[Resolved] Need help deciphering Hijack This Log

Hijakt1

• Click Start, then Settings, then click Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, Remove Coupon Printer for Windows
• Do the same for Java™ SE Runtime Environment 6 Update 1.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  explorer.exe
  
  :Services
  
  :Reg
  
  :Files
  c:\windows\system32\drivers\lvuvc.hs
  c:\windows\system32\drivers\logiflt.iad
  c:\program files\CouponPrinter.exe
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [Reboot]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== c:\windows\system32\drivers\lvuvc.hs moved successfully. c:\windows\system32\drivers\logiflt.iad moved successfully. c:\program files\CouponPrinter.exe moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\Acr290B.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla15.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla16.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla17.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla18.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla19.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla1A.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla1B.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\fla1C.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\~DF6317.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\~DF6332.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Y8P3ZTTT\history_manager[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Y8P3ZTTT\iframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Y8P3ZTTT\spencersmagic_com[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Y8P3ZTTT\video[2].flv scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Y8P3ZTTT\virusresults[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\R2T8P76W\blank[3].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\R2T8P76W\groupCAM5NFF8.htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\R2T8P76W\ReadMessage[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\R2T8P76W\us-120groupeventCA8H8EXI.htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\R2T8P76W\WGD90CARC7TNGCASEBEC4CAIXZ1QFCATKKYS6CA49YX1YCA9YIO78CAO3Q5UJCAALND6TCA7Q9A 0RCANEF3F1CA0T73DPCAJGV4DPCA656DYCCAIE89Y1CAQNHHAECAVG1I9LCAIRJFGGCATEEA7ZCAWRUDG H.htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\J6DSVCQQ\embed[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\J6DSVCQQ\hom-intro[1].flv scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\J6DSVCQQ\iframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\J6DSVCQQ\navbar[8].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\J6DSVCQQ\results[2].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\F83D0WQG\LUJTRCA6IOZ7MCAUB3ZURCAB8ZLVTCAIH2SCJCAG013JXCAVDB8WECA8QDWZICA3VFY51CAZGM0 W6CAFP4AFWCAIBYSDKCA8HFPF6CANQ9FBCCAKY26R3CA39I4FKCAGPPGI6CAA1A8AYCA99SJTZCAUW7VZ F.htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\F83D0WQG\Need_help_deciphering_Hijack_Log_t101854[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\F83D0WQG\redirectiframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\F83D0WQG\rpc_relay[5].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\F83D0WQG\T33MDCA738D5OCA1678HHCAYOXIRVCAKH9YM4CAK7RP4GCAN6TDA1CAMFT34GCAKAUFZ7CA4JZ0 KZCAHOBK30CALHV6OYCA3X0ID2CATD2UJFCAUZBUG0CAC9J5P6CA7VZTMTCAB7K1T8CA31OA8DCAT02YJ P.htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AFUC8GYT\blank[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AFUC8GYT\embed[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AFUC8GYT\FUD8YCA2XT2YFCA03MZLFCAIT0JUICATO7M9YCA4JG916CA4VXSFFCA2D3M53CACTQHDCCAEW4M JTCAXMXDQWCAC4Y2V4CA6FV0TICA5P6BCUCAGTE4MSCAB5YL3UCAI8I7JDCAOHWZXMCAZF718RCAOISO7 3.htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AFUC8GYT\st[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AFUC8GYT\watch[2].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AFUC8GYT\_;ord=1239977356177625[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4MDSBJ7W\home[4].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4MDSBJ7W\magictherapy_com[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4MDSBJ7W\Need_help_deciphering_Hijack_Log_t101854[2].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\10[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\getnetworkwidgetmain[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\iframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\iframe[2].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\ifr[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\Need_help_deciphering_Hijack_Log_t101854[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\Need_help_deciphering_Hijack_Log_t101854[2].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\newsletter-issue_04-16-09[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2MNVEYWS\shalombayitmagazine[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\25G6EM94\fc[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\25G6EM94\iframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\25G6EM94\main[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\25G6EM94\Need_help_deciphering_Hijack_Log_t101854[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\25G6EM94\noback[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\25G6EM94\roofwithaview_blogspot_com[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_458.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04172009_090022 Now I'll reboot before continuing with your instructions.

I have free versions of AVG, Ad-Aware 2008, Spybot S&D and Spyware Doctor. How do I temporarily disable these programs in order to run the Kaspersky scan?

Hijakt1,

Good question. We happen to have a little guide here: http://forums.whatthetech.com/How_Disable_…ams_t96260.html

Kaspersky Online Scanner 7.0 upon trying to download: "Starting Java applet has failed! Please go online to use this program." I AM online. Now what?

Hijakt1,

Now we try a different online scanner that is nearly as good.

I need you to run the following scan: Eset Online Scanner

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button.
• Click Start. The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button. The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

"No threats found" version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=4017 (20090417) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=114715e70a937b4293161c13f6445729 # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2009-04-17 06:56:05 # local_time=2009-04-17 11:56:05 (-0800, Pacific Daylight Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=227889 # found=0 # scan_time=1902

Hijakt1, Please let me have a new HijackThis log. Also, how is it running? Is it still acting weird?

It seems to be behaving itself. No detectable symptoms at this point.

Hijakt1,

• Please open HijackThis and run Do a system scan only
• Check the boxes next to ONLY the entries listed below(if present):
  
  • R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - S-1-5-18 Startup: PowerReg Scheduler V3.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: PowerReg Scheduler V3.exe (User 'Default user')
    O4 - Startup: PowerReg Scheduler V3.exe
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    
• Close all programs except for HijackThis.
• Click on Fix checked
• A box will pop up asking you if you wish to fix the selected items. Please choose YES.
• Once it has fixed them, please exit/close HijackThis.

With that done, Log looks good


You need to create a new Clean restore point:

• Download SysRestorePoint to your desktop and unzip it to it's own folder.
• Double click SysRestorePoint.exe so that we can make a new system restore point.
• A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Unable to use SysRestorePoint.exe. A window pops up saying I have to install v2.0.50727 verssion of .NET Framework. I created a system restore point using the program in System Tools, but I can't figure out how to remove the previous restore points there. And we thought we were almost finished.

Hijakt1, That's not a problem. There's no reason for you to install .Net framework. There are a couple of other ways to make a restore point and it sounds like you already made one. Please go ahead and follow the steps for removing old restore points. That command is built into windows and has nothing to do with the other program.

Tried following your directions, but I don't have the prompts you describe in the directions. Start>run>cleanmgr>OK>"Select the drive you want to clean up." There are no tabs. No "More Options" tab. No clean up button in a System Restore box. What am I missing?

Hijakt1, Aha.. Select the c: drive and then you'll get the tab.