What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Simbala's HJT log

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Ewido should find and remove what's left.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #33
hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 8:22:24 PM, on 10/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\khooker.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sotecglobal.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [YQVJSo1x] C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1128610856\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe



ewido log

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 8:14:56 PM, 10/18/2005
+ Report-Checksum: 99360269

+ Scan result:

HKLM\SYSTEM\CurrentControlSet\Services\WinIK -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\Security -> Spyware.CommonName : Error during cleaning
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\Enum -> Spyware.CommonName : Error during cleaning
:mozilla.21:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.158:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.203:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.204:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.208:C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim [removed][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\Documents and Settings\Kim Hamerly\Cookies\kim hamerly@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.7:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.8:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.9:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.11:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.12:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.13:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.14:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.15:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.2o7 : Error during cleaning
:mozilla.16:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.17:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Ru4 : Error during cleaning
:mozilla.22:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.24:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.28:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Hitbox : Error during cleaning
:mozilla.29:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Atdmt : Error during cleaning
:mozilla.45:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Bfast : Error during cleaning
:mozilla.46:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Linksynergy : Error during cleaning
:mozilla.47:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Linksynergy : Error during cleaning
:mozilla.48:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Linksynergy : Error during cleaning
:mozilla.49:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.53:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Revenue : Error during cleaning
:mozilla.54:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.55:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Doubleclick : Error during cleaning
:mozilla.56:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Adserver : Error during cleaning
:mozilla.61:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Centrport : Error during cleaning
:mozilla.63:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
:mozilla.68:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.69:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.70:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.71:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.72:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.73:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Advertising : Error during cleaning
:mozilla.75:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.76:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.77:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.120:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Coremetrics : Error during cleaning
:mozilla.134:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Mediaplex : Error during cleaning
:mozilla.143:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.145:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.146:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.147:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.148:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.149:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Trafficmp : Error during cleaning
:mozilla.197:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Googleadservices : Error during cleaning
:mozilla.218:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.219:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Liveperson : Error during cleaning
:mozilla.239:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
:mozilla.240:C:\Program Files\support.com\backup\co\cookies.txt\21319_568d6aa15_/cookies.txt -> Spyware.Cookie.Webtrendslive : Error during cleaning
C:\Program Files\wpurwwvo\cnml.exe -> Spyware.CommonName : Error during cleaning
C:\WINDOWS\system32\drivers\winik.sys -> Trojan.Rootkit.Agent.q : Error during cleaning


::Report End


upon reboot- mcafee alerted me to the trojan again….

till tomorrow…

thanks
kim
Post #34
Download Pocket Killbox version 2.0.0.175
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.

Then double-click on the killbox.exe program.


Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled Delete on reboot.

Do not close killbox, and open notepad, by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.


When notepad is open, copy and paste the following bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing Control-C on your keyboard. Then click on the open notepad windows and press Control-V to paste the contents into the notepad.




C:\WINDOWS\system32\drivers\winik.sys
C:\Program Files\wpurwwvo\cnml.exe


OPen C:\Program Files\wpurwwvo <– Add every File in this folder into the above to be removed:


Return to Killbox, go to the File menu and select Paste from Clipboard.


Still in Killbox, click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually

After reboot you should be able to delete this folder: C:\Program Files\wpurwwvo
Post #36
; Instructions: Copy and paste the Blue text into a text editor such as Notepad.
;
; Save this text as FixVX2.reg. Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
;
;


REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]
"Type"=dword:00000004
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK]
"Type"=dword:00000004
"Start"=dword:00000004


Double-click on FixVX2.reg. When it asks you to merge the information to the registry click Yes.


Reboot .


Copy and paste the Blue text into a text editor such as Notepad.
;
; Save this text as Fixreg.reg. Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
;


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK]

Double-click on Fixreg.reg. When it asks you to merge the information to the registry click Yes.



Reboot and let me know how you are doing.
Post #37
okay- just got back on my computer- mcafee popped up and let me know it now cleaned and deleted winik.sys. why? i have no clue- since when i last was on here- it told me i could not delete it… but computers are strange. should i still do the above?? i am going to reboot now and see what happens though…..
Post #38
Lets see if they are still in the registry.

On your your Desktop and double click on regsrch.vbs
(if you have script protection, please allow this to run)

In the dialog that opens enter the following:
winik

Press 'OK'

The search will run for a while then alert you when it is finished.

Press 'OK' and copy the contents of the WordPad window and post in this thread.
Post #39
REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "winik" 10/19/2005 10:32:04 AM ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000] "Service"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000] "DeviceDesc"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK] "DisplayName"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Security] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum] "0"="Root\\LEGACY_WINIK\\0000" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000] "Service"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000] "DeviceDesc"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK] "DisplayName"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000] "Service"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000] "DeviceDesc"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK] "DisplayName"="WinIK" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum] "0"="Root\\LEGACY_WINIK\\0000" [HKEY_USERS\S-1-5-21-2914288250-2704639424-2437969446-1005\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit] "LastKey"="My Computer\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinIK"
Post #40

okay- just got back on my computer- mcafee popped up and let me know it now cleaned and deleted winik.sys.

why? i have no clue- since when i last was on here- it told me i could not delete it… but computers are strange.

should i still do the above?? i am going to reboot now and see what happens though…..

Yes, run the two registry fixes I posted.

Then run RegSrch.vbs after reboot.

I'd also like to see a new HJT log at this point.
Post #41
RegSrch.vbs log

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "winik" 10/19/2005 11:04:23 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_USERS\S-1-5-21-2914288250-2704639424-2437969446-1005\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"="My Computer\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\WinIK"



new hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 11:06:30 AM, on 10/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sotecglobal.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [YQVJSo1x] C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe



no sign of mcafee popups.. so that is good- machine still running pretty slow though…. althought that is the fastest i have finished the hijackthis process- it usually gets " stuck" in the middle- then finishes.
Post #42
Looks like our friend doesn't want to die.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [YQVJSo1x] C:\PROGRA~1\wpurwwvo\eAwCHgxM.exe


Close ALL windows and browsers except HijackThis and click "Fix checked"

Open C:\PROGRAM Files\wpurwwvo <–Delete Folder


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #43
no mcafee alerts… but very slow start-up- too forever to open folder that hijackthis is in… , t0ook AGEs to open netscape…

arghhh


Logfile of HijackThis v1.99.1
Scan saved at 11:44:15 AM, on 10/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\khooker.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Company\Quick Start Button\QSB.exe
C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\MMDiag.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kim Hamerly\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sotecglobal.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sotecglobal.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.weather.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com/"); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Kim Hamerly\Application Data\Mozilla\Profiles\default\4nrrcuwv.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKCU\..\Run: [QSB] C:\Program Files\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.5.6.21\PlaxoHelper.exe -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sotecglobal.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Post #44
I'm really sorry about all the downloads and restarts. This new bad guy is being very hard to kill.

Backup your Registry…
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run…)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.
Post #45
Looks like he wants to be Micah's buddy. Micah_6:8 I'm from the McAfeeHelp forums and I've seen many of these cases. Is there a place where I can talk with you about the easiest way to detect and remove this user's problem without disrupting your progress. Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI