Need help with my HJ log

need help please

BUMP

Need help please

We are sorry for the delay in replying to you.

I see that you are running msconfig in /auto mode which means that you may have selectively removed some items in the past from the startup procedure. This can be bad if they are malware, so we would like you to re-enable those startup entries by doing the following:

Please click on start < run, and type msconfig and then press enter. When the window opens click on the startup tab and make sure there are checkmarks in every entry. Then press ok until you are out of the program. If it asks to reboot, do not reboot.

Now please create a new Hijackthis Log and post it as a reply to this thread.

I'll receive an e-mail notification of your reply and will respond as soon as possible.

Thank you for your patience.

Hello SuspectShady and welcome to TomCoyote.

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!

Note : Once the pc has restarted if a log does not appear or the icons didn't dissappear, run the "second.bat" located inside the L2mfix folder.

Please download the trial version of Ewido security suite.

Install and Update Ewido:

• Download and install Ewido security suite.
• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Launch Ewido, there should be an icon on your desktop for it to double-click.
  • The program will prompt you to update, click the OK button.
  • The program will now go to the main screen.
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
• Once the updates are installed, close the program.

Scanning With Ewido:

• Reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
• Launch Ewido again.
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • While the scan is in progress you will be prompted to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the boxes that say "Perform action on all infections"and "Create encrypted backup" then choose clean and click OK.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report.txt file to your desktop.
• Now close ewido security suite.

Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include the Ewido report.

Step 1
We need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft AntiSpyware.
• Click on Options, Settings.
• In the left pane, click on Real-time Protection.
• Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
• Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
• After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
• Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

After the computer is clean, it is very important that you enable Real-time Protection again.


Step 2
Open HijackThis, run a scan, then check the following:

R3 - URLSearchHook: (no name) - {8F0F542D-48E5-A4B0-BA15-A4FF174B32EB} - C:\WINDOWS\sdqcfkiy.dll

O2 - BHO: (no name) - {E7F59100-CBDA-3230-DEE9-9917DD979479} - C:\WINDOWS\sdqcfkiy.dll

O3 - Toolbar: Search - {99E79BFE-1873-FDA5-F5CE-3D6200788B1E} - C:\WINDOWS\sdqcfkiy.dll

O4 - HKLM\..\Run: [xkjruc] C:\WINDOWS\System32\xkjruc.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\x4d4ps.exe reg_run
O4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32
O4 - HKLM\..\Run: [dnam] C:\WINDOWS\system32\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [Qib] C:\WINDOWS\System32\??crosoft.NET\arpa.exe
O4 - HKCU\..\Run: [Nada] C:\Program Files\tode\aucd.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000106.exe

With all other programs and browsers closed, click fix checked.


Step 3
Please set your computer to show all files.

• Double-click My Computer.
• Click the Tools menu, and then click Folder Options.
• Click the View tab.
• Clear "Hide file extensions for known file types."
• Under the "Hidden files" folder, select "Show hidden files and folders."
• Clear "Hide protected operating system files."
• Click Apply, and then click OK.

You will need to reverse this process when all steps are done.


Step 4
Please delete the following files/folders:

C:\WINDOWS\SysCheckBop32
C:\WINDOWS\System32\xkjruc.exe
C:\WINDOWS\System32\x4d4ps.exe
C:\WINDOWS\system32\d140113.a.Stub.EXE
C:\Program Files\Common Files\mc-58-12-0000106.exe
C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe

C:\WINDOWS\System32\??crosoft.NET << Whole Folder
C:\Program Files\tode << Whole Folder

If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 5
Run at least two of the following online virus scans making sure to reboot in between each one. Allow them to fix anything they find.You need to use Internet Explorer or Netscape browsers.
Bitdefender
Panda ActiveScan << Click "Scan your PC" and scan "My Computer".
Symantec Security Check << click scan for viruses
RAV Online Virus Scanner << Enter your e-mail address and click on To continue without subscribing
McAfee
Write down anything that can not be fixed. Include the file name and the path to the file.


Step 6
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include anything that can not be fixed by the online scans.
Please let us know of any complications you had and how the computer is behaving.

Please Download the following tools to see if anything else shows up.

• Download WinPFind
  • Right Click the Zip Folder and Select "Extract All"
  • Extract it somewhere you will remember like the Desktop
  • Dont do anything with it yet!
• Download Track qoo
  • Save it somewhere you will remember like the Desktop

Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Doubleclick WinPFind.exe

• Click "Start Scan"
• It will scan the entire System, so please be patient!
• Once the Scan is Complete
• Go to the WinPFind folder
• Locate WinPFind.txt
• Place those results in the next post!

Reboot back to Normal Mode!

Double Click on "Track qoo.vbs"

Note - If your Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless!

Wait a few seconds and a notepad page will pop up, Copy & Paste those results and place them in the next post along with the results of WinPFind!

when i ran that trackqoo vbs i got an error saying invalid syntax, source: Null, Code: 800401e4, but this txt below was on my desktop and i don't know where it came from but here it is as well as the Winpftxt REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "FLMOFFICE4DMOUSE"="C:\\Program Files\\Browser Mouse\\mouse32a.exe" "FLMK08KB"="C:\\Program Files\\Muiltmedia keyboard utility\\1.1\\MMKEYBD.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ 65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00 —————– WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows XP Current Build: Current Build Number: 2600 Internet Explorer Version: 6.0.2600.0000 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder… UPX! 2/16/2005 11:06:16 AM 218112 C:\HijackThis.exe Checking %ProgramFilesDir% folder… Checking %WinDir% folder… PECompact2 9/18/2005 1:08:02 PM 15841777 C:\WINDOWS\LPT$VPN.845 qoologic 9/18/2005 1:08:02 PM 15841777 C:\WINDOWS\LPT$VPN.845 SAHAgent 9/18/2005 1:08:02 PM 15841777 C:\WINDOWS\LPT$VPN.845 UPX! 5/3/2005 11:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll UPX! 1/10/2005 4:17:24 PM 170053 C:\WINDOWS\tsc.exe PECompact2 9/18/2005 1:08:02 PM 15841777 C:\WINDOWS\VPTNFILE.845 qoologic 9/18/2005 1:08:02 PM 15841777 C:\WINDOWS\VPTNFILE.845 SAHAgent 9/18/2005 1:08:02 PM 15841777 C:\WINDOWS\VPTNFILE.845 UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll aspack 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll Checking %System% folder… PEC2 8/23/2001 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc UPX! 11/25/2003 5:32:02 PM 123392 C:\WINDOWS\SYSTEM32\pncrt.dll Umonitor 8/23/2001 7:00:00 AM 630784 C:\WINDOWS\SYSTEM32\rasdlg.dll winsync 8/23/2001 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu Checking %System%\Drivers folder and sub-folders… Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts Checking the Windows folder and sub-folders for system and hidden files within the last 60 days… 9/25/2005 5:15:16 AM S 2048 C:\WINDOWS\bootstat.dat 9/25/2005 5:13:48 AM H 57 C:\WINDOWS\pog4Z 9/25/2005 5:14:20 AM S 64 C:\WINDOWS\CSC\00000001 9/24/2005 10:13:20 PM S 64 C:\WINDOWS\CSC\00000002 9/24/2005 5:10:04 PM S 64 C:\WINDOWS\CSC\csc1.tmp 9/18/2005 9:36:02 PM HS 3072 C:\WINDOWS\Installer\{C6F5B6CF-609C-428E-876F-CA83176C021B}\Thumbs.db 9/25/2005 4:48:44 AM H 31767 C:\WINDOWS\system32\vsconfig.xml 9/13/2005 4:25:02 AM H 4212 C:\WINDOWS\system32\zllictbl.dat 9/25/2005 5:15:08 AM H 8192 C:\WINDOWS\system32\config\default.LOG 9/25/2005 5:15:28 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG 9/25/2005 5:15:20 AM H 12288 C:\WINDOWS\system32\config\SECURITY.LOG 9/25/2005 5:15:30 AM H 61440 C:\WINDOWS\system32\config\software.LOG 9/25/2005 5:15:20 AM H 724992 C:\WINDOWS\system32\config\system.LOG 9/24/2005 10:13:32 PM HS 194 C:\WINDOWS\Tasks\RUTASK.job 9/25/2005 5:14:28 AM H 6 C:\WINDOWS\Tasks\SA.DAT Checking for CPL files… 5/25/2004 9:06:58 AM 417792 C:\WINDOWS\SYSTEM32\ac3filter.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 558592 C:\WINDOWS\SYSTEM32\appwiz.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 130048 C:\WINDOWS\SYSTEM32\desk.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 150016 C:\WINDOWS\SYSTEM32\hdwwiz.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 294912 C:\WINDOWS\SYSTEM32\inetcpl.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 119808 C:\WINDOWS\SYSTEM32\intl.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 65536 C:\WINDOWS\SYSTEM32\joy.cpl Sun Microsystems, Inc. 6/2/2005 10:52:54 PM 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 559616 C:\WINDOWS\SYSTEM32\mmsys.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 256000 C:\WINDOWS\SYSTEM32\nusrmgr.cpl NVIDIA Corporation 6/15/2005 12:20:00 PM 73728 C:\WINDOWS\SYSTEM32\nvtuicpl.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\nwc.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\odbccp32.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 109056 C:\WINDOWS\SYSTEM32\powercfg.cpl Apple Computer, Inc. 9/23/2004 6:57:40 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 270848 C:\WINDOWS\SYSTEM32\sysdm.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 90112 C:\WINDOWS\SYSTEM32\timedate.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 66048 C:\WINDOWS\SYSTEM32\dllcache\access.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 558592 C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 130048 C:\WINDOWS\SYSTEM32\dllcache\desk.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 150016 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 294912 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 119808 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 65536 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 559616 C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 256000 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 109056 C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 147456 C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 270848 C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl Microsoft Corporation 8/23/2001 7:00:00 AM 90112 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder… 7/22/2005 12:51:16 PM 1757 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk 7/21/2005 7:09:20 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini Checking files in %ALLUSERSPROFILE%\Application Data folder… 7/21/2005 6:42:06 PM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini Checking files in %USERPROFILE%\Startup folder… 7/21/2005 7:09:20 PM HS 84 C:\Documents and Settings\Suspect\Start Menu\Programs\Startup\desktop.ini Checking files in %USERPROFILE%\Application Data folder… 7/22/2005 12:48:36 PM 1217 C:\Documents and Settings\Suspect\Application Data\AdobeDLM.log 7/21/2005 6:42:06 PM HS 62 C:\Documents and Settings\Suspect\Application Data\desktop.ini 7/22/2005 12:48:36 PM 0 C:\Documents and Settings\Suspect\Application Data\dm.ini »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\stqtymmm {08306fc4-ebf4-4407-b178-b0c511e473b8} = C:\WINDOWS\System32\roboa.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin = %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627} = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872} CNavExtBho Class = C:\Program Files\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\System32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll {8E718888-423F-11D2-876E-00A0C9082467} = &Radio : C:\WINDOWS\System32\msdxm.ocx [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66} MenuText = Uninstall BitDefender Online Scanner v8 : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9E248641-0E24-4DDB-9A1F-705087832AD6} MenuText = Java : [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} Media Band = %SystemRoot%\System32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} Favorites Band = %SystemRoot%\System32\shdocvw.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E} History Band = %SystemRoot%\System32\shdocvw.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" SSC_UserPrompt C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer FLMOFFICE4DMOUSE C:\Program Files\Browser Mouse\mouse32a.exe FLMK08KB C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup nwiz nwiz.exe /install NvMediaCenter RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe" Zone Labs Client C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe KernelFaultCheck %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Screen Calendar "C:\Program Files\Screen Calendar\scrcal.exe" -m [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state system.ini 0 win.ini 0 bootini 0 services 0 startup 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = {0DF44EAA-FF21-4412-828E-260A8728E7F1} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 undockwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations LowRiskFileTypes .zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mov;.mp3;.wav HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 145 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System DisableRegistryTools 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif = wzcdlg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 9/25/2005 5:22:43 AM

Please open Notepad, and copy/paste the code in the box below into a new text file. Save it as KillQoo.reg (set Filetype to "All Files") and save it on your Desktop.

REGEDIT4

[-HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\stqtymmm]

[-HKEY_CLASSES_ROOT\CLSID\{08306fc4-ebf4-4407-b178-b0c511e473b8}]

Scan with HijackThis and click config than on the misc tools tab, select delete a file on reboot. Paste the bold text into the file name box and click open.

C:\WINDOWS\RMAgentOutput.dll

When it asks you to reboot, choose no. Click delete a file on reboot and paste the next line into the file name box and click open.

C:\WINDOWS\Tasks\RUTASK.job

When it asks you to reboot, choose no. Click delete a file on reboot and paste the next line into the file name box and click open.

C:\WINDOWS\System32\roboa.dll

This time when it asks you to reboot, choose yes.



Now Locate and DoubleClick KillQoo.reg-> Allow it to merge into the Registry!


Reboot the computer and scan with HijackThis. Post the new log as a reply to this thread.
Let us know how the computer is behaving now.