nlw2004
Topic Starter
I have a couple of virues in my computer that I really need help getting out. Here is my hijack this log.Thanks.
Logfile of HijackThis v1.98.2
Scan saved at 8:29:08 PM, on 10/18/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\pwrruu.exe
C:\Program Files\CSBB\CSV7P070.exe
C:\WINDOWS\System32\windows\services.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cmcorec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Owner\Application Data\ttuh.exe
C:\WINDOWS\System32\t?skmgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\hijackthis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8119cc25af88a612665dae1cb362d98f\update\update.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fghbe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fghbe.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fghbe.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000002230} - C:\Program Files\CSBB\CSBB.DLL
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll (file missing)
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LRRNgmbS] C:\documents and settings\owner\local settings\temp\LRRNgmbS.exe
O4 - HKLM\..\Run: [qc8C] C:\documents and settings\owner\local settings\temp\qc8C.exe
O4 - HKLM\..\Run: [ee.exe] C:\Program Files\EE\ee.exe
O4 - HKLM\..\Run: [CSV7P70] C:\Program Files\CSBB\CSV7P070.exe
O4 - HKLM\..\Run: [yevdzc] C:\WINDOWS\System32\yevdzc.exe
O4 - HKLM\..\Run: [Windows] C:\WINDOWS\System32\windows\services.exe
O4 - HKLM\..\Run: [GRn] C:\documents and settings\owner\local settings\temp\GRn.exe
O4 - HKLM\..\Run: C:\documents and settings\owner\local settings\temp\I.exe
O4 - HKLM\..\Run: [ntbc32.exe] C:\WINDOWS\ntbc32.exe
O4 - HKLM\..\Run: [3s7j37X] cmcorec.exe
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winggm32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [IBotRXb7W] cmpstore.exe
O4 - HKCU\..\Run: [Tsa] C:\PROGRA~1\COMMON~1\tsa\tsm.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Owner\Application Data\ttuh.exe
O4 - HKCU\..\Run: [Fxfd] C:\WINDOWS\System32\t?skmgr.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {03177121-226B-11D4-B0BE-005004AD3039} (UploaderCtrl Class) - http://members17.clubphoto.com/_img/upload…tl_uploader.cab
O16 - DPF: {0F96BA2F-29F6-4A75-C78B-062A1EF06882} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {12A9C2B9-ABE9-2066-060D-7F33220938CC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {13864AEC-B43B-1D0A-2C21-230516195418} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {152466FD-4C28-29BC-056A-3DA65E186077} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {15802188-75D4-4942-8B1A-045C72639BB9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {23CFB721-17C0-1AAB-6813-4E1033463279} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {26CF4AB9-C26D-7180-4965-71D414008884} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2CE910B0-2814-6341-D27E-6AE65A066735} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3762D90E-C513-0F71-1907-02E973F01E19} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {38348BCC-7059-7ED8-5130-76914D1CB193} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {40E8421C-A348-248C-3939-0EA441078446} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {41726953-6DE5-14CD-46B4-57665F4D6558} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4F1B5DF2-50B6-2AF6-5A11-4E2463C64B12} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4FC1584C-7C4A-1CED-7CB7-672C3E8E2C53} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5D9992DC-97A4-36B1-1EA8-69E33EDED290} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {63CD1581-D419-7C23-0DB7-557614B0001F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098143295687
O16 - DPF: {68D0B786-FC0D-7226-0F34-36CC6166E024} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6D1E213F-5C09-6F27-3570-55891725BB14} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {75604F5A-1965-79F9-D061-4AE908E549AB} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7BC53560-965C-32FD-7B1C-5B5B3957039D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7E25E3C6-5EF8-4306-684E-48877AB53650} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
O21 - SSODL: XxgZVJPOduP - {BC1B0101-16B1-ABAB-63BE-D4D2A7A38352} - C:\WINDOWS\System32\xp.dll
Logfile of HijackThis v1.98.2
Scan saved at 8:29:08 PM, on 10/18/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\pwrruu.exe
C:\Program Files\CSBB\CSV7P070.exe
C:\WINDOWS\System32\windows\services.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cmcorec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Owner\Application Data\ttuh.exe
C:\WINDOWS\System32\t?skmgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\hijackthis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8119cc25af88a612665dae1cb362d98f\update\update.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fghbe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fghbe.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fghbe.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000002230} - C:\Program Files\CSBB\CSBB.DLL
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll (file missing)
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LRRNgmbS] C:\documents and settings\owner\local settings\temp\LRRNgmbS.exe
O4 - HKLM\..\Run: [qc8C] C:\documents and settings\owner\local settings\temp\qc8C.exe
O4 - HKLM\..\Run: [ee.exe] C:\Program Files\EE\ee.exe
O4 - HKLM\..\Run: [CSV7P70] C:\Program Files\CSBB\CSV7P070.exe
O4 - HKLM\..\Run: [yevdzc] C:\WINDOWS\System32\yevdzc.exe
O4 - HKLM\..\Run: [Windows] C:\WINDOWS\System32\windows\services.exe
O4 - HKLM\..\Run: [GRn] C:\documents and settings\owner\local settings\temp\GRn.exe
O4 - HKLM\..\Run: C:\documents and settings\owner\local settings\temp\I.exe
O4 - HKLM\..\Run: [ntbc32.exe] C:\WINDOWS\ntbc32.exe
O4 - HKLM\..\Run: [3s7j37X] cmcorec.exe
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winggm32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [IBotRXb7W] cmpstore.exe
O4 - HKCU\..\Run: [Tsa] C:\PROGRA~1\COMMON~1\tsa\tsm.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Owner\Application Data\ttuh.exe
O4 - HKCU\..\Run: [Fxfd] C:\WINDOWS\System32\t?skmgr.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {03177121-226B-11D4-B0BE-005004AD3039} (UploaderCtrl Class) - http://members17.clubphoto.com/_img/upload…tl_uploader.cab
O16 - DPF: {0F96BA2F-29F6-4A75-C78B-062A1EF06882} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {12A9C2B9-ABE9-2066-060D-7F33220938CC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {13864AEC-B43B-1D0A-2C21-230516195418} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {152466FD-4C28-29BC-056A-3DA65E186077} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {15802188-75D4-4942-8B1A-045C72639BB9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {23CFB721-17C0-1AAB-6813-4E1033463279} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {26CF4AB9-C26D-7180-4965-71D414008884} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2CE910B0-2814-6341-D27E-6AE65A066735} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3762D90E-C513-0F71-1907-02E973F01E19} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {38348BCC-7059-7ED8-5130-76914D1CB193} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {40E8421C-A348-248C-3939-0EA441078446} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {41726953-6DE5-14CD-46B4-57665F4D6558} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4F1B5DF2-50B6-2AF6-5A11-4E2463C64B12} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4FC1584C-7C4A-1CED-7CB7-672C3E8E2C53} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5D9992DC-97A4-36B1-1EA8-69E33EDED290} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {63CD1581-D419-7C23-0DB7-557614B0001F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098143295687
O16 - DPF: {68D0B786-FC0D-7226-0F34-36CC6166E024} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6D1E213F-5C09-6F27-3570-55891725BB14} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {75604F5A-1965-79F9-D061-4AE908E549AB} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7BC53560-965C-32FD-7B1C-5B5B3957039D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7E25E3C6-5EF8-4306-684E-48877AB53650} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
O21 - SSODL: XxgZVJPOduP - {BC1B0101-16B1-ABAB-63BE-D4D2A7A38352} - C:\WINDOWS\System32\xp.dll
anyone.