http://cube.async.caltech.edu/init.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Smart Update Service (AOL-Updatr) - Unknown owner - C:\WINDOWS\Fonts\aolupd.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

shelf life View Member Profile	Jun 3 2007, 04:14 PM Post #6
SuperMember Group: Malware Expert Posts: 3,181 Joined: 15-May 04 From: @localhost Member No.: 6,820 Operating System: Debian, Windows	hi lsehbruce, the honey pot comment was a joke, your computer isnt really a honey pot. the hjt log looks good. in answer to your questions; looks like you have norton antivirus.( mainly for protection against virus) is it up to date? (i can reccommend free alternatives) now you have AVG antimlaware also (mainly for trojans). after 30 days the guard component of avg becomes inactive unless you buy it. but you can still update and scan with it after the 30 days. malware can come in different ways but mainly its because of things you do or dont do. you can have a computer full of anti this and anti that but it cant think for you. you still make the decisions. one way to prevent malware is to learn how it gets on your computer. see that link to my web site below (prevention) let me know about your norton subscription, is it still active? shelf life

lsehbruce View Member Profile	Jun 3 2007, 06:13 PM Post #7
Authentic Member Group: Authentic Member Posts: 50 Joined: 6-June 06 Member No.: 56,487 Operating System: windows xp	My Norton Antivirus is expired. What do you suggest? I will also check out your site. Thanks so much for all your help.

shelf life View Member Profile	Jun 3 2007, 08:18 PM Post #8
SuperMember Group: Malware Expert Posts: 3,181 Joined: 15-May 04 From: @localhost Member No.: 6,820 Operating System: Debian, Windows	hi lsehbruce, if norton is expired you should uninstall it via the add/remove programs panel, reboot computer once, then your first stop should be for antivirus. AVG also makes a free antivirus version. download, install update and do a scan. follow the wizard during the install: http://free.grisoft.com/freeweb.php/doc/2/ -------------------------------- you are also behind on windows updates. you still have windows service pack1. once you get the antivirus installed and do a scan you need to visit windows updates and get service pack 2 the download will be a massive one. some links about service pack 2: http://www.microsoft.com/windowsxp/sp2/default.mspx http://windows.about.com/od/updatingupgrad...vicepack2_2.htm shelf life

lsehbruce View Member Profile	Jun 4 2007, 03:07 PM Post #9
Authentic Member Group: Authentic Member Posts: 50 Joined: 6-June 06 Member No.: 56,487 Operating System: windows xp	Hi, before I download the windows update, I am nervous about doing this. My computer crashed a few months back and I lost everything. The person I spoke to at Dell told me it was from a automatic update that I had clicked on the bottom of my computer. Is there any chance of this crashing my computer or is this different? Again, Thanks!

shelf life View Member Profile	Jun 4 2007, 04:13 PM Post #10
SuperMember Group: Malware Expert Posts: 3,181 Joined: 15-May 04 From: @localhost Member No.: 6,820 Operating System: Debian, Windows	hi lsehbruce, QUOTE at Dell told me it was from a automatic update that I had clicked on the bottom of my computer. Is there any chance of this crashing my computer or is this different? updating isnt supposed to crash your computer, (not right away anyway, maybe later (joke) they both do the same thing. in windows 2000 and XP there is a built in feature to have auto updates turned on. this will periodically check a server for updates and download them in the backround to your computer then i think a icon will flash in the tray saying updates are ready to install. this auto update feature can be turned off though. the next way to get updates is to go to the windows update website where your computer will be checked for any updates you need, you then download them from the website and they get installed. a third way is to get service pack 2 on cd and install. it might be a good idea to pull off anything you cant afford to loose, as the update is massive. see if this helps: http://support.dell.com/support/topics/glo...lang=EN&cs= shelf life

« Next Oldest · Infections Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Time is now: 7th November 2009 - 05:27 PM

Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk.
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy