insomniac21
whats the news on the way to get rid of it?
Spyware / Malware / Virus Removal
Problems With Spyware
16 min read
Siggyx
I have called one of the top guns to take a look, hang in there.
insomniac2100
well so you both know. Im running XP Pro sp1 right now.
Daemon
Hi there
You are running XP Pro? What happened to ME, have you upgraded over the top of it or is it a dual boot? Please post a fresh HJT log.
insomniac2100
I have upgraded to XP Pro. Here is my current log:
Logfile of HijackThis v1.99.1
Scan saved at 11:23:55 AM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Program Files\AIMnewver\aim.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\All Users\Desktop\Folders\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {87567B19-096F-4F6C-B580-7D71E5414CA3} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
O18 - Filter: text/html - {9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O18 - Filter: text/plain - {9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} - C:\WINDOWS\SYSTEM32\ndmdife.dll
Logfile of HijackThis v1.99.1
Scan saved at 11:23:55 AM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Program Files\AIMnewver\aim.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\All Users\Desktop\Folders\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {87567B19-096F-4F6C-B580-7D71E5414CA3} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
O18 - Filter: text/html - {9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O18 - Filter: text/plain - {9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} - C:\WINDOWS\SYSTEM32\ndmdife.dll
Daemon
hmm OK, this is a new challenge - would have been preferable to clean up before upgrading however let's see what we can do.
Do this. Download StartDreck from here. Unzip to its own folder and start the program:
Press 'Config'
Press 'Unmark All'
Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'. Press 'Save' and select the location to save the log file (default is the same folder as the application). Post the log in this thread.
Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.
Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.
Click the Make a Log of what was found button and post the log here in this thread.
Do this. Download StartDreck from here. Unzip to its own folder and start the program:
Press 'Config'
Press 'Unmark All'
Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'. Press 'Save' and select the location to save the log file (default is the same folder as the application). Post the log in this thread.
Click here to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.
Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.
Click the Make a Log of what was found button and post the log here in this thread.
insomniac2100
Alright. Here is the DLLcompare log (there was nothing in the lower pane):
* DLLCompare Log version(1.0.0.125)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________
O^E says: "There were no files found 
"
________________________________________________
1,344 items found: 1,344 files, 0 directories.
Total of file sizes: 251,579,164 bytes 239.92 M
Administrator Account = True
——————–End log———————
And here is the StartDreck log:
StartDreck (build 2.1.7 public stable) - 2005-03-22 @ 15:41:08 (GMT -05:00)
Platform: Windows XP (Win NT 5.1.2600 Service Pack 1)
Internet Explorer: 6.0.2800.1106
Logged in as Carol Tanger at CAROL
»Registry
»Run Keys
»Current User
»Run
»RunOnce
»Default User
»Run
»RunOnce
*Printing Migration=rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters
»Local Machine
»Run
*SystemTray=SysTray.Exe
*AdaptecDirectCD=C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
*sp=rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
*SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
»RunOnce
»RunServices
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»Files
»System/Drivers
»Running Processes
+0=
+4=
+328=\SystemRoot\System32\smss.exe
+436=\??\C:\WINDOWS\system32\csrss.exe
+464=\??\C:\WINDOWS\system32\winlogon.exe
+508=C:\WINDOWS\system32\services.exe
+520=C:\WINDOWS\system32\lsass.exe
+720=C:\WINDOWS\system32\svchost.exe
+744=C:\WINDOWS\System32\svchost.exe
+868=C:\WINDOWS\System32\svchost.exe
+884=C:\WINDOWS\System32\svchost.exe
+1032=C:\WINDOWS\system32\spoolsv.exe
+1216=C:\WINDOWS\system32\srvany.exe
+1264=C:\WINDOWS\System32\svchost.exe
+1324=C:\WINDOWS\system32\resetservice.exe
+1840=C:\WINDOWS\Explorer.EXE
+1924=C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
+1940=C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
+1952=C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
+572=C:\Program Files\AIMnewver\aim.exe
+1460=C:\WINDOWS\System32\rundll32.exe
+396=C:\Program Files\Internet Explorer\IEXPLORE.EXE
+568=C:\Documents and Settings\Carol Tanger\Desktop\startdreck\StartDreck.exe
»Application specific
"
________________________________________________
1,344 items found: 1,344 files, 0 directories.
Total of file sizes: 251,579,164 bytes 239.92 M
Administrator Account = True
——————–End log———————
And here is the StartDreck log:
StartDreck (build 2.1.7 public stable) - 2005-03-22 @ 15:41:08 (GMT -05:00)
Platform: Windows XP (Win NT 5.1.2600 Service Pack 1)
Internet Explorer: 6.0.2800.1106
Logged in as Carol Tanger at CAROL
»Registry
»Run Keys
»Current User
»Run
»RunOnce
»Default User
»Run
»RunOnce
*Printing Migration=rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters
»Local Machine
»Run
*SystemTray=SysTray.Exe
*AdaptecDirectCD=C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
*sp=rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
*SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
»RunOnce
»RunServices
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»Files
»System/Drivers
»Running Processes
+0=
+4=
+328=\SystemRoot\System32\smss.exe
+436=\??\C:\WINDOWS\system32\csrss.exe
+464=\??\C:\WINDOWS\system32\winlogon.exe
+508=C:\WINDOWS\system32\services.exe
+520=C:\WINDOWS\system32\lsass.exe
+720=C:\WINDOWS\system32\svchost.exe
+744=C:\WINDOWS\System32\svchost.exe
+868=C:\WINDOWS\System32\svchost.exe
+884=C:\WINDOWS\System32\svchost.exe
+1032=C:\WINDOWS\system32\spoolsv.exe
+1216=C:\WINDOWS\system32\srvany.exe
+1264=C:\WINDOWS\System32\svchost.exe
+1324=C:\WINDOWS\system32\resetservice.exe
+1840=C:\WINDOWS\Explorer.EXE
+1924=C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
+1940=C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
+1952=C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
+572=C:\Program Files\AIMnewver\aim.exe
+1460=C:\WINDOWS\System32\rundll32.exe
+396=C:\Program Files\Internet Explorer\IEXPLORE.EXE
+568=C:\Documents and Settings\Carol Tanger\Desktop\startdreck\StartDreck.exe
»Application specific
Daemon
Download SpSeHjfix into a folder. Disconnect from the net and Close ALL OPEN PROGRAMS. Run 'SpSeHjfix' and click on "Start Disinfection". When it's finished it will reboot your machine to finish the cleaning process. The tool creates a log of the fix which will appear in the folder.
Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.
Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.
insomniac21
here is the new HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 4:03:20 PM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AIMnewver\aim.exe
C:\Documents and Settings\All Users\Desktop\Folders\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {F89738D5-1B16-4085-B6B1-E9EBCB0D81C3} - C:\WINDOWS\SYSTEM32\ndmdife.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
O18 - Filter: text/html - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O18 - Filter: text/plain - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
and the log the program created:
(3/22/05 3:57:37 PM) SPSeHjFix started v1.09
(3/22/05 3:57:37 PM) OS: WinXP Service Pack 1 (5.1.2600)
(3/22/05 3:57:37 PM) Language: english
(3/22/05 3:57:41 PM) Disinfect started
(3/22/05 3:57:41 PM) Bad-Dll(IEP): se.dll
(3/22/05 3:57:41 PM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\SYSTEM32\ndmdife.dll
(3/22/05 3:57:41 PM) Searchassistant Uninstaller - Keys Deleted
(3/22/05 3:57:41 PM) UBF: 6
(3/22/05 3:57:41 PM) UBB: 1
(3/22/05 3:57:41 PM) FilterKey: HKCR\text/html (deleted)
(3/22/05 3:57:41 PM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(3/22/05 3:57:41 PM) FilterKey: HKCR\CLSID\{9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} (deleted)
(3/22/05 3:57:41 PM) FilterKey: HKCR\text/plain (deleted)
(3/22/05 3:57:41 PM) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(3/22/05 3:57:41 PM) FilterKey: HKCR\CLSID\{9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} (error while deleting)
(3/22/05 3:57:41 PM) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87567B19-096F-4F6C-B580-7D71E5414CA3} (deleted)
(3/22/05 3:57:41 PM) BHO-Key: HKCR\CLSID\{87567B19-096F-4F6C-B580-7D71E5414CA3} (deleted)
(3/22/05 3:57:41 PM) UBR: 4
(3/22/05 3:57:41 PM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(3/22/05 3:57:41 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(3/22/05 3:57:41 PM) File added to delete: c:\windows\system32\ndmdife.dll
(3/22/05 3:57:41 PM) File added to delete: c:\windows\system32\ndmdife.dll
(3/22/05 3:57:41 PM) File added to delete: c:\docume~1\carolt~1\locals~1\temp\se.dll
(3/22/05 3:57:41 PM) Reboot
Logfile of HijackThis v1.99.1
Scan saved at 4:03:20 PM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AIMnewver\aim.exe
C:\Documents and Settings\All Users\Desktop\Folders\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {F89738D5-1B16-4085-B6B1-E9EBCB0D81C3} - C:\WINDOWS\SYSTEM32\ndmdife.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
O18 - Filter: text/html - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O18 - Filter: text/plain - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
and the log the program created:
(3/22/05 3:57:37 PM) SPSeHjFix started v1.09
(3/22/05 3:57:37 PM) OS: WinXP Service Pack 1 (5.1.2600)
(3/22/05 3:57:37 PM) Language: english
(3/22/05 3:57:41 PM) Disinfect started
(3/22/05 3:57:41 PM) Bad-Dll(IEP): se.dll
(3/22/05 3:57:41 PM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\SYSTEM32\ndmdife.dll
(3/22/05 3:57:41 PM) Searchassistant Uninstaller - Keys Deleted
(3/22/05 3:57:41 PM) UBF: 6
(3/22/05 3:57:41 PM) UBB: 1
(3/22/05 3:57:41 PM) FilterKey: HKCR\text/html (deleted)
(3/22/05 3:57:41 PM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(3/22/05 3:57:41 PM) FilterKey: HKCR\CLSID\{9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} (deleted)
(3/22/05 3:57:41 PM) FilterKey: HKCR\text/plain (deleted)
(3/22/05 3:57:41 PM) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(3/22/05 3:57:41 PM) FilterKey: HKCR\CLSID\{9EB9A75A-85BA-4E78-97E9-4FB4D89851C8} (error while deleting)
(3/22/05 3:57:41 PM) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87567B19-096F-4F6C-B580-7D71E5414CA3} (deleted)
(3/22/05 3:57:41 PM) BHO-Key: HKCR\CLSID\{87567B19-096F-4F6C-B580-7D71E5414CA3} (deleted)
(3/22/05 3:57:41 PM) UBR: 4
(3/22/05 3:57:41 PM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(3/22/05 3:57:41 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(3/22/05 3:57:41 PM) File added to delete: c:\windows\system32\ndmdife.dll
(3/22/05 3:57:41 PM) File added to delete: c:\windows\system32\ndmdife.dll
(3/22/05 3:57:41 PM) File added to delete: c:\docume~1\carolt~1\locals~1\temp\se.dll
(3/22/05 3:57:41 PM) Reboot
Daemon
OK. Do this so you can see hidden files and folders - click here to download xphidden.zip. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.
Print out these instructions as the next steps are in Safe Mode and you won't be able to go online.
Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete:
C:\WINDOWS\SYSTEM32\ndmdife.dll
C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll
Don't worry if you can't find them - just move to the next step. Then, with only HJT running, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {F89738D5-1B16-4085-B6B1-E9EBCB0D81C3} - C:\WINDOWS\SYSTEM32\ndmdife.dll (file missing)
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Filter: text/html - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O18 - Filter: text/plain - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
Boot back into Normal Mode, rescan with HJT and post a new log.
Print out these instructions as the next steps are in Safe Mode and you won't be able to go online.
Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete:
C:\WINDOWS\SYSTEM32\ndmdife.dll
C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll
Don't worry if you can't find them - just move to the next step. Then, with only HJT running, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {F89738D5-1B16-4085-B6B1-E9EBCB0D81C3} - C:\WINDOWS\SYSTEM32\ndmdife.dll (file missing)
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll,DllInstall
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Filter: text/html - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
O18 - Filter: text/plain - {C4B0DD3E-E0D4-4ADD-A7B9-BBAC52B874BB} - C:\WINDOWS\SYSTEM32\ndmdife.dll
Boot back into Normal Mode, rescan with HJT and post a new log.
insomniac21
the new log still has some about:blank stuff :
Logfile of HijackThis v1.99.1
Scan saved at 4:31:20 PM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Documents and Settings\All Users\Desktop\spyware stuff\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
Logfile of HijackThis v1.99.1
Scan saved at 4:31:20 PM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Documents and Settings\All Users\Desktop\spyware stuff\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
Daemon
With only HJT running, have it fix these:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
Post a new log when done.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\CAROLT~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
Post a new log when done.
insomniac21
new log.
Logfile of HijackThis v1.99.1
Scan saved at 4:49:53 PM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Documents and Settings\All Users\Desktop\spyware stuff\hijackthis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
Logfile of HijackThis v1.99.1
Scan saved at 4:49:53 PM, on 3/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
C:\Documents and Settings\All Users\Desktop\spyware stuff\hijackthis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - Global Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMnewver\aim.exe
O9 - Extra button: Support - {2E95F975-8082-44A7-A458-EBE9262255F9} - http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Help - {92806424-B730-4D03-B84E-303D3D0057BD} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {D1E787C8-CE90-4C9A-A523-2F5DA9BA052C} - http://www.comcast.net (file missing) (HKCU)
O16 - DPF: Win32 Classes -
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.indiansprings.org/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32846.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{62A760D6-C932-4507-A799-36816593E203}: NameServer = 68.82.0.6,68.82.0.5
Daemon
Well it looks OK now. I guess you want to leave it a day or so to make sure. Post back and let me know.
insomniac21
Thank you so much for both of you guys' help! I will post back to let you know of any developments.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI