What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijacking Log Help Please

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.98.2
Scan saved at 09:55:22, on 23.08.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\internat.exe
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe
C:\WINNT\system32\wtssvcc.exe
C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
C:\WINNT\System32\svchost.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
D:\Fun\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINNT\search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINNT\search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINNT\search.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://195.225.176.14/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
F2 - REG:system.ini: Shell=Explorer.exe monitor.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7C60D974-BABB-4F5A-835F-C3BF28F008D9} - C:\WINNT\system32\chbhmba.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [win32.exe] C:\WINNT\win32.exe
O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe
O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [wind.exe] C:\WINNT\system32\wind.exe
O4 - HKCU\..\Run: [monitor] monitor.exe
O4 - HKCU\..\Run: [Rctw] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe
O4 - HKCU\..\Run: [WAPI] C:\WINNT\system32\wtssvcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O12 - Plugin for .bmp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .TIF: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O13 - DefaultPrefix:
O13 - WWW Prefix:
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\winnt\win.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ED862A9-4B80-4861-9519-20CCD5DB4B8C}: NameServer = 195.34.133.14,195.34.133.15
O18 - Filter: text/html - {D4B696E0-C120-4BA0-9C81-A6FC6A1B2C5B} - C:\WINNT\system32\chbhmba.dll
O18 - Filter: text/plain - {D4B696E0-C120-4BA0-9C81-A6FC6A1B2C5B} - C:\WINNT\system32\chbhmba.dll
O19 - User stylesheet: (file missing)
Post #2
cannot set a startpage and visit some pages
which of the following i can delete????

Logfile of HijackThis v1.98.2
Scan saved at 14:45:40, on 23.08.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\internat.exe
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe
C:\WINNT\system32\wtssvcc.exe
C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
D:\Fun\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINNT\search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINNT\search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINNT\search.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://195.225.176.14/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
F2 - REG:system.ini: Shell=Explorer.exe monitor.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7C60D974-BABB-4F5A-835F-C3BF28F008D9} - C:\WINNT\system32\chbhmba.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [win32.exe] C:\WINNT\win32.exe
O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe
O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [wind.exe] C:\WINNT\system32\wind.exe
O4 - HKCU\..\Run: [monitor] monitor.exe
O4 - HKCU\..\Run: [Rctw] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe
O4 - HKCU\..\Run: [WAPI] C:\WINNT\system32\wtssvcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O12 - Plugin for .bmp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .TIF: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O13 - DefaultPrefix:
O13 - WWW Prefix:
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\winnt\win.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ED862A9-4B80-4861-9519-20CCD5DB4B8C}: NameServer = 195.34.133.14,195.34.133.15
O18 - Filter: text/html - {D4B696E0-C120-4BA0-9C81-A6FC6A1B2C5B} - C:\WINNT\system32\chbhmba.dll
O18 - Filter: text/plain - {D4B696E0-C120-4BA0-9C81-A6FC6A1B2C5B} - C:\WINNT\system32\chbhmba.dll
O19 - User stylesheet: (file missing)
Post #3
Hello moby14, sorry for the delay but the forums are very busy at present. You have one of the more severe infections that is difficult to remove. It will take several steps to remove the offending infection.

Step#1

Please download and open the following zip file. Double-click on the file inside the zip and when it asks you if you would like to merge the file into your registry, please answer yes. This will make sure all files are visible on your computer.

http://www.davehigham.zen.co.uk/downloads/xphidden.zip


Step#2

This infection continues to reinstall itself through a hidden dll which we have to find and remove. To find it:

1. Please download DllCompare
( The Screenshot will show you how the program will look when it starts.)

2. Start the Program with its default settings and put a check mark in the include subdirectories. Click the Run Locate.com and wait until the scan says complete.

3. Click the Compare button to start the next process.

4. Files in the upper portion have been verified to "exist", Files in the bottom section were not able to be accessed. Very few files should be listed in the bottom section when the Compare scan is complete.

5. Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan screenshot.

6. This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files) screenshot

7. Click the Make a Log of what was found button, and post the log here in this thread using Add Reply to receive further instructions.
Post #4
I am sorry I gave you instructions for XP when I wanted you to show all hidden files. Please do the following to make certain all hidden files are showing: * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View Tab. * Under the Hidden files and folders heading select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm. * Click OK. all the best!
Post #5
hi, thank you for your help. this is what i get when i used the "make a log of what was found" - button. there only was one file in the bottom section which does NOT get removed after i rescanned it. waiting for your answer and say thank you * DLLCompare Log version(1.0.0.125) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINNT\SYSTEM32\resacgm.dll Mon 21 Jun 2004 10:07:44 ….R 57.344 56,00 K ________________________________________________ 1.062 items found: 1.062 files, 0 directories. Total of file sizes: 183.972.130 bytes 175,45 M Administrator Account = True ——————–End log———————
Post #6
Great! that is exactly what we wanted. The file in that log is the hidden dll which we wiill now proceed to get rid of



Click here to download and install Registrar Lite. Install, run, copy and paste this line to reglite's address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

and hit the "go" tab. Find:"Appinit_Dlls" Value on the right side panel, DoubleClick, copy and confirm that the filename in the Value area is the same as that from the DllCompare log.

If so, using Windows Explorer, go to your root drive: C:\ and create a new folder called 'Hijack' and within that folder, create two new folders, one called 'Backups' and one called 'Junk'.

Use the Registrar Lite program. Copy and paste the key below into reglite's address bar and hit 'Go':

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

Click on the Windows key(purplish-blue colour) to highlight it, and use the top menu File>Export to the C:\Hijack\Backups folder:

1.) Winkey.reg (Save as Type: regedit4 .reg type)
2.) Winkey.hiv (Save as Type: Scroll to select regetd32/WinAPI *hiv *dat files)

Navigate to C:\Hijack\Backups and confirm both files have been successfully saved.

Use the Registrar Lite program again. Copy and paste the key below into reglite's address bar and hit 'Go':

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Right-click on the Windows key (purplish-blue) in the left pane and rename it to Notwindows - for example:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotWindows

DoubleClick "Appinit_Dlls" value on right pane and erase the data in the 'Value' box at the the bottom of the new pane. The data to remove will be:

"C:\WINDOWS\System32\resacgm.dll", hit 'Apply' and 'Ok' to set.

Rename 'NotWindows' back to 'Windows' in the left pane, close Registrar Lite and reboot the computer. If all goes well the hidden process will not run at startup and you should now be able to find and *see* the resacgm.dll in C:\WINDOWS\System32.

Unzip and run Winfile from here. Open it up, click File>Move…

Copy and paste this into the 'From' box: C:\WINDOWS\System32\resacgm.dll
Copy and paste this into the 'To' box: C:\Hijack\Junk\resacgm.dll

Click OK. Close Winfile and check in C:\Hijack\Junk for resacgm.dll - please let me know what's there and we can proceed.
Post #7
thanks again for your help, i can now "see" the file, BUT when i tried to open your last link to run winfile i got following answer: HTTP1.1 STATUS 403 Remote Access to this object forbidden This file cannot be directly accessed from a remote site, but must be linked through the Brinkster Member's site. what to do now?
Post #9
thank you, the link is working. i followed the instructions, but winfile told me that this file is a hidden one and i should click "yes" to try to transfer it. winfile tried, but i got a message, that it could not finish the transfer. now the file is not in the "junk"-file but it also is not in the "system32"-file. during the transfer my antivirus programm startet and told me that it found a vius and put it into the "isolation area". ???
Post #11
first i tried the whole prozess again but i did not find anything then i looked in the isolation area and yes the file is there, i still get hijacked so i am waiting for more instructions
Post #12
OK do this. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done.

Click here to download Ad-Aware and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Then click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and post a new log here
Post #13
i scanned with both
after rebooting i opened the explorer and i did not get hijacked! If this is the end: THANK YOU VERY MUCH!
if not: here is the log:

Logfile of HijackThis v1.98.2
Scan saved at 16:17:25, on 31.08.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\internat.exe
C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
C:\Programme\Internet Explorer\iexplore.exe
D:\Fun\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmx.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://195.225.176.14/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {73FFB059-5ADC-4E40-A27B-A82A0E6A13FC} - c:\winnt\system32\bfbhk.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL
O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [win32.exe] C:\WINNT\win32.exe
O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe
O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [wind.exe] C:\WINNT\system32\wind.exe
O4 - HKCU\..\Run: [monitor] monitor.exe
O4 - HKCU\..\Run: [Rctw] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe
O4 - HKCU\..\Run: [WAPI] C:\WINNT\system32\wtssvcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O4 - Global Startup: GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe
O12 - Plugin for .bmp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .TIF: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\winnt\win.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ED862A9-4B80-4861-9519-20CCD5DB4B8C}: NameServer = 195.34.133.14,195.34.133.15
O18 - Filter: text/html - {E7841F34-B75F-4C98-A135-3858D9392E2D} - c:\winnt\system32\bfbhk.dll
O18 - Filter: text/plain - {E7841F34-B75F-4C98-A135-3858D9392E2D} - c:\winnt\system32\bfbhk.dll
O19 - User stylesheet: (file missing)
Post #14
Few more things to clean up. I would like you also to do another DllCompare log to make sure there is nothing hiding

Step#1

You do have a few trojans on your PC and the best way to deal with them when you are infected is to do Online AV scans. Please go to the following two Online Scanners and let them do a complete scan of your computer and fix everything they find
PandaSoftware Online AV scan
Housecall Online AV scan


Step#2

1. Please check to make sure that Spybot SD is completely updated

2. Close ALL windows except Spybot SD

3. Check for problems

4. Fix selected RED items

5. Reboot


Step#3

You have a search bar which is not recommended as it is related to adware. A list of Safe Programs

Go to Start>Control Panel>Add Remove Programs and uninstall MySearch Bar., My Web Search, OR My Bar. REBOOT when done.


Step#4

1. Scan again with HijackThis (ALL WINDOWS CLOSED EXCEPT HJT)

2. Put a check mark beside each of the following entries in the HJT window


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmx.at/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://195.225.176.14/ie

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank


O2 - BHO: (no name) - {73FFB059-5ADC-4E40-A27B-A82A0E6A13FC} - c:\winnt\system32\bfbhk.dll (file missing)


O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [win32.exe] C:\WINNT\win32.exe

O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe

O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

O4 - HKCU\..\Run: [wind.exe] C:\WINNT\system32\wind.exe

O4 - HKCU\..\Run: [monitor] monitor.exe

O4 - HKCU\..\Run: [Rctw] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe

O4 - HKCU\..\Run: [WAPI] C:\WINNT\system32\wtssvcc.exe

O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\winnt\win.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{8ED862A9-4B80-4861-9519-20CCD5DB4B8C}: NameServer = 195.34.133.14,195.34.133.15 <— this may be the IP address of your network, please make sure it is not an IP address you recognize. If you recognize it then please do not remove it

O18 - Filter: text/html - {E7841F34-B75F-4C98-A135-3858D9392E2D} - c:\winnt\system32\bfbhk.dll

O18 - Filter: text/plain - {E7841F34-B75F-4C98-A135-3858D9392E2D} - c:\winnt\system32\bfbhk.dll

O19 - User stylesheet: (file missing)


3. Click 'fix checked'

4. REBOOT to finish removing the entries into SAFE MODE by tapping F8 repeatedly while booting up

5. DELETE the following files:

C:\??\scvhost.exe please search for this be very careful that you delete the correct file as there is a legitimate very necessary windows file named svchost.exe

C:\WINNT\win32.exe

C:\WINNT\system32\wind.exe

C:\??]monitor.exe <–please search for this

C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\paat.exe

C:\WINNT\system32\wtssvcc.exe

C:\winnt\win.exe

6. REBOOT into normal mode

7. please SCAN again with HJT

8. POST a new log file here in this thread using 'Add Reply' to see what is left to clean.


Good Luck!
Post #15
hi

no problems with steps 1+2

step 3: what to do with the link? shell i download something? but i uninstalled MYsearchbar

step 4: could NOT find:
O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe

O4 - HKLM\..\Run: [win32.exe] C:\WINNT\win32.exe

O4 - HKLM\..\RunServices: [Config Loader] scvhost.exe

O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

O4 - HKCU\..\Run: [wind.exe] C:\WINNT\system32\wind.exe

O4 - HKCU\..\Run: [WAPI] C:\WINNT\system32\wtssvcc.exe

cannot delete:
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ED862A9-4B80-4861-9519-20CCD5DB4B8C}: NameServer = 195.34.133.14,195.34.133.15 <— this may be the IP address of your network, please make sure it is not an IP address you recognize. If you recognize it then please do not remove it

because these are my DNS-Serversdresses

In the Safe mode:
couldn't find anything except: "monitor.exe", i deleted it

and here is my new log:

Logfile of HijackThis v1.98.2
Scan saved at 10:58:50, on 02.09.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Programme\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\internat.exe
C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
D:\Fun\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: CAMEDIA Master.lnk = C:\Programme\OLYMPUS\CAMEDIA Master 4.1\CM_camera.exe
O12 - Plugin for .bmp: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .TIF: C:\Programme\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ED862A9-4B80-4861-9519-20CCD5DB4B8C}: NameServer = 195.34.133.14,195.34.133.15

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI