What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Nasty-filled hijackthis

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've had this problem a short time now and have done a hijackthis. The results are below and seem to show a load of problems - 04 and startup entries - is anyone available to help out?
Thanks.
Malwarebytes is, I think, also infected. Bummer.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:34:39 PM, on 12/28/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Memory Improve Master\MemoryImproveMaster.exe
C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\SysWOW64\ASTSRV.EXE
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
C:\Users\Andrew\AppData\Roaming\Alsehy\yhvo.exe
C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
C:\Windows\SysWOW64\svchost.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon .exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Andrew\AppData\Local\Temp\cpes_clean.exe
C:\Program Files (x86)\WordWeb\wweb32 .exe
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Users\Andrew\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:50370
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,c:\program files (x86)\microsoft\watermark.exe,
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [WordWeb] "C:\Program Files (x86)\WordWeb\wweb32.exe" -startup
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files (x86)\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKLM\..\Run: [rap] C:\Program Files (x86)\ert\3.exe
O4 - HKLM\..\Run: [svchost] C:\Users\Andrew\AppData\Roaming\Microsoft\svchost.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [CheckPoint Cleanup] C:\Users\Andrew\AppData\Local\Temp\cpes_clean_launcher.exe C:\Users\Andrew\AppData\Local\Temp\cpes_clean.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Memory Improve Master] C:\Program Files (x86)\Memory Improve Master\MemoryImproveMaster.exe /autorun
O4 - HKCU\..\Run: [{3218CE00-CAE3-65F9-A346-C2D255EDB34D}] C:\Users\Andrew\AppData\Roaming\Alsehy\yhvo.exe
O4 - HKCU\..\Run: [{50BC07FE-F0C2-91C3-0311-48485CD4F814}] C:\Users\Andrew\AppData\Roaming\Leap\ugliv.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Qcubahogevop] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\nds042.dll",Startup (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Qcubahogevop] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\nds042.dll",Startup (User 'Default user')
O4 - .DEFAULT User Startup: awuho.exe (User 'Default user')
O4 - .DEFAULT User Startup: cueh.exe (User 'Default user')
O4 - .DEFAULT User Startup: dauluz.exe (User 'Default user')
O4 - .DEFAULT User Startup: ekwidi.exe (User 'Default user')
O4 - .DEFAULT User Startup: ekzu.exe (User 'Default user')
O4 - .DEFAULT User Startup: elpo.exe (User 'Default user')
O4 - .DEFAULT User Startup: eqquyw.exe (User 'Default user')
O4 - .DEFAULT User Startup: eshyi.exe (User 'Default user')
O4 - .DEFAULT User Startup: ewyd.exe (User 'Default user')
O4 - .DEFAULT User Startup: fyem.exe (User 'Default user')
O4 - .DEFAULT User Startup: hafumi.exe (User 'Default user')
O4 - .DEFAULT User Startup: igmoiq.exe (User 'Default user')
O4 - .DEFAULT User Startup: ilahk.exe (User 'Default user')
O4 - .DEFAULT User Startup: ilmyus.exe (User 'Default user')
O4 - .DEFAULT User Startup: irgi.exe (User 'Default user')
O4 - .DEFAULT User Startup: iwbiyp.exe (User 'Default user')
O4 - .DEFAULT User Startup: iwmipo.exe (User 'Default user')
O4 - .DEFAULT User Startup: iwyxy.exe (User 'Default user')
O4 - .DEFAULT User Startup: izxet.exe (User 'Default user')
O4 - .DEFAULT User Startup: kuihi.exe (User 'Default user')
O4 - .DEFAULT User Startup: liokso.exe (User 'Default user')
O4 - .DEFAULT User Startup: loacow.exe (User 'Default user')
O4 - .DEFAULT User Startup: lyevvy.exe (User 'Default user')
O4 - .DEFAULT User Startup: muxu.exe (User 'Default user')
O4 - .DEFAULT User Startup: ocfee.exe (User 'Default user')
O4 - .DEFAULT User Startup: opix.exe (User 'Default user')
O4 - .DEFAULT User Startup: oxan.exe (User 'Default user')
O4 - .DEFAULT User Startup: ozengi.exe (User 'Default user')
O4 - .DEFAULT User Startup: paopu.exe (User 'Default user')
O4 - .DEFAULT User Startup: piab.exe (User 'Default user')
O4 - .DEFAULT User Startup: qicy.exe (User 'Default user')
O4 - .DEFAULT User Startup: rety.exe (User 'Default user')
O4 - .DEFAULT User Startup: sikax.exe (User 'Default user')
O4 - .DEFAULT User Startup: umwe.exe (User 'Default user')
O4 - .DEFAULT User Startup: upsoif.exe (User 'Default user')
O4 - .DEFAULT User Startup: uqdoo.exe (User 'Default user')
O4 - .DEFAULT User Startup: utdiq.exe (User 'Default user')
O4 - .DEFAULT User Startup: uwid.exe (User 'Default user')
O4 - .DEFAULT User Startup: uwygs.exe (User 'Default user')
O4 - .DEFAULT User Startup: wope.exe (User 'Default user')
O4 - .DEFAULT User Startup: xiylo.exe (User 'Default user')
O4 - .DEFAULT User Startup: xotye.exe (User 'Default user')
O4 - .DEFAULT User Startup: ydxii.exe (User 'Default user')
O4 - .DEFAULT User Startup: ymezca.exe (User 'Default user')
O4 - .DEFAULT User Startup: ypuhez.exe (User 'Default user')
O4 - .DEFAULT User Startup: ysduu.exe (User 'Default user')
O4 - .DEFAULT User Startup: ywcex.exe (User 'Default user')
O4 - .DEFAULT User Startup: ziutd.exe (User 'Default user')
O4 - Startup: bysexiSrv.exe
O4 - Startup: cuomSrv.exe
O4 - Startup: dediSrv.exe
O4 - Startup: edtaynSrv.exe
O4 - Startup: efcufSrv.exe
O4 - Startup: ekidSrv.exe
O4 - Startup: ewipdSrv.exe
O4 - Startup: fyafeSrv.exe
O4 - Startup: goyfruSrv.exe
O4 - Startup: hygienSrv.exe
O4 - Startup: imdeeSrv.exe
O4 - Startup: laniySrv.exe
O4 - Startup: louroqSrv.exe
O4 - Startup: mauquSrv.exe
O4 - Startup: moibSrv.exe
O4 - Startup: obcoSrv.exe
O4 - Startup: ogifaSrv.exe
O4 - Startup: oxondeSrv.exe
O4 - Startup: peahSrv.exe
O4 - Startup: poubahSrv.exe
O4 - Startup: riilkSrv.exe
O4 - Startup: ryruySrv.exe
O4 - Startup: saonlSrv.exe
O4 - Startup: tefoSrv.exe
O4 - Startup: toohSrv.exe
O4 - Startup: toqaSrv.exe
O4 - Startup: xiihoSrv.exe
O4 - Startup: ypxuafSrv.exe
O4 - Startup: yxguSrv.exe
O4 - Startup: zapeSrv.exe
O4 - Startup: zelawSrv.exe
O4 - Startup: zudaqySrv.exe
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASO3DiskOptimizer - Unknown owner - C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Nalpeiron Ltd. - C:\Windows\system32\ASTSRV.EXE
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service 64-bit (nlsInterface) - Unknown owner - C:\Windows\system32\nlsInterface.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
O23 - Service: Ralink Registry Writer 64 (RalinkRegistryWriter64) - Ralink Technology, Corp. - C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
Post #2 last edited
Hi,

You have a very nasty infection called Ramnit, generally it isn't cleanable as it infects most of the files on the computer, I haven't seen it on a Windows7 64 bit system before, so I don't know how much it will actually take hold.

I usually recommend a reformat/reinstall, but let's see how infected this machine is:

Please do the following

Refer to the ComboFix User's Guide

  • Download ComboFix from one of these locations:

    Link 1
    Link 2

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.


    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————
Post #3
Thanks, Catbite, for helping out.
I tried twice to Combofix, and it did seem to almost finish. I left it running overnight, but on restarting the comp (Combofix had stalled somewhere along the way - on the reporting side, I think), Taskmanager was absolutely full of instances 3.exe and … I forget the other - embedded in Realplayer. The instances just became more numerous as I watched. I closed down the comp' and tried again in Safe Mode and manually deleted the 3.exe (Inside a folder named ert in Program Files and Realplayer .
The prog' stalled again, but on restart, the comp' seems pretty stable, although the ert folder's back again and one instance of 3.exe was in Taskmanager. I just closed it down.
The comp' definitely is MUCH more stable (low memory and cpu useage) than it has been for a while, and the Hijackthis looks much cleaner - but I'll leave that to the experts to check out.

Oops. Out of date hijackthis version used. The new, 2.0.4 version looks a lot less healthy.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:12:50 PM, on 12/29/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
C:\Windows\SysWOW64\svchost.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\SysWOW64\ASTSRV.EXE
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
C:\Windows\SysWOW64\svchost.exe
C:\Program Files (x86)\Memory Improve Master\MemoryImproveMaster.exe
C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon .exe
C:\Program Files (x86)\WordWeb\wweb32 .exe
C:\Users\Andrew\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:50370
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,,c:\program files (x86)\microsoft\watermark.exe
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [WordWeb] "C:\Program Files (x86)\WordWeb\wweb32.exe" -startup
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files (x86)\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKLM\..\Run: [rap] C:\Program Files (x86)\ert\3 .exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask .exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Memory Improve Master] C:\Program Files (x86)\Memory Improve Master\MemoryImproveMaster.exe /autorun
O4 - HKCU\..\Run: [{3218CE00-CAE3-65F9-A346-C2D255EDB34D}] C:\Users\Andrew\AppData\Roaming\Alsehy\yhvo.exe
O4 - HKCU\..\Run: [{50BC07FE-F0C2-91C3-0311-48485CD4F814}] C:\Users\Andrew\AppData\Roaming\Leap\ugliv.exe
O4 - HKUS\S-1-5-18\..\Run: [Qcubahogevop] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\nds042.dll",Startup (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Qcubahogevop] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\nds042.dll",Startup (User 'Default user')
O4 - .DEFAULT User Startup: awuho.exe (User 'Default user')
O4 - .DEFAULT User Startup: cueh.exe (User 'Default user')
O4 - .DEFAULT User Startup: dauluz.exe (User 'Default user')
O4 - .DEFAULT User Startup: ekwidi.exe (User 'Default user')
O4 - .DEFAULT User Startup: ekzu.exe (User 'Default user')
O4 - .DEFAULT User Startup: elpo.exe (User 'Default user')
O4 - .DEFAULT User Startup: eqquyw.exe (User 'Default user')
O4 - .DEFAULT User Startup: eshyi.exe (User 'Default user')
O4 - .DEFAULT User Startup: ewyd.exe (User 'Default user')
O4 - .DEFAULT User Startup: fyem.exe (User 'Default user')
O4 - .DEFAULT User Startup: hafumi.exe (User 'Default user')
O4 - .DEFAULT User Startup: igmoiq.exe (User 'Default user')
O4 - .DEFAULT User Startup: ilahk.exe (User 'Default user')
O4 - .DEFAULT User Startup: ilmyus.exe (User 'Default user')
O4 - .DEFAULT User Startup: irgi.exe (User 'Default user')
O4 - .DEFAULT User Startup: iwbiyp.exe (User 'Default user')
O4 - .DEFAULT User Startup: iwmipo.exe (User 'Default user')
O4 - .DEFAULT User Startup: iwyxy.exe (User 'Default user')
O4 - .DEFAULT User Startup: izxet.exe (User 'Default user')
O4 - .DEFAULT User Startup: kuihi.exe (User 'Default user')
O4 - .DEFAULT User Startup: liokso.exe (User 'Default user')
O4 - .DEFAULT User Startup: loacow.exe (User 'Default user')
O4 - .DEFAULT User Startup: lyevvy.exe (User 'Default user')
O4 - .DEFAULT User Startup: muxu.exe (User 'Default user')
O4 - .DEFAULT User Startup: ocfee.exe (User 'Default user')
O4 - .DEFAULT User Startup: opix.exe (User 'Default user')
O4 - .DEFAULT User Startup: oxan.exe (User 'Default user')
O4 - .DEFAULT User Startup: ozengi.exe (User 'Default user')
O4 - .DEFAULT User Startup: paopu.exe (User 'Default user')
O4 - .DEFAULT User Startup: piab.exe (User 'Default user')
O4 - .DEFAULT User Startup: qicy.exe (User 'Default user')
O4 - .DEFAULT User Startup: rety.exe (User 'Default user')
O4 - .DEFAULT User Startup: sikax.exe (User 'Default user')
O4 - .DEFAULT User Startup: umwe.exe (User 'Default user')
O4 - .DEFAULT User Startup: upsoif.exe (User 'Default user')
O4 - .DEFAULT User Startup: uqdoo.exe (User 'Default user')
O4 - .DEFAULT User Startup: utdiq.exe (User 'Default user')
O4 - .DEFAULT User Startup: uwid.exe (User 'Default user')
O4 - .DEFAULT User Startup: uwygs.exe (User 'Default user')
O4 - .DEFAULT User Startup: wope.exe (User 'Default user')
O4 - .DEFAULT User Startup: xiylo.exe (User 'Default user')
O4 - .DEFAULT User Startup: xotye.exe (User 'Default user')
O4 - .DEFAULT User Startup: ydxii.exe (User 'Default user')
O4 - .DEFAULT User Startup: ymezca.exe (User 'Default user')
O4 - .DEFAULT User Startup: ypuhez.exe (User 'Default user')
O4 - .DEFAULT User Startup: ysduu.exe (User 'Default user')
O4 - .DEFAULT User Startup: ywcex.exe (User 'Default user')
O4 - .DEFAULT User Startup: ziutd.exe (User 'Default user')
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASO3DiskOptimizer - Unknown owner - C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Nalpeiron Ltd. - C:\Windows\system32\ASTSRV.EXE
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service 64-bit (nlsInterface) - Unknown owner - C:\Windows\system32\nlsInterface.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
O23 - Service: Ralink Registry Writer 64 (RalinkRegistryWriter64) - Ralink Technology, Corp. - C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 13375 bytes



Thanks again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI