What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] HijackThislog

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Malwarebytes' Anti-Malware 1.36 Database version: 1947 Windows 5.1.2600 Service Pack 3 4/7/2009 3:38:01 PM mbam-log-2009-04-07 (15-38-01).txt Scan type: Quick Scan Objects scanned: 83717 Time elapsed: 3 minute(s), 59 second(s) Memory Processes Infected: 1 Memory Modules Infected: 2 Registry Keys Infected: 37 Registry Values Infected: 3 Registry Data Items Infected: 0 Folders Infected: 4 Files Infected: 37 Memory Processes Infected: C:\Program Files\Fasoo DRM\fpm.exe (Trojan.BHO) -> Unloaded process successfully. Memory Modules Infected: C:\Program Files\Fasoo DRM\f_blksc.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_xlus.dll (Trojan.BHO) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\TypeLib\{1de3791c-e723-447a-a402-37fd2f133750} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d827611e-de82-4010-b6d6-1df3f63f5065} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{a7e8de60-4dea-11d6-a03d-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{a7e8de6c-4dea-11d6-a03d-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5e705a09-557a-4ceb-8177-c94e0400c902} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b4c942e7-57d6-41fd-bb18-15c077179dcc} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{72917d60-46aa-11d6-a038-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{72917d6d-46aa-11d6-a038-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{72917d6e-46aa-11d6-a038-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{236cc5e0-d591-442b-a070-0e2bc4d707e8} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{80fb062c-3d5d-11d6-a031-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1687b15d-e5fd-47a7-8a3a-0ed326a54fa7} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1687b15d-e5fd-47a7-8a3a-0ed326a54fa7} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{f7e4275d-81cb-4cc9-bf45-cc3b86eb9570} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{da74df6a-4b0b-4e42-9166-290b56239b69} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1773a6ae-93d3-4ce2-9965-ae29f1e59db1} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{49086551-9514-11d5-9772-0090273528bb} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{dd846afe-9557-11d5-9772-0090273528bb} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{dd846b02-9557-11d5-9772-0090273528bb} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{3a48d2b8-2ea5-418a-a4d4-52b6bbfc7e95} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{81abbbb2-c869-4e35-ae7a-583b470d3ed9} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{a77c1658-358a-484a-ac86-bcfc0ef1d216} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{979e5fcf-eb94-4532-adc7-dcbe57dc1203} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{da3144f1-fce0-4012-a289-e4ceada25ee6} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{d55001f0-20eb-11d6-a01a-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d55001fd-20eb-11d6-a01a-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e547fb26-f94d-4b3c-99cb-c65003542a0a} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{e9b499c0-539b-11d6-a044-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{94768d6c-32eb-4db4-ac31-a3b6181adef5} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{4d4e0637-5d6e-4f4c-823d-82efc637541a} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{fde46f8c-d05c-43d3-81dd-06e17bb7060d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{952eb86c-14bf-4cff-bb1b-af65b473bc5d} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{a82eed52-7466-4fb6-b8b5-1107c1828b4f} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e467ddd-f8a8-4845-acdf-775746a79725} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{934cefdc-e880-446f-880f-6560f613d8aa} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{934cefdc-e880-446f-880f-6560f613d8aa} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{934cefdc-e880-446f-880f-6560f613d8aa} (Trojan.BHO) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\07105015 (Rogue.Multiple.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fph exe (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fpm exe (Trojan.BHO) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Documents and Settings\All Users\Application Data\07105015 (Rogue.Multiple.H) -> Delete on reboot. C:\Program Files\Fasoo DRM (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\Log (Trojan.BHO) -> Quarantined and deleted successfully. C:\Documents and Settings\krishna.d\Start Menu\Programs\System Security (Rogue.SystemSecurity) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users\Application Data\07105015\07105015.exe (Rogue.Multiple.H) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\07105015\07105015.glu (Rogue.Multiple.H) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\07105015\pc07105015cnf (Rogue.Multiple.H) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\07105015\pc07105015ins (Rogue.Multiple.H) -> Quarantined and deleted successfully. C:\Program Files\Fasoo DRM\FasooAcrobatManager4x.api (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\FasooAcrobatManager5x.api (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\fph.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\fpm.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\fsmLoader.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_agent.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_ai.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_blksc.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_cie.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_cie_ep_sso.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_cm.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_dc.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_diag.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_dm.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_dn.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_info.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_kcl(htmlviewer).fac (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_pm.dll (Trojan.BHO) -> Quarantined and deleted successfully. C:\Program Files\Fasoo DRM\f_smgbd.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_sps.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_ver.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_vh.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_vi.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_vt.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\f_xlus.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\InstAcro.exe (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\SMGBD.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\Fasoo DRM\Log\101.log (Trojan.BHO) -> Quarantined and deleted successfully. C:\Program Files\Fasoo DRM\Log\21.log (Trojan.BHO) -> Quarantined and deleted successfully. C:\Program Files\Fasoo DRM\Log\f_1507.log (Trojan.BHO) -> Quarantined and deleted successfully. C:\Documents and Settings\krishna.d\Start Menu\Programs\System Security\System Security 2009 Support.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully. C:\Documents and Settings\krishna.d\Start Menu\Programs\System Security\System Security 2009.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mc_H8__muq_K1__.dll (Trojan.Agent) -> Quarantined and deleted successfully.
Post #2
Hi dkp,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Download HijackThis from Here .
  • If using Internet Explorer, Please select RUN
  • If Using Firefox, Download to your Desktop and then Double-Click on Icon to start installation.
  • Choose the default location of C:\Program Files\Trend Micro\HijackThis as the destination. HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!
  • Click the Install button.
  • Accept the license agreement .
  • The progam will place a shortcut on your desktop. This will make it easier for you to access the tool when required.
  • Click Do a system scan and save a log file. A Notepad file will open.
  • To post the text, first you must highlight the entire text and then press the (Ctrl+C) keys which copies it to your clipboard.
  • Now paste the log into this thread using the (Ctrl + V) buttons.


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI