What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijackthis log

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
cant get this uninstaled please help me

alice

Logfile of HijackThis v1.99.1
Scan saved at 5:45:51 PM, on 7/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\logonui.exe
D:\WINDOWS\Explorer.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\msnrgd32.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe
D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\system32\ntvdm.exe
D:\Documents and Settings\Alice\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {BD1110AA-0048-626C-8CF0-3A7E083970E6} - D:\WINDOWS\System32\UPD\bxdaynvjpr.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [sac] d:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [hmtej] D:\WINDOWS\hmtej.exe
O4 - HKLM\..\Run: [Windows Office] msnrgd32.exe
O4 - HKLM\..\RunServices: [Windows Office] msnrgd32.exe
O4 - HKLM\..\RunOnce: [Windows Office] msnrgd32.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe" -quiet
O4 - HKCU\..\Run: [Windows Office] msnrgd32.exe
O4 - HKCU\..\RunOnce: [Windows Office] msnrgd32.exe
O4 - Startup: FriendFinder Messenger.lnk = D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
O8 - Extra context menu item: &Yahoo! Search - file:///D:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///D:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///D:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122620080342
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O23 - Service: AOL Instant Messanger (AIM) - Unknown owner - D:\WINDOWS\aim.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
Post #3
Hello alicep1979, welcome to the TC.

Download Ewido, install then from within the program check for updates BUT dont scan yet
ewido security suite: http://fileforum.betanews.com/detail/ewido…te/1098736486/1
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu". When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK.
We will fix this in a moment.
From the main ewido screen, click on update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful"), Now close the program.
Do NOT run a scan yet.

Notes: If you already have the program please make sure its version 3.5 you have and updated.
If the program just exits before it finishes start it again and set it up to do a custom scan:
Start the program click the scan button over to the left click custom scan, click add drive/directory/file
and add c:\documents and settings\
add c:\windows\
add c:\windows\system32\ also, then click start scan, have it remove everything found.

Please download Nailfix from here:
http://www.noidea.us/easyfile/file.php?dow…050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #4
ok did all that. heres the 2 logs thanks in advance

alice

ewido security suite
———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 8:05:34 PM, 7/29/2005
+ Report-Checksum: 31AB22B7

+ Scan result:

HKLM\SOFTWARE\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9} -> Spyware.180Solutions : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD} -> Spyware.180Solutions : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA} -> Spyware.180Solutions : Cleaned with backup
HKLM\SOFTWARE\Effective-i -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKLM\SOFTWARE\Policies\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
HKU\.DEFAULT\Software\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
HKU\.DEFAULT\Software\Effective-i -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKU\.DEFAULT\Software\Effective-i\TheSearchAccelerator -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKU\.DEFAULT\Software\Effective-i\TheSearchAccelerator\IE5 -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKU\.DEFAULT\Software\Maxthon\Plugin\toolbar\{44BE0690-5429-47f0-85BB-3FFD8020233E} -> Spyware.UCmore : Cleaned with backup
HKU\.DEFAULT\Software\Policies\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-18\Software\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-18\Software\Effective-i -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKU\S-1-5-18\Software\Effective-i\TheSearchAccelerator -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKU\S-1-5-18\Software\Effective-i\TheSearchAccelerator\IE5 -> Spyware.EffectiveBrandToolbar : Cleaned with backup
HKU\S-1-5-18\Software\Maxthon\Plugin\toolbar\{44BE0690-5429-47f0-85BB-3FFD8020233E} -> Spyware.UCmore : Cleaned with backup
HKU\S-1-5-18\Software\Policies\Avenue Media -> Spyware.InternetOptimizer : Cleaned with backup
C:\System Volume Information\_restore{576EED6E-BBCD-4247-8247-D8D4E21C4E12}\RP65\A0019149.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{576EED6E-BBCD-4247-8247-D8D4E21C4E12}\RP65\A0019170.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{576EED6E-BBCD-4247-8247-D8D4E21C4E12}\RP70\A0019241.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{576EED6E-BBCD-4247-8247-D8D4E21C4E12}\RP70\A0019261.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{576EED6E-BBCD-4247-8247-D8D4E21C4E12}\RP71\A0020257.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0000037.exe -> Trojan.LowZones.d : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0000038.exe -> Backdoor.Rbot.tv : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0000042.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0001176.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0001177.exe -> TrojanDownloader.Agent.ex : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP5\A0001218.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002401.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002438.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\Download\Partition Magic 8 KeyGen All Versions.exe -> Worm.Backterra.d : Cleaned with backup
C:\Recycled\Dc1.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
C:\New Folder\Back Ups\Programs\Multi-Media\#1.Video.Converter.v3.5.2.Incl.Keygen-Cafe.zip/keygen.exe -> TrojanDropper.Delf.fl : Cleaned with backup
C:\New Folder\Back Ups\Programs\Multi-Media\#1.Video.Converter.v3.5.2.Incl.Keygen-Cafe\keygen.exe -> TrojanDropper.Delf.fl : Cleaned with backup
C:\xtc.exe -> TrojanDownloader.Small.aqt : Cleaned with backup
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\018TMVMZ\xtc[1].exe -> TrojanDownloader.Small.aqt : Cleaned with backup
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\018TMVMZ\xtc[2].exe -> TrojanDownloader.Small.aqt : Cleaned with backup
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\KT8NAV6X\optimize314[1].exe -> TrojanDownloader.Dyfuca.ei : Cleaned with backup
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SR2NSDGP\nem220[1].dll -> TrojanDownloader.Dyfuca : Cleaned with backup
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\O189G3OJ\tct101[1].dll -> TrojanDownloader.Dyfuca.eg : Cleaned with backup
D:\Documents and Settings\LocalService\Cookies\[removed][1].txt -> Spyware.Cookie.Shopathomeselect : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed][1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@adtech[1].txt -> Spyware.Cookie.Adtech : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed]-buddy[1].txt -> Spyware.Cookie.Bargain-buddy : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\[removed][1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Documents and Settings\Alice\Cookies\alice@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
D:\Program Files\Microsoft AntiSpyware\Quarantine\94EFB1A4-1B15-455F-9ABB-226AD9\F0FE92B8-52DD-4926-B50D-3991BD -> TrojanDownloader.Dyfuca.ei : Cleaned with backup
D:\Program Files\Microsoft AntiSpyware\Quarantine\BD8F04AB-7FFC-4206-B481-ACA308\AF2C51B5-1586-4320-9E25-D1ACA7 -> Spyware.180Solutions : Cleaned with backup
D:\Program Files\Microsoft AntiSpyware\Quarantine\BD8F04AB-7FFC-4206-B481-ACA308\BA76F8B5-1A26-4BE0-BFB7-E7AA67 -> Spyware.180Solutions : Cleaned with backup
D:\Program Files\Microsoft AntiSpyware\Quarantine\98FC1C89-7677-453D-882B-F4C9B3\CB6BD175-67B6-4AC2-BADC-4C9370 -> Spyware.UCmore : Cleaned with backup
D:\Program Files\Microsoft AntiSpyware\Quarantine\98FC1C89-7677-453D-882B-F4C9B3\E05F8364-2A2C-4E8B-BE45-19CB9D -> Spyware.UCmore : Cleaned with backup
D:\Program Files\Microsoft AntiSpyware\Quarantine\201279C8-E9CF-4DF0-B323-039BB0\EB99A9D0-E382-4829-88CA-A116D6 -> Spyware.Hijacker.Generic : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0001175.sys -> Trojan.Rootkit.k : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0001181.EXE -> Adware.SAHA : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP3\A0001182.EXE -> Adware.SAHA : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001399.SYS -> Trojan.Rootkit.k : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001309.exe -> Adware.Saha : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001310.exe -> Spyware.SmartPops : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001311.dll -> Adware.SAHA : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001312.exe -> Adware.SAHA : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001313.dll -> Spyware.BargainBuddy : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001314.exe -> Spyware.BargainBuddy : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001316.exe -> Spyware.WeirWeb : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001317.dll -> Adware.BetterInternet : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001321.sys -> Trojan.Rootkit.k : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0001401.exe -> Spyware.180Solutions : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002399.SYS -> Trojan.Rootkit.k : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002432.exe -> Adware.BetterInternet : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002437.SYS -> Trojan.Rootkit.k : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002442.exe -> Backdoor.Wootbot : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002443.sys -> Trojan.Rootkit.k : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002444.exe -> Backdoor.Wootbot : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002445.exe -> Backdoor.SdBot.xd : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002446.exe -> Backdoor.SdBot.xd : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002447.exe -> Backdoor.SdBot.xd : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002448.exe -> TrojanDropper.Small.qn : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002449.exe -> TrojanDownloader.Dyfuca.dk : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002450.exe -> Adware.BetterInternet : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002451.exe -> Spyware.180Solutions : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002452.exe -> TrojanDownloader.Adload.a : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002453.exe/UCMTSAIE.DLL -> Spyware.UCmore : Cleaned with backup
D:\System Volume Information\_restore{69754F2D-D5B8-4AEF-929F-AD847343090D}\RP7\A0002453.exe/IUCMORE.DLL -> Spyware.UCmore : Cleaned with backup


::Report End

——————————————————-

hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 8:06:49 PM, on 7/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\explorer.exe
D:\Documents and Settings\Alice\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {BD1110AA-0048-626C-8CF0-3A7E083970E6} - D:\WINDOWS\System32\UPD\bxdaynvjpr.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [sac] d:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [Windows Office] msnrgd32.exe
O4 - HKLM\..\Run: [Offices] msnmgd32.exe
O4 - HKLM\..\RunServices: [Windows Office] msnrgd32.exe
O4 - HKLM\..\RunServices: [Offices] msnmgd32.exe
O4 - HKLM\..\RunOnce: [Windows Office] msnrgd32.exe
O4 - HKLM\..\RunOnce: [Offices] msnmgd32.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe" -quiet
O4 - HKCU\..\Run: [Windows Office] msnrgd32.exe
O4 - HKCU\..\Run: [Offices] msnmgd32.exe
O4 - HKCU\..\RunOnce: [Windows Office] msnrgd32.exe
O4 - HKCU\..\RunOnce: [Offices] msnmgd32.exe
O4 - Startup: FriendFinder Messenger.lnk = D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
O8 - Extra context menu item: &Yahoo! Search - file:///D:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///D:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///D:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122620080342
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O23 - Service: AOL Instant Messanger (AIM) - Unknown owner - D:\WINDOWS\aim.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
Post #6
ok rebuted and ran a fresh scan. thanks in advance

alice

Logfile of HijackThis v1.99.1
Scan saved at 8:16:28 PM, on 7/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe
D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\Documents and Settings\Alice\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {BD1110AA-0048-626C-8CF0-3A7E083970E6} - D:\WINDOWS\System32\UPD\bxdaynvjpr.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [sac] d:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [Windows Office] msnrgd32.exe
O4 - HKLM\..\Run: [Offices] msnmgd32.exe
O4 - HKLM\..\RunServices: [Windows Office] msnrgd32.exe
O4 - HKLM\..\RunServices: [Offices] msnmgd32.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe" -quiet
O4 - HKCU\..\Run: [Windows Office] msnrgd32.exe
O4 - HKCU\..\Run: [Offices] msnmgd32.exe
O4 - Startup: FriendFinder Messenger.lnk = D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
O8 - Extra context menu item: &Yahoo! Search - file:///D:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///D:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///D:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122620080342
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O23 - Service: AOL Instant Messanger (AIM) - Unknown owner - D:\WINDOWS\aim.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
Post #7
I suggest you do this:


Use Add/Remove Programs and remove:
180searchassistant


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

O2 - BHO: (no name) - {BD1110AA-0048-626C-8CF0-3A7E083970E6} - D:\WINDOWS\System32\UPD\bxdaynvjpr.dll (file missing)

O4 - HKLM\..\Run: [sac] d:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [Windows Office] msnrgd32.exe
O4 - HKLM\..\Run: [Offices] msnmgd32.exe
O4 - HKLM\..\RunServices: [Windows Office] msnrgd32.exe
O4 - HKLM\..\RunServices: [Offices] msnmgd32.exe
O4 - HKCU\..\Run: [Windows Office] msnrgd32.exe
O4 - HKCU\..\Run: [Offices] msnmgd32.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"


Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.



Search for and delete these files if listed:
msnrgd32.exe
msnmgd32.exe



Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #8
1800search asistant wasnt in the add/remove programs.

did a servch but couldent find ether
msnrgd32.exe
msnmgd32.exe

i did everything else. the computer seams to be loading faster now. thansk in advance

alice

Logfile of HijackThis v1.99.1
Scan saved at 9:04:22 PM, on 7/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe
D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Documents and Settings\Alice\Desktop\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe" -quiet
O4 - Startup: FriendFinder Messenger.lnk = D:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe
O8 - Extra context menu item: &Yahoo! Search - file:///D:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///D:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///D:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122620080342
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O23 - Service: AOL Instant Messanger (AIM) - Unknown owner - D:\WINDOWS\aim.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
Post #11
Good Job


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D



MOST IMPORTANT: You Need to Update Windows and IE to get all the Latest Security Patches to protect your computer from the malware that is around on the internet. Please go to
http://v5.windowsupdate.microsoft.com/v5co…t.aspx?ln=en-us]Microsoft Windows and Internet Explorer Updates to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the cirtical updates installed (Free) Microsoft Office Update
Post #12
ok i did all that and the computer is runing great now. im happy about that :D is ther anything else i need to do? how did this stuff atack me in 6 hours of a fresh instal of windows. thanks in advance. alice :D :D :D
Post #14
i havent had the money to buy a virus program. i have microsoft atispyware and adware instaled on my computer. i need to get a virus scan i know. but have a very tight budget. i do apreceat all the help you have given me. im still confused how it happens but i dont know alot about computers or how to protect them. thanks in advance alice

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI