Hijack This Log

nlw2004 Topic Starter

Post #1October 25, 2004, 11:06 PM UTC last edited October 25, 2004, 11:07 PM UTC

Can someone please help me here is another one of my hijack this logs. I have posted twice but nobody want reply so I'm posting again.

Do I have a really bad virus.
Logfile of HijackThis v1.98.2
Scan saved at 7:04:34 PM, on 10/25/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\pwrruu.exe
C:\Program Files\CSBB\CSV7P070.exe
C:\WINDOWS\System32\windows\services.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\glmramp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Application Data\ttuh.exe
C:\WINDOWS\System32\t?skmgr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\System32\wuauclt.exe
C:\over.exe
C:\gama.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LRRNgmbS] C:\documents and settings\owner\local settings\temp\LRRNgmbS.exe
O4 - HKLM\..\Run: [qc8C] C:\documents and settings\owner\local settings\temp\qc8C.exe
O4 - HKLM\..\Run: [ee.exe] C:\Program Files\EE\ee.exe
O4 - HKLM\..\Run: [CSV7P70] C:\Program Files\CSBB\CSV7P070.exe
O4 - HKLM\..\Run: [yevdzc] C:\WINDOWS\System32\yevdzc.exe
O4 - HKLM\..\Run: [Windows] C:\WINDOWS\System32\windows\services.exe
O4 - HKLM\..\Run: [GRn] C:\documents and settings\owner\local settings\temp\GRn.exe
O4 - HKLM\..\Run: C:\documents and settings\owner\local settings\temp\I.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [3s7j37X] glmramp.exe
O4 - HKLM\..\Run: [Sys29] c:\windows\system32\winehc32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IBotRXb7W] rdpps.exe
O4 - HKCU\..\Run: [Tsa] C:\PROGRA~1\COMMON~1\tsa\tsm.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Owner\Application Data\ttuh.exe
O4 - HKCU\..\Run: [Fxfd] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {03177121-226B-11D4-B0BE-005004AD3039} (UploaderCtrl Class) - http://members17.clubphoto.com/_img/upload…tl_uploader.cab
O16 - DPF: {0F96BA2F-29F6-4A75-C78B-062A1EF06882} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {12A9C2B9-ABE9-2066-060D-7F33220938CC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {12D2954C-1671-4C4B-D531-2F1178F12179} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {13864AEC-B43B-1D0A-2C21-230516195418} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {152466FD-4C28-29BC-056A-3DA65E186077} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {15802188-75D4-4942-8B1A-045C72639BB9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {169E1860-5AD8-323F-5E6C-52FE2957E42D} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {198DD0C4-C5F0-4212-1249-1F934CD61AB2} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {23CFB721-17C0-1AAB-6813-4E1033463279} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {26CF4AB9-C26D-7180-4965-71D414008884} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2CE910B0-2814-6341-D27E-6AE65A066735} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2FED06CA-CAEF-6071-5571-5E2B2736DE06} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3762D90E-C513-0F71-1907-02E973F01E19} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {38348BCC-7059-7ED8-5130-76914D1CB193} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {40E8421C-A348-248C-3939-0EA441078446} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {41726953-6DE5-14CD-46B4-57665F4D6558} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {446C7A7D-0765-1D8B-6B36-17F319DD00A4} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4964D214-DD3A-2CE7-EA20-7D0165554914} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4B9EEC59-CA05-29B0-F958-752A1B7D4382} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {4D299F8E-168B-3DB5-7A62-5F10793F7BBF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4F1B5DF2-50B6-2AF6-5A11-4E2463C64B12} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4FC1584C-7C4A-1CED-7CB7-672C3E8E2C53} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {589067DD-72A3-71E6-469B-32ED5151E797} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5D9992DC-97A4-36B1-1EA8-69E33EDED290} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {61D923FF-2B06-5D18-599F-32BA4B955E45} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {61DACDD4-0F10-5B43-6A02-36D13C3F6297} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {63CD1581-D419-7C23-0DB7-557614B0001F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098143295687
O16 - DPF: {642B4D14-F0B6-1318-6C64-42645B3C7815} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {68D0B786-FC0D-7226-0F34-36CC6166E024} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6D1E213F-5C09-6F27-3570-55891725BB14} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6E91F709-82AF-438A-FAEF-40D6510D7BA2} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {75604F5A-1965-79F9-D061-4AE908E549AB} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7BC53560-965C-32FD-7B1C-5B5B3957039D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7DF46FEA-60D4-402E-F598-4E0950E0BD8C} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {7E25E3C6-5EF8-4306-684E-48877AB53650} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
O21 - SSODL: XxgZVJPOduP - {BC1B0101-16B1-ABAB-63BE-D4D2A7A38352} - C:\WINDOWS\System32\xp.dll

Please help.

nlw2004

Post #2October 26, 2004, 11:21 PM UTC

Please anyone

Siggyx

Post #3October 27, 2004, 12:47 AM UTC

Welcome to the forum.

Step # 1

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/download4086.html

REBOOT

Step #2

Please download and run Spybot Search & Destroy and AdAware. Then follow the instructions in the links below to run.

Spybot Tutorial

AdAware Tutorial

Step # 3

Please do an online scan,

Trend Micro http://housecall.trendmicro.com/housecall/start_corp.asp

Make sure that you choose "fix" or "clean".

REBOOT

Download http://www.cexx.org/lspfix.htm

Close all windows except LSPfix

Click on LSPfix.exe and it will launch the program.

In the left hand (keep) LSPfix window there will be a list of files including the identified *.dll file that is listed on the O10 line in the HJT log.

Put a check mark in the box “I know what I am doing”

Move all instances of the identified *.dll file that is listed on the O10 line, from the left window (keep) to the right window (remove) by highlighting the file or files and clicking the arrow.

cdlsp.dll<<
Click ‘Finish’

REBOOT to complete the task and post a new HiJackThis log.

nlw2004

Post #4October 29, 2004, 1:14 AM UTC

Thank you so much for replying. I kind of made a mistake in the last step and deleted the wrong something. So I have restarted my whole windows xp but thank you so much for your time at helping me. Thanks and take care.

✨ Ask AI

Ask AI