i'm sure i'm the dumbest ever please help to remove this hijacker ran search and destroy, spy blaster, and pc cillin rebboted and ran log for hijack this
Logfile of HijackThis v1.99.1
Scan saved at 1:38:17 PM, on 4/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {62A3E0D2-A2CB-4548-8676-A99BA1AAF2B5} - C:\WINDOWS\System32\pfmh.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Filter: text/html - {62C8A99F-3A71-46B4-9E2F-A07FB362B8A1} - C:\WINDOWS\System32\pfmh.dll
O18 - Filter: text/plain - {62C8A99F-3A71-46B4-9E2F-A07FB362B8A1} - C:\WINDOWS\System32\pfmh.dll
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
Hello firefighter eddie and welcome to TomCoyote.
You may want to print out these instructions or save them to your desktop as a text file with Notepad because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet.
Prepare CWShredder for use: Download CWShredder . Save CWShredder.exe to a convenient location. Please do not do anything with it yet. Prepare SpSeHjfix Download SpSeHjfix from here . Unzip the contents of SpSeHjfix112.zip. Please do not do anything with it yet. Clean out temporary files: Start | Run | type cleanmgr | OK Let it scan your system for files to remove. Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked. Click "OK " to remove them. Click "Yes " to confirm the deletion. Boot into Safe Mode:
Restart your computer and immediately begin tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.
Disconnect from the Internet and Close ALL OPEN PROGRAMS. Run 'SpSeHjfix'. and click on "Start Disinfection". When it's finished it will reboot your machine to finish the cleaning process. The tool creates a log of the fix which will appear in the folder. Run CWShredder: Double-click on CWShredder.exe. Click "Fix -> " and click "OK " at the prompt. CWShredder will scan and clean your system of CWS files. Click "Next-> " and then "Exit ". Reboot and repeat the process above. Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.
Alan
I di exactly as requested here are the logs you requested
Logfile of HijackThis v1.99.1
Scan saved at 12:07:05 PM, on 5/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll__SpybotSDDisabled (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
(5/2/05 11:56:33 AM) SPSeHjFix started v1.1.2
(5/2/05 11:56:33 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/2/05 11:56:33 AM) Language: english
(5/2/05 11:56:33 AM) Win-Path: C:\WINDOWS
(5/2/05 11:56:33 AM) System-Path: C:\WINDOWS\System32
(5/2/05 11:56:33 AM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(5/2/05 11:56:44 AM) Disinfection started
(5/2/05 11:56:44 AM) Bad-Dll(IEP): c:\docume~1\admini~1\locals~1\temp\se.dll
(5/2/05 11:56:44 AM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\pfmh.dll
(5/2/05 11:56:44 AM) Searchassistant Uninstaller - Keys Deleted
(5/2/05 11:56:44 AM) UBF: 6 - UBB: 5 - UBR: 2
(5/2/05 11:56:44 AM) FilterKey: HKCR\text/html (deleted)
(5/2/05 11:56:44 AM) FilterKey: HKCR\CLSID\{41D0EFCB-614D-4EA1-BA8B-B571468ACA9E} (deleted)
(5/2/05 11:56:44 AM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(5/2/05 11:56:44 AM) FilterKey: HKCR\text/plain (deleted)
(5/2/05 11:56:44 AM) FilterKey: HKCR\CLSID\{41D0EFCB-614D-4EA1-BA8B-B571468ACA9E} (error while deleting)
(5/2/05 11:56:44 AM) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(5/2/05 11:56:44 AM) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A0CB886-BFEA-4229-962B-7C458F3E1E1C} (deleted)
(5/2/05 11:56:44 AM) BHO-Key: HKCR\CLSID\{0A0CB886-BFEA-4229-962B-7C458F3E1E1C} (deleted)
(5/2/05 11:56:44 AM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(5/2/05 11:56:44 AM) UBF: 4 - UBB: 4 - UBR: 1
(5/2/05 11:56:44 AM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\admini~1\locals~1\temp\se.dll/spage.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\owner\locals~1\temp\se.dll/spage.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(5/2/05 11:56:44 AM) Stealth-String not found
(5/2/05 11:56:44 AM) File added to delete: c:\windows\system32\pfmh.dll
(5/2/05 11:56:44 AM) File added to delete: c:\docume~1\owner\locals~1\temp\se.dll
(5/2/05 11:56:44 AM) Reboot
(5/2/05 12:00:54 PM) SPSeHjFix started v1.1.2
(5/2/05 12:00:54 PM) OS: WinXP Service Pack 1 (5.1.2600)
(5/2/05 12:00:54 PM) Language: english
(5/2/05 12:00:54 PM) Win-Path: C:\WINDOWS
(5/2/05 12:00:54 PM) System-Path: C:\WINDOWS\System32
(5/2/05 12:00:54 PM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(5/2/05 12:01:09 PM) Disinfection started
(5/2/05 12:01:09 PM) Bad-Dll(IEP): (not found)
(5/2/05 12:01:09 PM) Bad-Dll(IEP) in BHO: (not found)
(5/2/05 12:01:09 PM) UBF: 4 - UBB: 4 - UBR: 2
(5/2/05 12:01:09 PM) UBF: 4 - UBB: 4 - UBR: 2
(5/2/05 12:01:09 PM) Bad IE-pages: (none)
(5/2/05 12:01:09 PM) Stealth-String not found
(5/2/05 12:01:09 PM) Not infected->END
(5/2/05 12:05:32 PM) SPSeHjFix started v1.1.2
(5/2/05 12:05:32 PM) OS: WinXP Service Pack 1 (5.1.2600)
(5/2/05 12:05:32 PM) Language: english
(5/2/05 12:05:32 PM) Win-Path: C:\WINDOWS
(5/2/05 12:05:32 PM) System-Path: C:\WINDOWS\System32
(5/2/05 12:05:32 PM) Temp-Path: C:\DOCUME~1\Owner\LOCALS~1\Temp\
(5/2/05 11:56:33 AM) SPSeHjFix started v1.1.2
(5/2/05 11:56:33 AM) OS: WinXP Service Pack 1 (5.1.2600)
(5/2/05 11:56:33 AM) Language: english
(5/2/05 11:56:33 AM) Win-Path: C:\WINDOWS
(5/2/05 11:56:33 AM) System-Path: C:\WINDOWS\System32
(5/2/05 11:56:33 AM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(5/2/05 11:56:44 AM) Disinfection started
(5/2/05 11:56:44 AM) Bad-Dll(IEP): c:\docume~1\admini~1\locals~1\temp\se.dll
(5/2/05 11:56:44 AM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\pfmh.dll
(5/2/05 11:56:44 AM) Searchassistant Uninstaller - Keys Deleted
(5/2/05 11:56:44 AM) UBF: 6 - UBB: 5 - UBR: 2
(5/2/05 11:56:44 AM) FilterKey: HKCR\text/html (deleted)
(5/2/05 11:56:44 AM) FilterKey: HKCR\CLSID\{41D0EFCB-614D-4EA1-BA8B-B571468ACA9E} (deleted)
(5/2/05 11:56:44 AM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(5/2/05 11:56:44 AM) FilterKey: HKCR\text/plain (deleted)
(5/2/05 11:56:44 AM) FilterKey: HKCR\CLSID\{41D0EFCB-614D-4EA1-BA8B-B571468ACA9E} (error while deleting)
(5/2/05 11:56:44 AM) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(5/2/05 11:56:44 AM) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A0CB886-BFEA-4229-962B-7C458F3E1E1C} (deleted)
(5/2/05 11:56:44 AM) BHO-Key: HKCR\CLSID\{0A0CB886-BFEA-4229-962B-7C458F3E1E1C} (deleted)
(5/2/05 11:56:44 AM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(5/2/05 11:56:44 AM) UBF: 4 - UBB: 4 - UBR: 1
(5/2/05 11:56:44 AM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\admini~1\locals~1\temp\se.dll/spage.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\owner\locals~1\temp\se.dll/spage.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(5/2/05 11:56:44 AM) Stealth-String not found
(5/2/05 11:56:44 AM) File added to delete: c:\windows\system32\pfmh.dll
(5/2/05 11:56:44 AM) File added to delete: c:\docume~1\owner\locals~1\temp\se.dll
(5/2/05 11:56:44 AM) Reboot
(5/2/05 12:00:54 PM) SPSeHjFix started v1.1.2
(5/2/05 12:00:54 PM) OS: WinXP Service Pack 1 (5.1.2600)
(5/2/05 12:00:54 PM) Language: english
(5/2/05 12:00:54 PM) Win-Path: C:\WINDOWS
(5/2/05 12:00:54 PM) System-Path: C:\WINDOWS\System32
(5/2/05 12:00:54 PM) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(5/2/05 12:01:09 PM) Disinfection started
(5/2/05 12:01:09 PM) Bad-Dll(IEP): (not found)
(5/2/05 12:01:09 PM) Bad-Dll(IEP) in BHO: (not found)
(5/2/05 12:01:09 PM) UBF: 4 - UBB: 4 - UBR: 2
(5/2/05 12:01:09 PM) UBF: 4 - UBB: 4 - UBR: 2
(5/2/05 12:01:09 PM) Bad IE-pages: (none)
(5/2/05 12:01:09 PM) Stealth-String not found
(5/2/05 12:01:09 PM) Not infected->END
(5/2/05 12:05:32 PM) SPSeHjFix started v1.1.2
(5/2/05 12:05:32 PM) OS: WinXP Service Pack 1 (5.1.2600)
(5/2/05 12:05:32 PM) Language: english
(5/2/05 12:05:32 PM) Win-Path: C:\WINDOWS
(5/2/05 12:05:32 PM) System-Path: C:\WINDOWS\System32
(5/2/05 12:05:32 PM) Temp-Path: C:\DOCUME~1\Owner\LOCALS~1\Temp\
Please run the above process one more time.R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Owner\LOCALS~1\Temp\se.dll/spage.html fix checked
Alan
i'm not sure if i replied to this thread right or not.
i did as requested computer acting ok for now here is the results
thanks for all help eddie
Logfile of HijackThis v1.99.1
Scan saved at 10:42:57 PM, on 5/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll__SpybotSDDisabled (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
Your new log is clean.
Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)
1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK twice, and then click Yes when you are prompted to restart the computer.
4. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore'
MOST IMPORTANT : You Need to Update Windows and IE to get all the Latest Security Patches to protect your computer from the malware that is on the internet.
I recommend going to the following link and update to SP2. This adds more security and extra features including a pop-up blocker for Internet Explorer.
Microsoft Windows and Internet Explorer Updates
Here is a great link that explains the procedure for updating to SP2 with less complications (scroll down to the second post).
Now that everything is fixed, I suggest that you get these programs to help keep the computer clean:
Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - Safer alternative to the Internet Explorer web browser.
AVG AntiVirus -
Free antivirus program if you currently are not using one.
ZoneAlarm -
Free firewall program if you currently are not using one.
Here are three very good and
free malware scanners:
Spybot Search and Destroy 1.3
AdAware SE v1.05
Set-up Instructions for Spybot S&D; and Adaware SE
A2 Squared
If you have them already, check to make sure that they are the newest version.
Update these regularly.
You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.
Be sure to keep Windows and your Anti-virus updated.
