What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Help

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I hope you can help me. I downloaded SpySweeper, AdAware, and recently Hijackthis, but I can't seem to get rid of items- WINCC.EXE and MFCAA32.EXE. I think there are what keeps changing my homepage. I also noticed whenever i do a sweep with SpySweeper, Adware items CWS_NS3 and CWS_NS3 hijacker always show up even after i have them removed. Anywho heres my log from hijackthis:

Logfile of HijackThis v1.98.2
Scan saved at 9:08:51 AM, on 10/5/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\MFCAA32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\PROGRAM FILES\SUPPORT.COM\CLIENT\BIN\TGCMD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HPZTSB01.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\WINCC.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\DOWNLOADS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\fdyxq.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\fdyxq.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {538035DB-D345-0402-7D9A-12067B7C5180} - C:\WINDOWS\SYSTEM\MFCOE.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_3_12_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [OmgStartup] C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Prodigy DSL] C:\PROGRA~1\PRODINET\PRODIG~1\APP\EnterNetDUN.Exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\Client\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [ZTgServerSwitch] C:\Program Files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb01.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WINCC.EXE] C:\WINDOWS\WINCC.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MFCAA32.EXE] C:\WINDOWS\SYSTEM\MFCAA32.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\RunServices: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\RunServices: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: IomegaWare.lnk = C:\Program Files\Iomega\IomegaWare\Commander.exe
O4 - Startup: Iomega QuikSync.lnk = C:\Program Files\Iomega\QuikSync\QuikSync.exe
O4 - Startup: Iomega Icons.lnk = C:\Program Files\Iomega\Tools\imgicon.exe
O4 - Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\imgstart.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab

Logfile of HijackThis v1.98.2
Scan saved at 9:08:51 AM, on 10/5/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\MFCAA32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\PROGRAM FILES\SUPPORT.COM\CLIENT\BIN\TGCMD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HPZTSB01.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\WINCC.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\DOWNLOADS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\fdyxq.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\fdyxq.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {538035DB-D345-0402-7D9A-12067B7C5180} - C:\WINDOWS\SYSTEM\MFCOE.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_3_12_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [OmgStartup] C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Prodigy DSL] C:\PROGRA~1\PRODINET\PRODIG~1\APP\EnterNetDUN.Exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\Client\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [ZTgServerSwitch] C:\Program Files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb01.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WINCC.EXE] C:\WINDOWS\WINCC.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MFCAA32.EXE] C:\WINDOWS\SYSTEM\MFCAA32.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\RunServices: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\RunServices: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: IomegaWare.lnk = C:\Program Files\Iomega\IomegaWare\Commander.exe
O4 - Startup: Iomega QuikSync.lnk = C:\Program Files\Iomega\QuikSync\QuikSync.exe
O4 - Startup: Iomega Icons.lnk = C:\Program Files\Iomega\Tools\imgicon.exe
O4 - Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\imgstart.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
Post #2
Hello weakvsfire

If you are still having problems with your computer please see the following:
You have one of the most severe infections we see these days and it will take a few posts to get rid of it. I would like you to do the following steps in order following the instructions carefully:

Step #1

Please download and open the following zip file. Double-click on the file inside the zip and when it asks you if you would like to merge the file into your registry, please answer yes. This will make sure all files are visible on your computer.

http://www.davehigham.zen.co.uk/downloads/xphidden.zip


Step #2

The first thing I need you to do is download the file from here:

Getservice.zip

1. Extract the file to the c:\ drive.

2. Then navigate to the c:\getservices and double-click on the getservices.bat file.

3. A notepad will open up. Please paste the contents of that notepad as a reply to this post.




Step #3

This infection often continues to reinstall itself through a hidden dll which we have to find and remove.

1. Please download DllCompare
( The Screenshot will show you how the program will look when it starts.)

2. Start the Program with its default settings and put a check mark in the include subdirectories. Click the Run Locate.com and wait until the scan says complete.

3. Click the Compare button to start the next process.

4. Files in the upper portion have been verified to "exist", Files in the bottom section were not able to be accessed. Very few files should be listed in the bottom section when the Compare scan is complete.

5. Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan screenshot.

6. This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files) screenshot

7. Click the Make a Log of what was found button, and post the log here in this thread using Add Reply to receive further instructions.



Step #4

Please post the two log files here in this thread using 'Add Reply'
Post #3


Well i tried doing Step 1, but when i tried adding it to my registry it said it could not. I tried saving it to a compressed folder and extracting it to a new one, but it didn't matter. It said it could only import registry script and that what i downloaded was not.

Did i do something wrong?
Post #4
DId you try to add the zip file or the file inside the zip? It is the file inside named xphidden.reg that should be able to be added to your registry. Would you please let me know if it still doesn't work?
Post #6
Double Click on the zip file and it will open. The file inside will be xphidden.reg. Double click on it and it should enter itself into the registry.
Post #7
Ok i did that and it said that it wasn't a registry file. How do i get my computer to recognize the file? Oh and does this trojan virus mess with webcams?
Post #8
Hi weakvsfire,
In XP there are 'super hidden' files which this program exposes, We will have to use the standard means of exposing what we can manually.

Please go to start>Control Panel>Folder Options>View and put a check mark in the following:
Display the content of System Folders
Show Hidden Files and Folders

Uncheck the following
Hide Extensions for known file types
Hide protected operating system files

Once you have done that please proceed with the steps.
Post #10 last edited
duh late at night answering logs when I should be sleeping - in fact was half asleep obviously. No wonder XPHidden wouldn't work - why I got the idea you were running XP I don't know - I am terrribly sorry I have wasted your time!

Step 1

Please download the following two program from : Unzip and run StartDreck.exe
Hit: -config
hit: -Unmark all
Check these boxes only:
*Registry->run keys
*Registry->Browser helper objects
*System/drivers> Running processes
click >ok.

Use the "save" tab, to save, name and post the log here in this thread for further instructions.
Post #11
I'm sorry. I should have said in the beginning i have a windows me. Well i did what you told me to do, but i'm having a hard time saving the log. I did save it, but when i tried opening it with notepad i got this:  G>sA@ @             ( 6      ) - / 7     ! 8    9      4 :     # 1 * +  , 2 " ;      $ . <      % 3 =      & 0 >     ' 5 ? Ö This is not what showed up in the log though.
Post #12
Hello weakvsfire,

I have never seen the log do this before but anything is possible with thesee infections. Can you see the log in wordpad/notepad to read it? If you can please look down the list of items until you get to the following:

»RunOnce
»RunServices
»RunServicesOnce
»RunOnceEx


There may be entries that are locations and descriptions of files on the right side of some of the entries. The one I am interested in is RunServicesOnce. If there is an entry beside it could you please post that entry back here using Add Reply. That will be the name of the Hidden DLL file that we have to expose, find and delete. The entry will end with StreamingDeviceSetup.

Good Luck!
Post #13
I'm sorry, i found it now. Heres the log: StartDreck (build 2.1.7 public stable) - 2004-10-20 @ 11:51:25 (GMT -04:00) Platform: Windows ME (Win 4.90.3000 ) Internet Explorer: 6.0.2800.1106 Logged in as default at VAIO »Registry »Run Keys »Current User »Run *MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background *Yahoo! Pager=C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet *SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0 *SpyKiller=C:\Program Files\SpyKiller\spykiller.exe /startup *BestPopUpKiller=C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup »RunOnce »Default User »Run *MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background *Yahoo! Pager=C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet *SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0 *SpyKiller=C:\Program Files\SpyKiller\spykiller.exe /startup *BestPopUpKiller=C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup »RunOnce »Local Machine »Run *PCHealth=C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s *SystemTray=SysTray.Exe *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *OmgStartup=C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe *Prodigy DSL=C:\PROGRA~1\PRODINET\PRODIG~1\APP\EnterNetDUN.Exe *Tgcmd="C:\Program Files\Support.com\Client\bin\tgcmd.exe" /server /nosystray *ZTgServerSwitch=C:\Program Files\support.com\client\lserver\server.vbs *HPDJ Taskbar Utility=C:\WINDOWS\SYSTEM\hpztsb01.exe *LoadQM=loadqm.exe *QuickTime Task="C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime *Zone Labs Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" *NAV Agent=C:\PROGRA~1\NORTON~1\NAVAPW32.EXE *Symantec NetDriver Monitor=C:\PROGRA~1\SYMNET~1\SNDMON.EXE *WINCC.EXE=C:\WINDOWS\WINCC.EXE »RunOnce »RunServices *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SchedulingAgent=mstask.exe *SSDPSRV=C:\WINDOWS\SYSTEM\ssdpsrv.exe **StateMgr=C:\WINDOWS\System\Restore\StateMgr.exe *StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE *TrueVector=C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service *ScriptBlocking="C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg *MFCAA32.EXE=C:\WINDOWS\SYSTEM\MFCAA32.EXE »RunServicesOnce »RunOnceEx »RunServicesOnceEx »File Associations (CR) +.bat *batfile="%1" %* +.com *comfile="%1" %* +.exe *exefile="%1" %* +.hta *htafile=C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %* +.htm *htmlfile="C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome +.html *htmlfile="C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome +.js *JSFile=C:\WINDOWS\WScript.exe "%1" %* +.jse *JSEFile=C:\WINDOWS\WScript.exe "%1" %* +.pif *piffile="%1" %* +.reg *regfile=regedit.exe "%1" +.scr *scrfile="%1" /S +.txt *txtfile=C:\WINDOWS\NOTEPAD.EXE %1 +.vbs *VBSFile=C:\WINDOWS\WScript.exe "%1" %* +.vbe *VBEFile=C:\WINDOWS\WScript.exe "%1" %* +.wsh *WSHFile=C:\WINDOWS\WScript.exe "%1" %* +.wsf *WSFFile=C:\WINDOWS\WScript.exe "%1" %* +.lnk `lnkfile= [key or value does not exist] »Browser Helper Objects (LM) *Navbho.CNavExtBho.1/{BDF3E430-B101-42AD-A544-FADC6B084872} `InprocServer32=C:\Program Files\Norton AntiVirus\NavShExt.dll *Class/{25984661-3482-A9A8-6BD1-7E8B33646034} `InprocServer32=C:\WINDOWS\CRDV.DLL »Files »Autostart Folders »Current User *C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\IomegaWare.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega QuikSync.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Icons.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Startup Options.lnk »Default User *C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\IomegaWare.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega QuikSync.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Icons.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Startup Options.lnk »Local Machine »INI-Files »WIN.INI\[windows] *LOAD= *RUN= »SYSTEM.INI\[boot] *SHELL=Explorer.exe »Text Files *C:\WINDOWS\msdos.sys *C:\msdos.sys *C:\config.sys *C:\autoexec.bat *C:\WINDOWS\wininit.ini *C:\WINDOWS\wininit.bak *C:\WINDOWS\winstart.bat *C:\WINDOWS\dosstart.bat *C:\WINDOWS\command\cmdinit.bat »System/Drivers »Running Processes +FF0F06E1=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFFCD85=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFE6DB1=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFE7775=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFE2635=C:\WINDOWS\SYSTEM\MSTASK.EXE +FFFEE63D=C:\WINDOWS\SYSTEM\SSDPSRV.EXE +FFFEAF09=C:\WINDOWS\SYSTEM\STIMON.EXE +FFFE9165=C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE +FFFD16ED=C:\WINDOWS\EXPLORER.EXE +FFFE2869=C:\WINDOWS\SYSTEM\MFCAA32.EXE +FFFC3971=C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE +FFFB1311=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFFA5BB9=C:\WINDOWS\SYSTEM\WMIEXE.EXE +FFFAF169=C:\PROGRAM FILES\SUPPORT.COM\CLIENT\BIN\TGCMD.EXE +FFFA9A51=C:\WINDOWS\SYSTEM\HPZTSB01.EXE +FFFDD2E5=C:\WINDOWS\LOADQM.EXE +FFFB7C59=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFF926F5=C:\WINDOWS\SYSTEM\QTTASK.EXE +FFFA8B01=C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE +FFF873E1=C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE +FFF85D3D=C:\WINDOWS\WINCC.EXE +FFF8FF11=C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE +FFF8A90D=C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE +FFFB1FDD=C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE +FFF64D41=C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE +FFF63BC9=C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE +FFF57361=C:\WINDOWS\SYSTEM\DDHELP.EXE +FFF514BD=C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE +FFF48561=C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE +FFF196C9=C:\MY DOCUMENTS\STARTDRECK[1]\STARTDRECK.EXE »NT Services »Application specific Sorry, i'm not good at this.
Post #14
Sorry weakvsfire but I need a new HJT log file before giving you more instructions. I need to give you instructions on what to remove, but that may have changed in the last 15 days so please post a new HJT log. thanks
Post #15
New log: StartDreck (build 2.1.7 public stable) - 2004-10-21 @ 14:07:22 (GMT -04:00) Platform: Windows ME (Win 4.90.3000 ) Internet Explorer: 6.0.2800.1106 Logged in as default at VAIO »Registry »Run Keys »Current User »Run *MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background *Yahoo! Pager=C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet *SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0 *SpyKiller=C:\Program Files\SpyKiller\spykiller.exe /startup *BestPopUpKiller=C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup »RunOnce »Default User »Run *MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background *Yahoo! Pager=C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet *SpySweeper="C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0 *SpyKiller=C:\Program Files\SpyKiller\spykiller.exe /startup *BestPopUpKiller=C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup »RunOnce »Local Machine »Run *PCHealth=C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s *SystemTray=SysTray.Exe *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *OmgStartup=C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe *Prodigy DSL=C:\PROGRA~1\PRODINET\PRODIG~1\APP\EnterNetDUN.Exe *Tgcmd="C:\Program Files\Support.com\Client\bin\tgcmd.exe" /server /nosystray *ZTgServerSwitch=C:\Program Files\support.com\client\lserver\server.vbs *HPDJ Taskbar Utility=C:\WINDOWS\SYSTEM\hpztsb01.exe *LoadQM=loadqm.exe *QuickTime Task="C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime *Zone Labs Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" *NAV Agent=C:\PROGRA~1\NORTON~1\NAVAPW32.EXE *Symantec NetDriver Monitor=C:\PROGRA~1\SYMNET~1\SNDMON.EXE *WINCC.EXE=C:\WINDOWS\WINCC.EXE »RunOnce »RunServices *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SchedulingAgent=mstask.exe *SSDPSRV=C:\WINDOWS\SYSTEM\ssdpsrv.exe **StateMgr=C:\WINDOWS\System\Restore\StateMgr.exe *StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE *TrueVector=C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service *ScriptBlocking="C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg *MFCAA32.EXE=C:\WINDOWS\SYSTEM\MFCAA32.EXE »RunServicesOnce »RunOnceEx »RunServicesOnceEx »File Associations (CR) +.bat *batfile="%1" %* +.com *comfile="%1" %* +.exe *exefile="%1" %* +.hta *htafile=C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %* +.htm *htmlfile="C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome +.html *htmlfile="C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome +.js *JSFile=C:\WINDOWS\WScript.exe "%1" %* +.jse *JSEFile=C:\WINDOWS\WScript.exe "%1" %* +.pif *piffile="%1" %* +.reg *regfile=regedit.exe "%1" +.scr *scrfile="%1" /S +.txt *txtfile=C:\WINDOWS\NOTEPAD.EXE %1 +.vbs *VBSFile=C:\WINDOWS\WScript.exe "%1" %* +.vbe *VBEFile=C:\WINDOWS\WScript.exe "%1" %* +.wsh *WSHFile=C:\WINDOWS\WScript.exe "%1" %* +.wsf *WSFFile=C:\WINDOWS\WScript.exe "%1" %* +.lnk `lnkfile= [key or value does not exist] »Browser Helper Objects (LM) *Navbho.CNavExtBho.1/{BDF3E430-B101-42AD-A544-FADC6B084872} `InprocServer32=C:\Program Files\Norton AntiVirus\NavShExt.dll *Class/{25984661-3482-A9A8-6BD1-7E8B33646034} `InprocServer32=C:\WINDOWS\CRDV.DLL »Files »Autostart Folders »Current User *C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\IomegaWare.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega QuikSync.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Icons.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Startup Options.lnk »Default User *C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\IomegaWare.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega QuikSync.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Icons.lnk *C:\WINDOWS\Start Menu\Programs\StartUp\Iomega Startup Options.lnk »Local Machine »INI-Files »WIN.INI\[windows] *LOAD= *RUN= »SYSTEM.INI\[boot] *SHELL=Explorer.exe »Text Files *C:\WINDOWS\msdos.sys *C:\msdos.sys *C:\config.sys *C:\autoexec.bat *C:\WINDOWS\wininit.bak *C:\WINDOWS\winstart.bat *C:\WINDOWS\dosstart.bat *C:\WINDOWS\command\cmdinit.bat »System/Drivers »Running Processes +FF0F0693=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFFCDF7=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFE6DC3=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFE7707=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFE276F=C:\WINDOWS\SYSTEM\MSTASK.EXE +FFFEE62B=C:\WINDOWS\SYSTEM\SSDPSRV.EXE +FFFEA39F=C:\WINDOWS\SYSTEM\STIMON.EXE +FFFE982F=C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE +FFFD418F=C:\WINDOWS\SYSTEM\MFCAA32.EXE +FFFE506F=C:\WINDOWS\EXPLORER.EXE +FFFD23EF=C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE +FFFB2437=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFFA00AB=C:\WINDOWS\SYSTEM\WMIEXE.EXE +FFFA1377=C:\PROGRAM FILES\SUPPORT.COM\CLIENT\BIN\TGCMD.EXE +FFFABDA3=C:\WINDOWS\SYSTEM\HPZTSB01.EXE +FFF932AF=C:\WINDOWS\LOADQM.EXE +FFF9069F=C:\WINDOWS\SYSTEM\QTTASK.EXE +FFF9E4E7=C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE +FFFCD687=C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE +FFFD85AF=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFF827CB=C:\WINDOWS\WINCC.EXE +FFF8C14F=C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE +FFF8AACB=C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE +FFF77E1B=C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE +FFF7BA43=C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE +FFF62033=C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE +FFF6B597=C:\WINDOWS\SYSTEM\DDHELP.EXE +FFF5457F=C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE +FFF3190B=C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE +FFF245DF=C:\MY DOCUMENTS\STARTDRECK[1]\STARTDRECK.EXE »NT Services »Application specific

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI