What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

first hijack log

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 2:43:57 PM, on 7/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinMXDownloadWinMX3.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\HzwVc25s.exe
C:\WINDOWS\System32\Mde2R3.exe
C:\Documents and Settings\donna\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BellSouth
R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {D3808BD7-1651-41AE-A46A-2CA108B5C965} - C:\WINDOWS\System32\ddmpgk.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\ycomp5_5_5_0.dll
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [2LSSQW82ZYGD39] C:\WINDOWS\System32\EngpK.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: WinMXDownloadWinMX3.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv3.view22.com/app/view22rte.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{04A9CFF5-442C-4913-95B4-5BF8C80CB135}: NameServer = 205.152.144.235,205.152.132.235
O17 - HKLM\System\CS1\Services\Tcpip\..\{04A9CFF5-442C-4913-95B4-5BF8C80CB135}: NameServer = 205.152.144.235,205.152.132.235
O17 - HKLM\System\CS2\Services\Tcpip\..\{04A9CFF5-442C-4913-95B4-5BF8C80CB135}: NameServer = 205.152.144.235,205.152.132.235
O17 - HKLM\System\CS3\Services\Tcpip\..\{04A9CFF5-442C-4913-95B4-5BF8C80CB135}: NameServer = 205.152.144.235,205.152.132.235
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
Post #2 last edited
Hello east;

You have multiple infestations. Please post back when finished, as there well may be considerably more to do. In addition, at a later time I will offer you some free programs, that will help keep this from happening again.

Please read the complete post first, you should copy and paste this post to a Notepad text Document, or print it.
Download SspSeHjfix.exe for 2k/XP and unzip http://www.derbilk.de/404.html . Don't run it now we will use it later.

Download and install http://www.ccleaner.com/ccdownload.php
Download and install Adaware, uncheck "show help file" and "perform full system scan" at the end of the installing routine, perform the update and close Adaware. You will need it later.

Download the stand-alone version of CWShredder 2.12
http://cwshredder.net/bin/CWShredder.exe Now, please update the program, but do not run it yet.

Download the Peperfix Tool and save it to your Desktop.



Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. For this reason it cannot be run from a Zip file or from Temporary folders because the backups will be deleted. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

Next:
You have the Peper trojan among other infestations. It is advised to fix the Peper infestation first.

Make sure you are connected to the Internet and run the Peper Fix; reboot afterwards. Repeat the procedure as it has to be run twice to ensure its effectiveness.


Reboot into Safe Mode. To do this, press the F8 key repeatedly as the computer starts up until you see a menu screen (if Windows starts normally, restart it again). Use the arrow keys to highlight "Safe Mode" and press Enter.


Next:
Please set your computer to show all files.

* Double-click My Computer.
* Click the Tools menu, and then click Folder Options.
* Click the View tab.
* Clear "Hide file extensions for known file types."
* Under the "Hidden files" folder, select "Show hidden files and folders."
* Clear "Hide protected operating system files."
* Click Apply, and then click OK.

Next:

Close all browser windows and RUN HijackThis.
Click the SCAN button to produce a log.
Place a check mark beside each one of the following entries:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O2 - BHO: (no name) - {D3808BD7-1651-41AE-A46A-2CA108B5C965} - C:\WINDOWS\System32\ddmpgk.dll (file missing)
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll,DllInstall
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv3.view22.com/app/view22rte.cab

Now with all the items selected, delete them by clicking the FIX checked button.


While still in Safe Mode,


Using Windows Explorer, locate the following files/folders shown DARK, and delete them (if they are present):


C:\WINDOWS\System32\ddmpgk.dll

C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll

Next:

Do not reboot and remain in Safe Mode.

Please close every window, disconnect from Internet completely and doubleclick the CWShredder icon on your Desktop.
Click Fix and then Next, let it fix everything it asks about.

Start Ccleaner and click: Run Cleaner. Let it finish.

Start SspSeHjfix.exe, click on " Desinfection starten" and let it finish.

Then, please reboot.

Next:
Please run Ad-Aware SE and let it fix anything it asks about.

Reboot , enable hidden files and post a fresh Hijack This log in this thread, Using the Post Reply: feature, so I will be notified.

Note: Do not attempt to "Fix" anything in the new log, as we need to see the entire log, without any changes.
Post #3 last edited
Attention PIATAN #2 logfile and thanks for helping out

Logfile of HijackThis v1.99.1
Scan saved at 12:18:02 PM, on 7/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinMXDownloadWinMX3.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\donna\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: WinMXDownloadWinMX3.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
Post #4
Hello east;

Looks like there is a bit more to do. Please note there will be tools to download and use. Any that you already have do not need to be downloaded again, but should be updated before beginning.

I would advise to copy and paste this into a Notepad file and place it on your desktop, to read while you work, or print it. A printout can be used as a checklist, to reduce the possibility of errors.

Again, I would remind you that Hijack This must be placed in a folder of its own, or the backups it makes will be lost. It must not be ran from a temporary, or zip file. These backups could be critical to restoring your system in the event of a problem. Ignore this at your own peril.

Please disable SpySweeper now. If this is not done, it will try to prevent us from making the changes that are necessary.


Please read the complete post first.

Download and install http://www.ccleaner.com/ccdownload.php

Download and install Adaware, uncheck "show help file" and "perform full system scan" at the end of the installing routine, perform the update and close Adaware. You will need it later

Download and save to your Desktop, don't run it now, we will use it later:
http://securityresponse.symantec.com/avcenter/FxAgentB.exe

Download and then double click http://cwshredder.net/bin/CWShredder.exe. Then close every window and disconnect from Internet, double click the CWSshredder icon on your Desktop.
Click Fix, ok and then Next, let it fix everything it asks about.

Next:

Close all browser windows and RUN HijackThis.
Click the SCAN button to produce a log.
Place a check mark beside each one of the following entries:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Now with all the items selected, delete them by clicking the FIX checked button.

Next:


Shut down all running programs, make sure that you are not connected to the internet!
Double-click the FxAgentB.exe file to start the removal tool.
Save the log it makes and post it in your next reply.
Please do NOT start any other applications until the removal tool exits and the computer is restarted.

Restart the computer.

Run the removal tool again to ensure that the system is clean.

Start Ccleaner and click: Run Cleaner.

Run Adaware and perform a full system scan.


Reboot and post a fresh Hijack This log in this thread along with the log from FxAgentB , Using the Post Reply feature, so I will be notified.

Note: Do not attempt to "Fix" anything in the new log, as we need to see the entire log, without revisions.
Post #5
Attn: PIATAN #3log file
Logfile of HijackThis v1.99.1
Scan saved at 8:44:15 PM, on 7/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinMXDownloadWinMX3.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\donna\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {2C26471D-CAFF-4F5A-8C83-2B5BC9D5EBAA} - C:\WINDOWS\System32\lpa.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: WinMXDownloadWinMX3.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O18 - Filter: text/html - {02666C0C-348A-45BC-A1E9-4D50AA3053A5} - C:\WINDOWS\System32\lpa.dll
O18 - Filter: text/plain - {02666C0C-348A-45BC-A1E9-4D50AA3053A5} - C:\WINDOWS\System32\lpa.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe

log for removal

Symantec Backdoor.Agent.B Removal Tool 1.0.1.2

process: Explorer.EXE, thread: 000002E8 (terminated)
process: qttask.exe, thread: 000003EC (terminated)
process: aim.exe, thread: 000004AC (terminated)
process: WinMXDownloadWinMX3.exe, thread: 0000048C (terminated)
process: FxAgentB.exe, thread: 00000674 (terminated)
process: wuauclt.exe, thread: 00000690 (terminated)

registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: AppInit_DLLs (value set to "")

C:\WINDOWS\SYSTEM32\hlpc.dll: (will be deleted on next reboot)

The Backdoor.Agent.B removal was successful.
The system will delete 1 Backdoor.Agent.B files from your PC on next reboot.

Here is the report:

1 file(s) could not be deleted.
They will be deleted on next reboot.

The total number of the scanned files: 78260
The number of deleted files: 0
The number of viral processes terminated: 0
The number of viral threads terminated: 6
The number of registry entries fixed: 1

The tool initiated a system reboot.

As you can see about blank still exist I HATE CWS
Post #6
Hi east;

I'm not completely sure why the recommended fixes are failing. However, I do know that for some reason, not all the recommendations that I have provided have been followed and there is evidence of that, in the HJT log.

Lets try this again. Please, either print this, or copy and paste it into a Notepad file and place it on your desktop, to read as you work. This will reduce the liklihood of errors.
If all these recommendations are not carefully followed, exactally in the order given, the fix is likely to fail again.

Do not be concerned if it appears the fix has failed because you see evidence of CWS in your HJT log. We will fix that later, if necessary.

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. For this reason it cannot be run from a Zip file or from Temporary folders because the backups will be deleted. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.


I would recommend that all the programs below should be downloaded fresh and only they be used and that any additional copies of those same programs you may already have, be deleted.

Please update all these programs as they are downloaded, if that option is available.

:
Step#1
Download CWShredder

If you are using anything other than Windows xp you may need a zip program.
Please download the evaluation version of Winzip.

Step#2
Download SpSeHjfix112.zip to the desktop. Then right click on the desktop and select new >folder, name it spfix then unzip SpSeHjfx112.zip into the new folder.

Step#3
Disconnect from the net and Close ALL OPEN PROGRAMS.

Step#4
Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

Step#5
Reboot into Safe Mode by Tapping F8 while booting up then navigate to the folder on your desktop called spfix and then

Step#6
Run 'SpSeHjfx112.exe'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the spfix folder.

Step#7
Once it is finished, Fix with CWShredder - Click The FIX button!

Step#8
Reboot into Safe Mode and Repeat steps 5, 6 and 7 above

Step#9
Reboot into Normal Mode and post a new HijackThis log and the log that was created by 'SpSeHjfix'.

Warning Note: On a few occasions it has been reported that after using the SPSEHjfix you cannot open Internet Explorer. To fix this, go into Control Panel >Internet Options >Programs & press reset web settings, then you can set your home page to what you want on the general tab.
Post #7
Attn: Piatan current hjtlog and what ever were doing is definately improving things
Logfile of HijackThis v1.99.1
Scan saved at 1:37:22 PM, on 8/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinMXDownloadWinMX3.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\donna\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://yahoo.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: WinMXDownloadWinMX3.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe

spfix log


(8/1/05 1:09:45 PM) SPSeHjFix started v1.1.2
(8/1/05 1:09:45 PM) OS: WinXP Service Pack 1 (5.1.2600)
(8/1/05 1:09:45 PM) Language: english
(8/1/05 1:09:45 PM) Win-Path: C:\WINDOWS
(8/1/05 1:09:45 PM) System-Path: C:\WINDOWS\System32
(8/1/05 1:09:45 PM) Temp-Path: C:\DOCUME~1\donna\LOCALS~1\Temp\


(8/1/05 1:18:23 PM) SPSeHjFix started v1.1.2
(8/1/05 1:18:23 PM) OS: WinXP Service Pack 1 (5.1.2600)
(8/1/05 1:18:23 PM) Language: english
(8/1/05 1:18:23 PM) Win-Path: C:\WINDOWS
(8/1/05 1:18:23 PM) System-Path: C:\WINDOWS\System32
(8/1/05 1:18:23 PM) Temp-Path: C:\DOCUME~1\donna\LOCALS~1\Temp\
(8/1/05 1:18:29 PM) Disinfection started
(8/1/05 1:18:29 PM) Bad-Dll(IEP): c:\docume~1\donna\locals~1\temp\se.dll
(8/1/05 1:18:30 PM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\lpa.dll
(8/1/05 1:18:31 PM) Searchassistant Uninstaller - Keys Deleted
(8/1/05 1:18:31 PM) UBF: 6 - UBB: 0 - UBR: 2
(8/1/05 1:18:32 PM) FilterKey: HKCR\text/html (deleted)
(8/1/05 1:18:32 PM) FilterKey: HKCR\CLSID\{6DD3FB50-CB76-46E4-88CF-5801172BA7D0} (deleted)
(8/1/05 1:18:32 PM) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(8/1/05 1:18:32 PM) FilterKey: HKCR\text/plain (deleted)
(8/1/05 1:18:32 PM) FilterKey: HKCR\CLSID\{6DD3FB50-CB76-46E4-88CF-5801172BA7D0} (error while deleting)
(8/1/05 1:18:32 PM) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(8/1/05 1:18:32 PM) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C26471D-CAFF-4F5A-8C83-2B5BC9D5EBAA} (deleted)
(8/1/05 1:18:32 PM) BHO-Key: HKCR\CLSID\{2C26471D-CAFF-4F5A-8C83-2B5BC9D5EBAA} (deleted)
(8/1/05 1:18:32 PM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(8/1/05 1:18:32 PM) UBF: 4 - UBB: 0 - UBR: 1
(8/1/05 1:18:32 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\donna\locals~1\temp\se.dll/sp.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\donna\locals~1\temp\se.dll/sp.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(8/1/05 1:18:46 PM) Stealth-String found: C:\WINDOWS\System32\hlpc.dll
(8/1/05 1:18:46 PM) Error while add to delete. Try another way… : C:\WINDOWS\System32\hlpc.dll
(8/1/05 1:18:54 PM) File added to delete: c:\windows\system32\lpa.dll
(8/1/05 1:18:54 PM) File added to delete: c:\docume~1\donna\locals~1\temp\se.dll
(8/1/05 1:18:54 PM) Reboot
(8/1/05 1:22:35 PM) SPSeHjFix 2nd Step
(8/1/05 1:22:35 PM) Error while deleting Stealth-DLL
(8/1/05 1:22:35 PM) AppInit_DLLs-key: (edited)
(8/1/05 1:22:35 PM) Stealth-String not present. Disinfection succesfully
(8/1/05 1:23:05 PM) Cleaned


(8/1/05 1:29:16 PM) SPSeHjFix started v1.1.2
(8/1/05 1:29:16 PM) OS: WinXP Service Pack 1 (5.1.2600)
(8/1/05 1:29:16 PM) Language: english
(8/1/05 1:29:16 PM) Win-Path: C:\WINDOWS
(8/1/05 1:29:16 PM) System-Path: C:\WINDOWS\System32
(8/1/05 1:29:16 PM) Temp-Path: C:\DOCUME~1\donna\LOCALS~1\Temp\
(8/1/05 1:29:18 PM) Disinfection started
(8/1/05 1:29:18 PM) Bad-Dll(IEP): (not found)
(8/1/05 1:29:18 PM) Bad-Dll(IEP) in BHO: (not found)
(8/1/05 1:29:18 PM) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\lpa.dll
(8/1/05 1:29:18 PM) Searchassistant Uninstaller - Keys Deleted
(8/1/05 1:29:18 PM) UBF: 4 - UBB: 0 - UBR: 2
(8/1/05 1:29:18 PM) UBF: 4 - UBB: 0 - UBR: 2
(8/1/05 1:29:18 PM) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\donna\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(8/1/05 1:29:18 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar:
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(8/1/05 1:29:18 PM) Stealth-String not found
(8/1/05 1:29:18 PM) File added to delete: c:\windows\system32\lpa.dll
(8/1/05 1:29:18 PM) File added to delete: c:\docume~1\donna\locals~1\temp\se.dll
(8/1/05 1:29:18 PM) Reboot


(8/1/05 1:31:13 PM) SPSeHjFix started v1.1.2
(8/1/05 1:31:13 PM) OS: WinXP Service Pack 1 (5.1.2600)
(8/1/05 1:31:13 PM) Language: english
(8/1/05 1:31:13 PM) Win-Path: C:\WINDOWS
(8/1/05 1:31:13 PM) System-Path: C:\WINDOWS\System32
(8/1/05 1:31:13 PM) Temp-Path: C:\DOCUME~1\donna\LOCALS~1\Temp\

You have been a great help
anything else I should do?
Post #8
Hello east;
I'm only too glad to help. Do you recall that I said that all recommendations were not being followed ? This is only one of the things to which I was referring. I've asked you to do this three times. It is for the protection of your PC and thankfully it has not been necessary, so far.

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. For this reason it cannot be run from a Zip file or from Temporary folders because the backups will be deleted. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

Next:

Close all browser windows and RUN HijackThis.
Click the SCAN button to produce a log.
Place a check mark beside each one of the following entries:


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

Now with all the items selected, delete them by clicking the FIX checked button.

Then, please reboot.

Please do all of the following, without delay. It will protect your PC.

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
To protect yourself further:
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
I also suggest that you delete any files from "temp", "tmp" folders. In Internet Explorer, click on "Tools" => "Internet Options" => "Delete Files" and select the box that says "Delete All Offline Content" and click on "OK" twice. Also, empty the recycle bin by right clicking on it and selecting "Empty Recycle Bin". These steps should be done on a regular basis.

And also see TonyKlein's good advice.
So how did I get infected in the first place?

The following is not optional, it must be done.

One of the best features of Windows XP is the System Restore option, however if a virus infects a computer with this operating system the virus can be backed up in the System Restore folder. Therefore, clearing the restore points is necessary after a virus removal.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK

Good luck.
Post #9
Glad we could be of help.

Since this topic has been resolved, it will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.
Post #10
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI