Jacked PC

akatkin Topic Starter

Post #1April 29, 2005, 2:35 PM UTC

This PC is infected with the Ibis toolbar (and possibly other spyware as well.) AdAware was run recently but was not successful in removing all of the offenders. Here's the log. What should we do?

Logfile of HijackThis v1.99.1
Scan saved at 8:24:20 PM, on 4/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\Program Files\Mqmiy\Nikjwjj.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe C:\WINDOWS\system32\exp.exe C:\WINDOWS\system32\wintask.exe C:\Program Files\Media Access\MediaAccK.exe C:\WINDOWS\system32\dtapy\nbla.exe
C:\Program Files\Media Access\MediaAccess.exe C:\WINDOWS\system32\iobgcmf\jspql.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\WINDOWS\system32\uyhq\reur.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\WINDOWS\system32\ujpesww\sler.exe
C:\WINDOWS\system32\xrfqkrlk\kqvx.exe
C:\WINDOWS\system32\lkfj\lfxwu.exe
C:\WINDOWS\system32\bvmvg\ogua.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINDOWS\system32\cbbhnnqm\innkuaw.exe
C:\WINDOWS\system32\nsvsvc\nsvsvc.exe
C:\WINDOWS\system32\picsvr\picsvr.exe
C:\WINDOWS\system32\ewbxfkx\xjcnkfoi.exe
C:\WINDOWS\system32\osmtwk\abdcwra.exe
C:\WINDOWS\system32\vtsacky\ybsrbtj.exe
C:\WINDOWS\system32\lakw\emkewdfo.exe
C:\WINDOWS\system32\keagynrn\fndyclms.exe
C:\WINDOWS\system32\ehem\rwvkplil.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe C:\WINDOWS\system32\mcalsapi.exe C:\Program Files\NaviSearch\bin\nls.exe C:\Program Files\CashBack\bin\cashback.exe C:\WINDOWS\system32\ap9h4qmo.exe C:\WINDOWS\EEPFDLL.EXE C:\WINDOWS\EEPFENC.EXE C:\WINDOWS\system32\ivnsmjcs\rhwm.exe
C:\DOCUME~1\lisa\LOCALS~1\Temp\See04152005.exe
C:\WINDOWS\system32\ivnsmjcs\rhwm.exe
C:\windows\system32\rsdxregw.exe
C:\WINDOWS\system32\tsysuyd8.exe
C:\Program Files\Bpt\bpt.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe C:\program files\internet explorer\iexplore.exe C:\WINDOWS\system32\rzrrvr.exe C:\WINDOWS\system32\GSMedia3.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ltficom.exe C:\Program Files\Greetings Workshop\GWREMIND.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\iobgcmf\jspql.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\CxtPls\CxtPls.exe C:\Program Files\BullsEye Network\bin\bargains.exe c:\windows\system32\fadtvu.exe C:\Program Files\Juno\bin\juno.exe C:\Program Files\Juno\qsacc\x1exec.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe
c:\Program Files\Microsoft Money\System\urlmap.exe C:\Program Files\Internet Explorer\iexplore.exe C:\DOCUME~1\lisa\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://store.presario.net/scripts/redirect…&c=2c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://store.presario.net/scripts/redirect…&c=1c02&lc=0409
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183}
- (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: (no name) - {00000000-DD60-0064-6EC2-6E0100000000} - (no file)
O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file)
O2 - BHO: (no name) - {00000049-8F91-4D9C-9573-F016E7626484} - (no file)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
O2 - BHO: Yahoo! Companion BHO -
{02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: MyWay Search Assistant BHO -
{04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\Juno\qsacc\X1IEBHO.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nsd3CC.dll
O2 - BHO: NLS UrlCatcher Class -
{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C60A737A-40D7-01AE-054C-C8A7ADA52EB9} - C:\WINDOWS\system32\wwqpubbd\fnlixdxf.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14}
- C:\WINDOWS\system32\mscb.dll
O2 - BHO: ADP UrlCatcher Class -
{F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC}
- C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: Microbuddy - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - C:\Program Files\MBKWBar\IEToolBar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [DDCM] "C:\Program
Files\WildTangent\DDC\DDCManager\DDCMan.exe" -Background
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [PhilipsRemote] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\PhilipsRemote.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [Poajpb] C:\Program Files\Mqmiy\Nikjwjj.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\system32\pacis.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [nbla] C:\WINDOWS\system32\dtapy\nbla.exe
O4 - HKLM\..\Run: [rhwm] C:\WINDOWS\system32\ivnsmjcs\rhwm.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitexxe32.exe
O4 - HKLM\..\Run: [jspql] C:\WINDOWS\system32\iobgcmf\jspql.exe
O4 - HKLM\..\Run: [reur] C:\WINDOWS\system32\uyhq\reur.exe
O4 - HKLM\..\Run: [sler] C:\WINDOWS\system32\ujpesww\sler.exe
O4 - HKLM\..\Run: [myem] C:\WINDOWS\system32\johscdc\myem.exe
O4 - HKLM\..\Run: [yxsfwvac] C:\WINDOWS\system32\atffer\yxsfwvac.exe
O4 - HKLM\..\Run: [yuoorm] C:\WINDOWS\system32\hurhhiet\yuoorm.exe
O4 - HKLM\..\Run: [tqjqlq] C:\WINDOWS\system32\xinsej\tqjqlq.exe
O4 - HKLM\..\Run: [kqvx] C:\WINDOWS\system32\xrfqkrlk\kqvx.exe
O4 - HKLM\..\Run: [lfxwu] C:\WINDOWS\system32\lkfj\lfxwu.exe
O4 - HKLM\..\Run: [ogua] C:\WINDOWS\system32\bvmvg\ogua.exe
O4 - HKLM\..\Run: [innkuaw] C:\WINDOWS\system32\cbbhnnqm\innkuaw.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\system32\gah95on6.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\system32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [xjcnkfoi] C:\WINDOWS\system32\ewbxfkx\xjcnkfoi.exe
O4 - HKLM\..\Run: [abdcwra] C:\WINDOWS\system32\osmtwk\abdcwra.exe
O4 - HKLM\..\Run: [rbbrivv] C:\WINDOWS\system32\wsjc\rbbrivv.exe
O4 - HKLM\..\Run: [wggclhht] C:\WINDOWS\system32\ehvbc\wggclhht.exe
O4 - HKLM\..\Run: [ybsrbtj] C:\WINDOWS\system32\vtsacky\ybsrbtj.exe
O4 - HKLM\..\Run: [ejmgjstr] C:\WINDOWS\system32\xuerqmak\ejmgjstr.exe
O4 - HKLM\..\Run: [emkewdfo] C:\WINDOWS\system32\lakw\emkewdfo.exe
O4 - HKLM\..\Run: [fndyclms] C:\WINDOWS\system32\keagynrn\fndyclms.exe
O4 - HKLM\..\Run: [rwvkplil] C:\WINDOWS\system32\ehem\rwvkplil.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [gsnb] C:\WINDOWS\system32\yfjbnwgv\gsnb.exe
O4 - HKLM\..\Run: [wdskctl] C:\WINDOWS\wdskctl.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [uFEQ39l] mcalsapi.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\gkkqt.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [salm] c:\windows\salm.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\system32\ap9h4qmo.exe
O4 - HKLM\..\Run: [SAHBundle]
C:\DOCUME~1\lisa\LOCALS~1\Temp\BundleLite_westfrontier1001.exe run
O4 - HKLM\..\Run: [EEPFDLL] C:\WINDOWS\EEPFDLL.EXE
O4 - HKLM\..\Run: [EEPFENC] C:\WINDOWS\EEPFENC.EXE
O4 - HKLM\..\Run: [Visual Element FX5]
C:\DOCUME~1\lisa\LOCALS~1\Temp\See04152005.exe
O4 - HKLM\..\Run: [ZStart] C:\windows\system32\rsdxregw.exe 0
O4 - HKLM\..\Run: [SysStart] C:\WINDOWS\system32\tsysuyd8.exe
O4 - HKLM\..\Run: [BPT] "C:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [Breg] "C:\Program Files\Common Files\Java\bptre.exe"
O4 - HKLM\..\Run: [DI2] "C:\DOCUME~1\lisa\LOCALS~1\Temp\27.exe\27.exe"
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzrrvr.exe
O4 - HKLM\..\Run: [tvs_b] c:\Program Files\tvs\tvs_ln.exe
O4 - HKLM\..\Run: [vzdvywa] c:\windows\system32\fadtvu.exe
O4 - HKLM\..\Run: [GMedia2] C:\WINDOWS\system32\GSMedia3.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\RunOnce: [tvs_re] c:\Program Files\Common Files\Java\tvs_re_inst.exe
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [fox4RVJqe] ltficom.exe
O4 - HKCU\..\Run: [MBKWBarManager] C:\Program Files\MBKWBar\TManager.exe
O4 - HKCU\..\RunOnce: [untd_recovery] C:\Program Files\Juno\qsacc\x1exec.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\tsysuyd8.exe
O4 - Startup: Zstart.lnk = C:\WINDOWS\system32\zxinst12.exe
O9 - Extra button: Yahoo! Login -
{2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD}
- C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21}
- c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
- C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
(file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF:
START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer)
- http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl
Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload
Tool) - http://by10fd.bay10.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50212/QDow_AS2.cab
O16 - DPF: {886DDE35-E955-11D0-A707-000000521958} - http://69.56.176.78/webplugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/Messe…nt.cab28578.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {C0B285F6-DB2B-4908-9C58-F6D95397D747} - http://www.pacimedia.com/install/pcs_0002.exe
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} (LightSurfUploadCtl
Class) - http://picturecenter.kodak.com/activex/Lig…loadControl.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown
Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{40E65866-04EA-4F13-AD55-5D4927D8F51C}:
NameServer = 64.136.20.121 64.136.28.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{40E65866-04EA-4F13-AD55-5D4927D8F51C}:
NameServer = 64.136.20.121 64.136.28.121 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: gsnbyfjbnwgv - Unknown owner - C:\WINDOWS\system32\yfjbnwgv\gsnb.exe
O23 - Service: jspqliobgcmf - Unknown owner - C:\WINDOWS\system32\iobgcmf\jspql.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc.
- C:\WINDOWS\System32\PackethSvc.exe
O23 - Service: rhwmivnsmjcs - Unknown owner - C:\WINDOWS\system32\ivnsmjcs\rhwm.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: tqjqlqxinsej - Unknown owner - C:\WINDOWS\system32\xinsej\tqjqlq.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: wggclhhtehvbc - Unknown owner - C:\WINDOWS\system32\ehvbc\wggclhht.exe
O23 - Service: yxsfwvacatffer - Unknown owner - C:\WINDOWS\system32\atffer\yxsfwvac.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

Trevuren

Post #2April 29, 2005, 4:55 PM UTC

Hi victim and welcome to the Tom Coyote Forums.

My name is Trevuren and I will he helping you.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

1. Go to the Tom Coyote Forums http://forums.tomcoyote.org/index.php?
.Click on My Controls near the top middle of the window (make sure you have signed in first)
.On the left hand column, click "view topics"
.If you click on the title of your post, you will be taken there
2. Also, while at that place in control panel, check the box to the right of your post and then scroll down.
Where it says "unsubscribe" click the pull-down menu and select "immediate email notification", By doing this, you will be notified as soon as I have posted a reply to your log.

3. I need you to have Hijackthis properly protected. I want you to delete your current version and proceed exactly as follows:

Download the most current version of Hijackthis (v.1.99.1) to a folder of its own. HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

A. Please click on the "My Computer" icon, then the C: drive icon. Next Right click on the desktop and choose NEW from the list available then> Folder' and name the folder 'HijackThis'. The end result should resemble something like this C:\HijackThis\

B. Download Hijackthis from:HERE

C. Double Click on 'HijackThis.zip' to extract and install HijackThis.exe to the new folder.

D. Close ALL windows except HJT

E. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

F. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')

4. Some programs on your system are know carriers of malware/adware and generally not good for your system:

A. Now I want you to UNINSTALL the following programs through the ADD/REMOVE feature of your Control Panel:

Media Access
Virtual Bouncer
MyWay
WinTools

B. Now, using Windows Explorer, I need you to DELETE the following folder(s) and all their content:

C:\Program Files\Media Access
C:\Program Files\Virtual Bouncer
C:\Program Files\WinTools
C:\Program Files\MyWay

5. REBOOT your computer

6. Finally, run HijackThis and with all windows closed except for HJT, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

Trevuren

Post #3May 17, 2005, 6:47 PM UTC

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

✨ Ask AI

Ask AI