What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ad-w-a-r-e.com Keep Taking Over ... Please Help

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Via some down loads I think I infected myself.

Now when I try to surf I get taken to the following pages

http://www.ad-w-a-r-e.com/normal/yyy12.html
http://hits.clickandtrack.net/cgi-bin/hit?…100721388301255

I would like to rid myself of this problem could someone please take a look at my log and give me direction.

Also I found this file in my Temp dir "Perflib_Perfdata_75c.dat" can someone tell me what it is used for?

Logfile of HijackThis v1.99.0
Scan saved at 10:12:37 PM, on 12/25/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\System32\snmp.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\OfficeScan NT\ofcdog.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\System32\DSentry.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\system32\kwuvww.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\For the Fight\A2personal\a2\a2guard.exe
C:\THE FIGHT\PestBlock\PestBlock.exe
C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GuruNet\GuruNet.exe
C:\PROGRA~1\COMMON~1\ATOMIC~1\agtserv.exe
C:\WINDOWS\System32\svchost.exe
C:\OfficeScan NT\pccntupd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\For the Fight\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://nt02.wstf.nasa.gov/exchange/logon.asp
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [a-squared] "C:\For the Fight\A2personal\a2\a2guard.exe"
O4 - HKCU\..\Run: [PestBlock] C:\THE FIGHT\PestBlock\PestBlock.exe -s
O4 - Global Startup: Acrobat Assistant.lnk = C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: GuruNet.lnk = C:\Program Files\GuruNet\GuruNet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O23 - Service: OfficeScanNT RealTime Scan - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Kerio Personal Firewall - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: OfficeScanNT Listener - Unknown - C:\OfficeScan NT\tmlisten.exe
Post #2
Go here, download the FindItNT-2K-XP.zip and extract the files from the zip. Navigate to the Find It NT-2K-XP folder and double-click on find.bat. A command prompt will open and it will search your computer for malicious files. Once it has finished a Notepad window will pop up with output.txt. Copy the entire contents of output.txt into your next post.

Don't reboot from now on unless I instruct it otherwise this pest will morph.
Post #3
Here is the output file Could you tell me what this pest has been named I would like to learn more about how it works? Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F490-98FA Directory of C:\WINDOWS\System32 12/26/2004 02:58 PM 222,630 dwghelp.dll 12/26/2004 02:58 PM 224,106 n6p4lg7q16.dll 12/26/2004 10:30 AM 222,630 hr4805hue.dll 12/25/2004 08:24 PM 225,701 IURTPRIO.DLL 12/25/2004 12:23 AM 224,217 aspmgr.dll 12/24/2004 07:27 PM 224,915 dn6801jue.dll 12/23/2004 08:48 PM 224,489 KZDRU1.DLL 12/23/2004 09:08 AM 223,897 dygest.dll 12/21/2004 07:47 PM 225,347 l0n4la5q1d.dll 12/21/2004 11:30 AM 226,219 aipmgr.dll 12/21/2004 10:21 AM 224,890 dfutil.dll 12/20/2004 11:56 PM 224,890 mcprivs.dll 12/20/2004 11:56 PM 225,920 f0l0la3m1d.dll 12/20/2004 10:51 PM 222,615 jYvacypt.dll 12/20/2004 10:13 PM 224,485 UMRSVPIA.DLL 12/20/2004 01:28 AM 224,810 d4j0le1m1h.dll 12/20/2004 01:00 AM DLLCACHE 12/19/2004 09:51 PM 224,810 dcdmo.dll 12/19/2004 11:56 AM 224,165 myrepl40.dll 12/19/2004 11:22 AM 224,050 irn2l55o1.dll 12/19/2004 11:09 AM 223,448 fpn6035se.dll 12/19/2004 10:59 AM 222,795 j8p00i7me8.dll 01/07/2004 10:19 AM 9,216 Thumbs.db 07/30/2003 06:59 PM Microsoft 22 File(s) 4,720,245 bytes 2 Dir(s) 8,168,005,632 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F490-98FA Directory of C:\WINDOWS\System32 12/21/2004 10:22 AM 24,053 FFASTLOG.TXT 12/20/2004 01:00 AM DLLCACHE 01/07/2004 10:19 AM 9,216 Thumbs.db 10/20/2003 01:08 PM GroupPolicy 08/31/2001 07:00 AM 488 logonui.exe.manifest 08/31/2001 07:00 AM 488 WindowsLogon.manifest 08/31/2001 07:00 AM 749 sapi.cpl.manifest 08/31/2001 07:00 AM 749 nwc.cpl.manifest 08/31/2001 07:00 AM 749 ncpa.cpl.manifest 08/31/2001 07:00 AM 749 cdplayer.exe.manifest 08/31/2001 07:00 AM 749 wuaucpl.cpl.manifest 9 File(s) 37,990 bytes 2 Dir(s) 8,167,997,440 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is F490-98FA Directory of C:\WINDOWS\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is F490-98FA Directory of C:\WINDOWS\System32 08/18/2001 05:00 AM 2,577 CONFIG.TMP 1 File(s) 2,577 bytes 0 Dir(s) 8,167,997,440 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{152DF359-D977-4294-96F6-FF62FBD36475}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] "Asynchronous"=dword:00000000 "DllName"="" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Paths] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\hr4805hue.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" —————- Xfind Results —————– C:\WINDOWS\System32\DWGHELP.DLL +++ File read error ————– Locate.com Results ————— C:\WINDOWS\SYSTEM32\ aipmgr.dll Tue Dec 21 2004 11:30:20a ..S.R 226,219 220.91 K aspmgr.dll Sat Dec 25 2004 12:23:08a ..S.R 224,217 218.96 K d4j0le~1.dll Mon Dec 20 2004 1:28:30a ..S.R 224,810 219.54 K dcdmo.dll Sun Dec 19 2004 9:51:34p ..S.R 224,810 219.54 K dfutil.dll Tue Dec 21 2004 10:21:46a ..S.R 224,890 219.62 K dn6801~1.dll Fri Dec 24 2004 7:27:14p ..S.R 224,915 219.64 K dwghelp.dll Sun Dec 26 2004 2:58:06p ..S.R 222,630 217.41 K dygest.dll Thu Dec 23 2004 9:08:48a ..S.R 223,897 218.65 K f0l0la~1.dll Mon Dec 20 2004 11:56:58p ..S.R 225,920 220.63 K ffastlog.txt Tue Dec 21 2004 10:22:20a A..H. 24,053 23.49 K fpn603~1.dll Sun Dec 19 2004 11:09:50a ..S.R 223,448 218.21 K hr4805~1.dll Sun Dec 26 2004 10:30:52a ..S.R 222,630 217.41 K irn2l5~1.dll Sun Dec 19 2004 11:22:58a ..S.R 224,050 218.80 K iurtprio.dll Sat Dec 25 2004 8:24:56p ..S.R 225,701 220.41 K j8p00i~1.dll Sun Dec 19 2004 10:59:10a ..S.R 222,795 217.57 K jyvacypt.dll Mon Dec 20 2004 10:51:22p ..S.R 222,615 217.39 K kzdru1.dll Thu Dec 23 2004 8:48:38p ..S.R 224,489 219.23 K l0n4la~1.dll Tue Dec 21 2004 7:47:36p ..S.R 225,347 220.06 K mcprivs.dll Mon Dec 20 2004 11:56:58p ..S.R 224,890 219.62 K myrepl40.dll Sun Dec 19 2004 11:56:22a ..S.R 224,165 218.91 K n6p4lg~1.dll Sun Dec 26 2004 2:58:06p ..S.R 224,106 218.85 K umrsvpia.dll Mon Dec 20 2004 10:13:48p ..S.R 224,485 219.22 K 22 items found: 22 files, 0 directories. Total of file sizes: 4,735,082 bytes 4.52 M 
Post #4 last edited
It has a number of names, Look2Me and VX2 being the most common.

Click here to download LSPFix. Extract the program from the zip file and run it, make sure you click the "I know what I'm doing" button. Select calsp.dll and using the right-pointing 'arrows' and move all instances of calsp.dll it mentions to the Remove (RHS) side but leave everything else (it might already be over there when you open LSPFix). Repeat for aklsp.dll. Click the 'Finished' button (if you exit with the X at top right nothing happens). Don't worry if they are not there - just skip this step.

Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file to your desktop.

Stay offline with the infected machine until this is complete.

Start Killbox and click on Tools->Delete Temp Files.

When that finishes, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\WINDOWS\system32\dwghelp.dll
C:\WINDOWS\system32\n6p4lg7q16.dll
C:\WINDOWS\system32\hr4805hue.dll
C:\WINDOWS\system32\IURTPRIO.DLL
C:\WINDOWS\system32\aspmgr.dll
C:\WINDOWS\system32\dn6801jue.dll
C:\WINDOWS\system32\KZDRU1.DLL
C:\WINDOWS\system32\dygest.dll
C:\WINDOWS\system32\l0n4la5q1d.dll
C:\WINDOWS\system32\aipmgr.dll
C:\WINDOWS\system32\dfutil.dll
C:\WINDOWS\system32\mcprivs.dll
C:\WINDOWS\system32\f0l0la3m1d.dll
C:\WINDOWS\system32\jYvacypt.dll
C:\WINDOWS\system32\UMRSVPIA.DLL
C:\WINDOWS\system32\d4j0le1m1h.dll
C:\WINDOWS\system32\dcdmo.dll
C:\WINDOWS\system32\myrepl40.dll
C:\WINDOWS\system32\irn2l55o1.dll
C:\WINDOWS\system32\fpn6035se.dll
C:\WINDOWS\system32\j8p00i7me8.dll
C:\WINDOWS\system32\guard.tmp
C:\\WINDOWS\\system32\\hr4805hue.dll
C:\\WINDOWS\\system32\\guard.tmp

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

When it reboots, with only HJT running, have it fix:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

Please post a new HJT log and Findit log again.
Post #5
Logfile of HijackThis v1.99.0
Scan saved at 8:01:44 AM, on 12/27/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\System32\snmp.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINDOWS\system32\fxssvc.exe
C:\OfficeScan NT\ofcdog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\System32\DSentry.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\system32\kwuvww.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
C:\OfficeScan NT\pccntupd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\For the Fight\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://nt02.wstf.nasa.gov/exchange/logon.asp
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [a-squared] "C:\For the Fight\A2personal\a2\a2guard.exe"
O4 - HKCU\..\Run: [PestBlock] C:\THE FIGHT\PestBlock\PestBlock.exe -s
O4 - Global Startup: Acrobat Assistant.lnk = C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: GuruNet.lnk = C:\Program Files\GuruNet\GuruNet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: strings.exe
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O23 - Service: OfficeScanNT RealTime Scan - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Kerio Personal Firewall - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: OfficeScanNT Listener - Unknown - C:\OfficeScan NT\tmlisten.exe


Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is F490-98FA

Directory of C:\WINDOWS\System32

12/20/2004 01:00 AM DLLCACHE
01/07/2004 10:19 AM 9,216 Thumbs.db
07/30/2003 06:59 PM Microsoft
1 File(s) 9,216 bytes
2 Dir(s) 8,474,071,040 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is F490-98FA

Directory of C:\WINDOWS\System32

12/21/2004 10:22 AM 24,053 FFASTLOG.TXT
12/20/2004 01:00 AM DLLCACHE
01/07/2004 10:19 AM 9,216 Thumbs.db
10/20/2003 01:08 PM GroupPolicy
08/31/2001 07:00 AM 488 logonui.exe.manifest
08/31/2001 07:00 AM 488 WindowsLogon.manifest
08/31/2001 07:00 AM 749 sapi.cpl.manifest
08/31/2001 07:00 AM 749 nwc.cpl.manifest
08/31/2001 07:00 AM 749 ncpa.cpl.manifest
08/31/2001 07:00 AM 749 cdplayer.exe.manifest
08/31/2001 07:00 AM 749 wuaucpl.cpl.manifest
9 File(s) 37,990 bytes
2 Dir(s) 8,474,066,944 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is F490-98FA

Directory of C:\WINDOWS\System32


——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is F490-98FA

Directory of C:\WINDOWS\System32

08/18/2001 05:00 AM 2,577 CONFIG.TMP
1 File(s) 2,577 bytes
0 Dir(s) 8,474,066,944 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{152DF359-D977-4294-96F6-FF62FBD36475}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Themes]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\n6p4lg7q16.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


—————- Xfind Results —————–


————– Locate.com Results —————


C:\WINDOWS\SYSTEM32\
ffastlog.txt Tue Dec 21 2004 10:22:20a A..H. 24,053 23.49 K

1 item found: 1 file, 0 directories.
Total of file sizes: 24,053 bytes 23.49 K

Post #6
Well done - little bit more to finish off. Click here to download vx2fix6.zip. Extract vx2fix6.reg from the zip file and copy it to the desktop of the infected computer. When done, double click the vx2fix6.reg and when asked to merge say yes.

Click Start, Run and type cmd. Press OK. A DOS window will open. Type the following and then press Enter after typing each one:

attrib -h -s c:\recycler

del c:\recycler

Close the window and REBOOT. Check if the Recycle Bin is OK. Please report back and let me know how it is running.
Post #7
This seems to have taken care of most of my problems. … Thank you I am having troulbe with Clkoptimizer and everything seems to be running slow. Should I do a new post to get help with this problem? Again thanks for you help
Post #9
I am getting popups that at first are address to Clkoptimizer then are directed to an ad of some sort. If I leave my machine on for an hour or so I come back to about 10 popups that have been forced open. I am using the yahoo popup blocker with has worked well in the past which leads me to think this Clkoptimizer has put something on my machine.
Post #10
Click here to download mwavscan. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.
Post #11
File C:\WINDOWS\system32\qhulhh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\IEMenuExtension.exe infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken. File C:\WINDOWS\xgjsysk.exe infected by "Trojan-Downloader.Win32.Envolo.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\aepiee.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\kwuvww.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\lv0409dqe.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\qhulhh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\vpuwpp.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\aipmgr.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\aspmgr.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\d4j0le1m1h.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\dcdmo.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\dfutil.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\dn6801jue.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\dygest.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\f0l0la3m1d.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\fpn6035se.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\irn2l55o1.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\IURTPRIO.DLL infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\j8p00i7me8.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\jYvacypt.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\KZDRU1.DLL infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\l0n4la5q1d.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\mcprivs.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\myrepl40.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\!Submit\UMRSVPIA.DLL infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\lstarrit\Application Data\Webroot\Spy Sweeper\Backup\Startup\nhgkhh.exe.bak infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\memory stick\PMI\setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\OfficeScan NT\SUSPECT\ar3[1].jar infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: No Action Taken. File C:\OfficeScan NT\SUSPECT\DLLHOST.EXE infected by "Worm.Win32.Welchia.a" Virus. Action Taken: No Action Taken. File C:\OfficeScan NT\SUSPECT\DLLHOST.VIR infected by "Worm.Win32.Welchia.a" Virus. Action Taken: No Action Taken. File C:\Program Files\IEMenuExtension\tbextn.dll infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken. File C:\Program Files\Windows ControlAd\WinCtlAdShift.dll infected by "Trojan-Downloader.Win32.Agent.gf" Virus. Action Taken: No Action Taken. File C:\Program Files\Windows ServeAd\WinAtServ.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\Second Folder\Music\Rosetta Stone Language-Learning (Spanish - French - Deutsch - Italian - Chinese - Japanese).zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\IEMenuExtension.exe infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\aepiee.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\kwuvww.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\lv0409dqe.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\qhulhh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\vpuwpp.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2DI7XIT8\track[1].html infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\WINDOWS\xgjsysk.exe infected by "Trojan-Downloader.Win32.Envolo.b" Virus. Action Taken: No Action Taken.
Post #12
Start Killbox and click on Tools->Delete Temp Files.

When that finishes, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\OfficeScan NT\SUSPECT\ar3[1].jar
C:\OfficeScan NT\SUSPECT\DLLHOST.EXE
C:\OfficeScan NT\SUSPECT\DLLHOST.VIR
C:\Program Files\IEMenuExtension\tbextn.dll
C:\Program Files\Windows ControlAd\WinCtlAdShift.dll
C:\Program Files\Windows ServeAd\WinAtServ.dll
C:\WINDOWS\IEMenuExtension.exe
C:\WINDOWS\SYSTEM32\aepiee.dll
C:\WINDOWS\SYSTEM32\kwuvww.exe
C:\WINDOWS\system32\lv0409dqe.dll
C:\WINDOWS\SYSTEM32\mac80ex.idf
C:\WINDOWS\system32\netut80ex.vxd
C:\WINDOWS\system32\pculcc.dll
C:\WINDOWS\system32\psis80ex.ax
C:\WINDOWS\system32\qhulhh.exe
C:\WINDOWS\system32\vpuwpp.dat
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2DI7XIT8\track[1].html
C:\WINDOWS\xgjsysk.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Please post a new HJT log and MWAVSCAN log again.
Post #13
File C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\nhgkhh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\aepiee.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\qhulhh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\vpuwpp.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\lstarrit\LOCALS~1\Temp\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\!Submit\aipmgr.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\ar3[1].jar infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: No Action Taken.
File C:\!Submit\aspmgr.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\d4j0le1m1h.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\dcdmo.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\dfutil.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\DLLHOST.EXE infected by "Worm.Win32.Welchia.a" Virus. Action Taken: No Action Taken.
File C:\!Submit\DLLHOST.VIR infected by "Worm.Win32.Welchia.a" Virus. Action Taken: No Action Taken.
File C:\!Submit\dn6801jue.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\dygest.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\f0l0la3m1d.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\fpn6035se.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\IEMenuExtension.exe infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken.
File C:\!Submit\irn2l55o1.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\IURTPRIO.DLL infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\j8p00i7me8.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\jYvacypt.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\KZDRU1.DLL infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\l0n4la5q1d.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\lv0409dqe.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\!Submit\mcprivs.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\myrepl40.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\!Submit\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\!Submit\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\!Submit\tbextn.dll infected by "not-a-virus:AdWare.ToolBar.Ucmore" Virus. Action Taken: No Action Taken.
File C:\!Submit\UMRSVPIA.DLL infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\!Submit\vpuwpp.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\!Submit\WinAtServ.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
File C:\!Submit\WinCtlAdShift.dll infected by "Trojan-Downloader.Win32.Agent.gf" Virus. Action Taken: No Action Taken.
File C:\!Submit\xgjsysk.exe infected by "Trojan-Downloader.Win32.Envolo.b" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\lstarrit\Application Data\Webroot\Spy Sweeper\Backup\Startup\nhgkhh.exe.bak infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\lstarrit\Local Settings\Temp\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\memory stick\PMI\setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Second Folder\Music\Rosetta Stone Language-Learning (Spanish - French - Deutsch - Italian - Chinese - Japanese).zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\SYSTEM32\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\vpuwpp.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2DI7XIT8\track[1].html infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.



HJT
Logfile of HijackThis v1.99.0
Scan saved at 8:36:31 PM, on 1/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\System32\snmp.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINDOWS\system32\fxssvc.exe
C:\OfficeScan NT\ofcdog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\System32\DSentry.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\For the Fight\A2personal\a2\a2guard.exe
C:\THE FIGHT\PestBlock\PestBlock.exe
C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GuruNet\GuruNet.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nhgkhh.exe
C:\PROGRA~1\COMMON~1\ATOMIC~1\agtserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\lstarrit\LOCALS~1\Temp\mwavscan.com
C:\DOCUME~1\lstarrit\LOCALS~1\Temp\kavss.exe
C:\For the Fight\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://nt02.wstf.nasa.gov/exchange/logon.asp
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [a-squared] "C:\For the Fight\A2personal\a2\a2guard.exe"
O4 - HKCU\..\Run: [PestBlock] C:\THE FIGHT\PestBlock\PestBlock.exe -s
O4 - Global Startup: Acrobat Assistant.lnk = C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: GuruNet.lnk = C:\Program Files\GuruNet\GuruNet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: strings.exe
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O23 - Service: OfficeScanNT RealTime Scan - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Kerio Personal Firewall - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: OfficeScanNT Listener - Unknown - C:\OfficeScan NT\tmlisten.exe
Post #14 last edited
Use the Killbox on these in the same manner:

C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\Programs\Startup\nhgkhh.exe
C:\WINDOWS\system32\aepiee.dll
C:\WINDOWS\system32\pculcc.dll
C:\WINDOWS\system32\qhulhh.exe
C:\WINDOWS\system32\pculcc.dll
C:\WINDOWS\system32\vpuwpp.dat
C:\WINDOWS\SYSTEM32\pculcc.dll
C:\WINDOWS\SYSTEM32\vpuwpp.dat
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\2DI7XIT8\track[1].html

Post a new HJT log and mwavscan log when done.
Post #15
Logfile of HijackThis v1.99.0
Scan saved at 12:15:15 PM, on 1/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\System32\snmp.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\ofcdog.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\System32\DSentry.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\For the Fight\A2personal\a2\a2guard.exe
C:\THE FIGHT\PestBlock\PestBlock.exe
C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GuruNet\GuruNet.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nhgkhh.exe
C:\PROGRA~1\COMMON~1\ATOMIC~1\agtserv.exe
C:\WINDOWS\System32\svchost.exe
C:\OfficeScan NT\pccntupd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\lstarrit\LOCALS~1\Temp\mwavscan.com
C:\DOCUME~1\lstarrit\LOCALS~1\Temp\kavss.exe
C:\For the Fight\Hijack\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [a-squared] "C:\For the Fight\A2personal\a2\a2guard.exe"
O4 - HKCU\..\Run: [PestBlock] C:\THE FIGHT\PestBlock\PestBlock.exe -s
O4 - Global Startup: Acrobat Assistant.lnk = C:\Second Folder\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: GuruNet.lnk = C:\Program Files\GuruNet\GuruNet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: strings.exe
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O23 - Service: OfficeScanNT RealTime Scan - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Kerio Personal Firewall - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: OfficeScanNT Listener - Unknown - C:\OfficeScan NT\tmlisten.exe

escan log
File C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\nhgkhh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\aepiee.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\qhulhh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\pculcc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\vpuwpp.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\lstarrit\LOCALS~1\Temp\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI