Spyware / Malware / Virus Removal

Help w/ Windows XP Home Invasion

3 min read

Looking for the outcome? Ask AI

weaverbrosracing Topic Starter

Post #1May 7, 2005, 7:05 PM UTC

Infected badly, the system reboots every 3 minutes. I can see bman and bman1 running. I've run McAfee VirusScan (old V4) and Ad-aware, but can't regain control.
Fortunately I was able to get Hijackthis to run…

Logfile of HijackThis v1.99.1
Scan saved at 11:44:31 AM, on 5/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\vffw\lmesfo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\otxnrx\ucsd.exe
C:\Program Files\Mouse\Amoumain.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\iPod\bin\iPodManager.exe
C:\Program Files\Office Mouse\moffice.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Office Mouse\MOUSE32A.DAT
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\certcli3.exe
C:\WINDOWS\TUEGDLL.EXE
C:\WINDOWS\KPVXENC.EXE
C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
C:\WINDOWS\System32\pacis.exe
C:\WINDOWS\System32\sqmnls\wtjp.exe
C:\WINDOWS\System32\elqfr\omgryill.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\msw\BMan.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\program files\180searchassistant\sac.exe
C:\windows\system32\xmgjvynw.exe
C:\WINDOWS\System32\tsvp.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\Program Files\CashBack\bin\cashback.exe
C:\WINDOWS\System32\vnlkvm.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\WINDOWS\System32\wuaal.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
a:\hijackthis.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\System32\dwwin.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\ceres.dll
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
O2 - BHO: (no name) - {16F52356-8CF6-F435-897F-D535B3AEE4A7} - C:\WINDOWS\System32\srvmrvjl\xmqrcxku.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScanMSC] "C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe" /EMBEDDING
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe
O4 - HKLM\..\Run: [\\MAIN\EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P30 "\\MAIN\EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C64 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P36 "Auto EPSON Stylus C64 Series on MAIN" /O15 "\\MAIN\EPSONC64" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C84 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P36 "Auto EPSON Stylus C84 Series on MAIN" /O15 "\\MAIN\EPSONC84" /M "Stylus C84"
O4 - HKLM\..\Run: [JPC.exe] C:\docume~1\courtney\locals~1\temp\JPC.exe
O4 - HKLM\..\Run: [3nmCHJ.exe] C:\docume~1\courtney\locals~1\temp\3nmCHJ.exe
O4 - HKLM\..\Run: [Yynlv9.exe] C:\docume~1\courtney\locals~1\temp\Yynlv9.exe
O4 - HKLM\..\Run: [iJjBY.exe] C:\docume~1\courtney\locals~1\temp\iJjBY.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [dnsole] C:\WINDOWS\Drivers\dnsole.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealPlayer\tsystray.exe"
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [9b4707bd298b] C:\WINDOWS\System32\certcli3.exe
O4 - HKLM\..\Run: [TUEGDLL] C:\WINDOWS\TUEGDLL.EXE
O4 - HKLM\..\Run: [KPVXENC] C:\WINDOWS\KPVXENC.EXE
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [sxlwbb] C:\WINDOWS\System32\kodgbmk\sxlwbb.exe
O4 - HKLM\..\Run: [vamxvi] C:\WINDOWS\System32\ekyqu\vamxvi.exe
O4 - HKLM\..\Run: [lvebe] C:\WINDOWS\System32\rtpq\lvebe.exe
O4 - HKLM\..\Run: [wtjp] C:\WINDOWS\System32\sqmnls\wtjp.exe
O4 - HKLM\..\Run: [ucsd] C:\WINDOWS\System32\otxnrx\ucsd.exe
O4 - HKLM\..\Run: [omgryill] C:\WINDOWS\System32\elqfr\omgryill.exe
O4 - HKLM\..\Run: [eqddic] c:\windows\system32\eqddic.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Courtney\LOCALS~1\Temp\rfuhriv.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [ocncir] C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliteztc32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [sFrT38U] jitlobby.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\tsvp.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [hphwesv] c:\windows\system32\mzbdxnd.exe
O4 - HKLM\..\Run: [lmesfo] C:\WINDOWS\System32\vffw\lmesfo.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\vnlkvm.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [do03RUYnR] wuaal.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMsucks\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…478/mcfscan.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = usps.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = usps.gov
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: cadmmuxhpelm - Unknown owner - C:\WINDOWS\System32\hpelm\cadmmux.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lmesfovffw - Unknown owner - C:\WINDOWS\System32\vffw\lmesfo.exe
O23 - Service: lryxkwjlnv - Unknown owner - C:\WINDOWS\System32\jlnv\lryxkw.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: ocncirwuoaxtv - Unknown owner - C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: ucsdotxnrx - Unknown owner - C:\WINDOWS\System32\otxnrx\ucsd.exe
O23 - Service: vamxviekyqu - Unknown owner - C:\WINDOWS\System32\ekyqu\vamxvi.exe (file missing)
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

Thanks for any help.

MrCharlie

Post #2May 13, 2005, 10:43 PM UTC

Welcome to the forum.

What a mess - you have it all.

First thing to do is….

Please run this uninstaller, you must have an internet connection for it to work.

http://www.mypctuneup.com/index.php

Reboot and post a fresh HJT log. MrC

weaverbrosracing

Post #3May 14, 2005, 2:01 AM UTC

I ran uninstaller and here's my new log…
Logfile of HijackThis v1.99.1
Scan saved at 6:55:31 PM, on 5/13/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\vffw\lmesfo.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\otxnrx\ucsd.exe
C:\Program Files\Mouse\Amoumain.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\iPod\bin\iPodManager.exe
C:\Program Files\Office Mouse\moffice.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Office Mouse\MOUSE32A.DAT
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\certcli3.exe
C:\WINDOWS\TUEGDLL.EXE
C:\WINDOWS\KPVXENC.EXE
C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
C:\WINDOWS\System32\pacis.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\sqmnls\wtjp.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\msw\BMan.exe
C:\WINDOWS\System32\elqfr\omgryill.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\program files\180searchassistant\sac.exe
C:\windows\system32\xmgjvynw.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\System32\tsvp.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
a:\hijackthis.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\Program Files\CashBack\bin\cashback.exe
C:\WINDOWS\System32\vnlkvm.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\WINDOWS\System32\wuaal.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office10\OSA.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
O2 - BHO: (no name) - {16F52356-8CF6-F435-897F-D535B3AEE4A7} - C:\WINDOWS\System32\srvmrvjl\xmqrcxku.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScanMSC] "C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe" /EMBEDDING
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe
O4 - HKLM\..\Run: [\\MAIN\EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P30 "\\MAIN\EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C64 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P36 "Auto EPSON Stylus C64 Series on MAIN" /O15 "\\MAIN\EPSONC64" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C84 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P36 "Auto EPSON Stylus C84 Series on MAIN" /O15 "\\MAIN\EPSONC84" /M "Stylus C84"
O4 - HKLM\..\Run: [JPC.exe] C:\docume~1\courtney\locals~1\temp\JPC.exe
O4 - HKLM\..\Run: [3nmCHJ.exe] C:\docume~1\courtney\locals~1\temp\3nmCHJ.exe
O4 - HKLM\..\Run: [Yynlv9.exe] C:\docume~1\courtney\locals~1\temp\Yynlv9.exe
O4 - HKLM\..\Run: [iJjBY.exe] C:\docume~1\courtney\locals~1\temp\iJjBY.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [dnsole] C:\WINDOWS\Drivers\dnsole.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealPlayer\tsystray.exe"
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [9b4707bd298b] C:\WINDOWS\System32\certcli3.exe
O4 - HKLM\..\Run: [TUEGDLL] C:\WINDOWS\TUEGDLL.EXE
O4 - HKLM\..\Run: [KPVXENC] C:\WINDOWS\KPVXENC.EXE
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [sxlwbb] C:\WINDOWS\System32\kodgbmk\sxlwbb.exe
O4 - HKLM\..\Run: [vamxvi] C:\WINDOWS\System32\ekyqu\vamxvi.exe
O4 - HKLM\..\Run: [lvebe] C:\WINDOWS\System32\rtpq\lvebe.exe
O4 - HKLM\..\Run: [wtjp] C:\WINDOWS\System32\sqmnls\wtjp.exe
O4 - HKLM\..\Run: [ucsd] C:\WINDOWS\System32\otxnrx\ucsd.exe
O4 - HKLM\..\Run: [omgryill] C:\WINDOWS\System32\elqfr\omgryill.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Courtney\LOCALS~1\Temp\rfuhriv.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [ocncir] C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliteztc32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [xmgjvynw] c:\windows\system32\xmgjvynw.exe -start
O4 - HKLM\..\Run: [sFrT38U] jitlobby.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\tsvp.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [hphwesv] c:\windows\system32\mzbdxnd.exe
O4 - HKLM\..\Run: [lmesfo] C:\WINDOWS\System32\vffw\lmesfo.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\vnlkvm.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [do03RUYnR] wuaal.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMsucks\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…478/mcfscan.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = usps.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = usps.gov
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: cadmmuxhpelm - Unknown owner - C:\WINDOWS\System32\hpelm\cadmmux.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lmesfovffw - Unknown owner - C:\WINDOWS\System32\vffw\lmesfo.exe
O23 - Service: lryxkwjlnv - Unknown owner - C:\WINDOWS\System32\jlnv\lryxkw.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: ocncirwuoaxtv - Unknown owner - C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O23 - Service: ucsdotxnrx - Unknown owner - C:\WINDOWS\System32\otxnrx\ucsd.exe
O23 - Service: vamxviekyqu - Unknown owner - C:\WINDOWS\System32\ekyqu\vamxvi.exe (file missing)
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

MrCharlie

Post #4May 14, 2005, 2:52 AM UTC

We still have a lot to do.

Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
lmesfovffw

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

Do the same for these also:

ZESOFT
ocncirwuoaxtv
ucsdotxnrx

Download and unzip the KillBox to a folder - we'll use it later.

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Go to your control panels add/remove programs and uninstall these if listed:
180searchassistant
CashBack
NaviSearch
BullsEye Network
VBouncer

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

lmesfo.exe
ucsd.exe
certcli3.exe
TUEGDLL.EXE
KPVXENC.EXE
BMan1.exe
pacis.exe
wtjp.exe
msw\BMan.exe
omgryill.exe
nsvsvc.exe
sac.exe
xmgjvynw.exe
tsvp.exe
nls.exe
cashback.exe
vnlkvm.exe
wuaal.exe

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
O2 - BHO: (no name) - {16F52356-8CF6-F435-897F-D535B3AEE4A7} - C:\WINDOWS\System32\srvmrvjl\xmqrcxku.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [sxlwbb] C:\WINDOWS\System32\kodgbmk\sxlwbb.exe
O4 - HKLM\..\Run: [vamxvi] C:\WINDOWS\System32\ekyqu\vamxvi.exe
O4 - HKLM\..\Run: [lvebe] C:\WINDOWS\System32\rtpq\lvebe.exe
O4 - HKLM\..\Run: [wtjp] C:\WINDOWS\System32\sqmnls\wtjp.exe
O4 - HKLM\..\Run: [ucsd] C:\WINDOWS\System32\otxnrx\ucsd.exe
O4 - HKLM\..\Run: [omgryill] C:\WINDOWS\System32\elqfr\omgryill.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Courtney\LOCALS~1\Temp\rfuhriv.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliteztc32.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\tsvp.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [JPC.exe] C:\docume~1\courtney\locals~1\temp\JPC.exe
O4 - HKLM\..\Run: [3nmCHJ.exe] C:\docume~1\courtney\locals~1\temp\3nmCHJ.exe
O4 - HKLM\..\Run: [Yynlv9.exe] C:\docume~1\courtney\locals~1\temp\Yynlv9.exe
O4 - HKLM\..\Run: [iJjBY.exe] C:\docume~1\courtney\locals~1\temp\iJjBY.exe
O4 - HKLM\..\Run: [dnsole] C:\WINDOWS\Drivers\dnsole.exe
O4 - HKLM\..\Run: [9b4707bd298b] C:\WINDOWS\System32\certcli3.exe
O4 - HKLM\..\Run: [TUEGDLL] C:\WINDOWS\TUEGDLL.EXE
O4 - HKLM\..\Run: [KPVXENC] C:\WINDOWS\KPVXENC.EXE
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [ocncir] C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O4 - HKLM\..\Run: [xmgjvynw] c:\windows\system32\xmgjvynw.exe -start
O4 - HKLM\..\Run: [sFrT38U] jitlobby.exe
O4 - HKLM\..\Run: [hphwesv] c:\windows\system32\mzbdxnd.exe
O4 - HKLM\..\Run: [lmesfo] C:\WINDOWS\System32\vffw\lmesfo.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\vnlkvm.exe
O4 - HKCU\..\Run: [do03RUYnR] wuaal.exe
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O23 - Service: cadmmuxhpelm - Unknown owner - C:\WINDOWS\System32\hpelm\cadmmux.exe (file missing)
O23 - Service: lmesfovffw - Unknown owner - C:\WINDOWS\System32\vffw\lmesfo.exe
O23 - Service: lryxkwjlnv - Unknown owner - C:\WINDOWS\System32\jlnv\lryxkw.exe (file missing)
O23 - Service: ocncirwuoaxtv - Unknown owner - C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O23 - Service: ucsdotxnrx - Unknown owner - C:\WINDOWS\System32\otxnrx\ucsd.exe
O23 - Service: vamxviekyqu - Unknown owner - C:\WINDOWS\System32\ekyqu\vamxvi.exe (file missing)
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

Click on Fix Checked and exit HijackThis.

Now open up the KillBox.
Select the Delete on Reboot option.
In the field labeled Full Path of File to Delete copy and paste each one of these in (one at a time).
Hit the delete button
OK
Do the next file
After that LAST file path has been entered and you press OK
Reboot the computer
If you recieve an error message "PendingRenameOperation…." and your computer doesn't restart, please restart it manually.

C:\WINDOWS\System32\srvmrvjl
C:\PROGRA~1\VBouncer
C:\WINDOWS\zeta.exe
C:\WINDOWS\System32\msbe.dll
C:\WINDOWS\System32\nvms.dll
C:\WINDOWS\System32\mscb.dll
C:\WINDOWS\cfgmgr51.dll
C:\WINDOWS\System32\vffw
C:\WINDOWS\System32\otxnrx
C:\WINDOWS\System32\certcli3.exe
C:\WINDOWS\TUEGDLL.EXE
C:\WINDOWS\KPVXENC.EXE
C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
C:\WINDOWS\System32\pacis.exe
C:\WINDOWS\System32\sqmnls
C:\DOCUME~1\ALLUSE~1\APPLIC~1\msw\BMan.exe
C:\WINDOWS\System32\elqfr
C:\WINDOWS\System32\nsvsvc
C:\program files\180searchassistant
C:\windows\system32\xmgjvynw.exe
C:\WINDOWS\System32\tsvp.exe
C:\Program Files\BullsEye Network
C:\Program Files\NaviSearch
C:\Program Files\CashBack
C:\WINDOWS\System32\vnlkvm.exe
C:\WINDOWS\System32\wuaal.exe
C:\WINDOWS\System32\winupdt.exe
C:\Documents and Settings\All Users\Application Data\msw
C:\WINDOWS\System32\ap9h4qmo.exe
C:\WINDOWS\System32\pacis.exe
C:\WINDOWS\System32\kodgbmk
C:\WINDOWS\System32\ekyqu
C:\WINDOWS\System32\rtpq
C:\WINDOWS\System32\sqmnls
C:\WINDOWS\System32\otxnrx
C:\WINDOWS\System32\elqfr
C:\DOCUME~1\Courtney\LOCALS~1\Temp\rfuhriv.exe
C:\WINDOWS\System32\nsvsvc
C:\windows\system32\eliteztc32.exe
C:\WINDOWS\System32\tsvp.exe
C:\docume~1\courtney\locals~1\temp\JPC.exe
C:\docume~1\courtney\locals~1\temp\3nmCHJ.exe
C:\docume~1\courtney\locals~1\temp\Yynlv9.exe
C:\docume~1\courtney\locals~1\temp\iJjBY.exe
C:\WINDOWS\Drivers\dnsole.exe
C:\WINDOWS\System32\certcli3.exe
C:\WINDOWS\TUEGDLL.EXE
C:\WINDOWS\KPVXENC.EXE
C:\WINDOWS\cfgmgr51.dll
C:\WINDOWS\System32\wuoaxtv
c:\windows\system32\mzbdxnd.exe
C:\WINDOWS\System32\vnlkvm.exe

These two you will have to search for and delete:

wuaal.exe
jitlobby.exe

Reboot and post a fresh HJT log, Good Luck - MrC

weaverbrosracing

Post #5May 14, 2005, 4:33 AM UTC

Boy that was fun…
Logfile of HijackThis v1.99.1
Scan saved at 9:24:03 PM, on 5/13/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\vffw\lmesfo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mouse\Amoumain.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\iPod\bin\iPodManager.exe
C:\Program Files\Office Mouse\moffice.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\RunDLL32.EXE
C:\Program Files\Office Mouse\MOUSE32A.DAT
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\System32\vnlkvm.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\iPod\bin\iPodService.exe
a:\hijackthis.exe
C:\WINDOWS\System32\dwwin.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
O1 - Hosts: 216.39.69.102 view.atdmt.com
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScanMSC] "C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe" /EMBEDDING
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe
O4 - HKLM\..\Run: [\\MAIN\EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P30 "\\MAIN\EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C64 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P36 "Auto EPSON Stylus C64 Series on MAIN" /O15 "\\MAIN\EPSONC64" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C84 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P36 "Auto EPSON Stylus C84 Series on MAIN" /O15 "\\MAIN\EPSONC84" /M "Stylus C84"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealPlayer\tsystray.exe"
O4 - HKLM\..\Run: [TUEGDLL] C:\WINDOWS\TUEGDLL.EXE
O4 - HKLM\..\Run: [KPVXENC] C:\WINDOWS\KPVXENC.EXE
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [ocncir] C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\vnlkvm.exe
O4 - HKLM\..\Run: [lmesfo] C:\WINDOWS\System32\vffw\lmesfo.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMsucks\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…478/mcfscan.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = usps.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = usps.gov
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lmesfovffw - Unknown owner - C:\WINDOWS\System32\vffw\lmesfo.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe

MrCharlie

Post #6May 14, 2005, 11:29 AM UTC

Well Done!

Do you have the IBM Think Pad Utility on your system?
If not, please have HJT fix this entry and delete this file using the KillBox when you delete the others.

O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun

C:\WINDOWS\cfgmgr51.dll <—delete this file

——————————————————————————

Is this site familiar to you, if not please have HJT fix it.

O1 - Hosts: 216.39.69.102 view.atdmt.com

——————————————————————————

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

lmesfo.exe
vnlkvm.exe

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

O4 - HKLM\..\Run: [KPVXENC] C:\WINDOWS\KPVXENC.EXE
O4 - HKLM\..\Run: [ocncir] C:\WINDOWS\System32\wuoaxtv\ocncir.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\vnlkvm.exe
O4 - HKLM\..\Run: [lmesfo] C:\WINDOWS\System32\vffw\lmesfo.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212…meInstaller.exe
O23 - Service: lmesfovffw - Unknown owner - C:\WINDOWS\System32\vffw\lmesfo.exe

Click on Fix Checked and exit HijackThis.

Now open up the KillBox and do the same as before, delete on reboot.

C:\WINDOWS\System32\vffw\lmesfo.exe
C:\WINDOWS\System32\vnlkvm.exe
C:\WINDOWS\System32\wuoaxtv\ocncir.exe
C:\WINDOWS\KPVXENC.EXE

Reboot…

Open up the KillBox again and delete these on reboot:

C:\WINDOWS\System32\vffw
C:\WINDOWS\System32\wuoaxtv

Reboot and post a fresh HijackThis log and we'll take another look. MrC

weaverbrosracing

Post #7May 15, 2005, 2:43 AM UTC

The system will actually stay up!

Logfile of HijackThis v1.99.1
Scan saved at 7:38:28 PM, on 5/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mouse\Amoumain.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\iPod\bin\iPodManager.exe
C:\Program Files\Office Mouse\moffice.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Office Mouse\MOUSE32A.DAT
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ntci.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
a:\hijackthis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScanMSC] "C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe" /EMBEDDING
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe
O4 - HKLM\..\Run: [\\MAIN\EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P30 "\\MAIN\EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C64 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P36 "Auto EPSON Stylus C64 Series on MAIN" /O15 "\\MAIN\EPSONC64" /M "Stylus C64"
O4 - HKLM\..\Run: [Auto EPSON Stylus C84 Series on MAIN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P36 "Auto EPSON Stylus C84 Series on MAIN" /O15 "\\MAIN\EPSONC84" /M "Stylus C84"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealPlayer\tsystray.exe"
O4 - HKLM\..\Run: [TUEGDLL] C:\WINDOWS\TUEGDLL.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIMsucks\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…478/mcfscan.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = usps.gov
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = usps.gov
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe

MrCharlie

Post #8May 15, 2005, 11:30 AM UTC

Looks Good! Well Done!

If you have any questions - please post back.

I'll leave you with……..

Some preventive maintenance:

——————Must have or do:—————–

Now that you're clean: <—-Important Step!!!!
Delete your system restore files and create a new restore point:
(ME and XP users only)

XP system restore

ME system restore

Visit Windows Update and install all the lastest critical updates.

Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked. Check for updates weekly.

SpywareBlaster

SpywareGuard

IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
IE-SPYAD

SpyBot has some protection benefits - use them.

Need a free anti virus?
AVG*free
(check for updates - daily)

How about a firewall? The front door to your computer.
ZoneAlarm*free

———-Free malware removal programs:———-

SpyBot
AD-Aware
CW-Shredder

Free Online Trojan Scan

A SQUARED FREE TROJAN SCANNER

Trojan Hunter
TrojanHunter - free trial

Please consider using FireFox instead of Internet Explorer

Replace Java with SunJava

Pop-up stoppers:
GoogleToolBar
Pop-upStopperFree

Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.

Good luck and thanks for using the forum - MrC

MrCharlie

Post #9June 5, 2005, 11:08 AM UTC

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Thanks, MrC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help w/ Windows XP Home Invasion

✨ Ask AI

Ask AI