Logfile of HijackThis v1.99.1
Scan saved at 8:22:39 PM, on 2006/7/2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\PROGRA~1\NORTON~1\navw32.exe
C:\WINDOWS\explorer.exe
C:\HJT\hijackthis\HijackThis.exe
R3 - URLSearchHook: (no name) - {B4790D7D-024F-26D6-171E-323BE57136B6} - panel_its.dll (file missing)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{55DB6B77-5C16-4B59-9DA5-435D39243DF9}.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{55DB6B77-5C16-4B59-9DA5-435D39243DF9}.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
O4 - HKLM\..\Run: [cnftips] stuffmon.exe
O4 - HKLM\..\Run: [backorif] driver64.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gwbwy.exe] C:\WINDOWS\system32\gwbwy.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [DTOURS] ms-its.exe
O4 - HKCU\..\Run: [jopplerg] Preliminary.exe
O4 - HKCU\..\Run: [NukeSpan] powerdll.exe
O4 - HKCU\..\Run: [Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2385B5C-C436-4ECC-A391-F5578F183835}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O17 - HKLM\System\CS1\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O17 - HKLM\System\CS2\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
This File
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{55DB6B77-5C16-4B59-9DA5-435D39243DF9}.dll
I already Press FIX to it…cuz b4 i use AVG scan this file than AVG will Stop Scan…
so i think it is the Trojan…but i wrong,the virus still here…pls help and thx to you all^^.
Welcome to the forum.
Your computer has been hijacked by people in the Ukraine. What you have is a Wareout infection.
85.255.112.0 - 85.255.127.255
Please download
FixWareout from one of these links:
Fixwareout.exe Fixwareout.exe CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
* Save it to your
desktop and run it.
* Click
Next , then
Install , make sure
"Run fixit" is checked and click
Finish.
* The fix will begin;
follow the prompts.
* You will be asked to reboot your computer;
please do so.
* Your system may take longer than usual to load;
this is normal.
* Once the desktop loads a text will open
(report.txt) . We'll need that in a bit.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "
Do a systen scan only ".
Then "check" the box to the left of these item(s):
(
Note: Fixwareout.exe may have removed some of these )
Then click "
Fix checked " and close Hijack This!.
Reboot in
"safe" mode .
Delete all of the following
noted (in red) file(s)/
FOLDER(s) you can find:
c:\windows\system32\
gwbwy.exe <— file
c:\windows\system32\
{55db6b77-5c16-4b59-9da5-435d39243df9}.dll <— file
driver64.exe <— file
ms-its.exe <— file
powerdll.exe <— file
preliminary.exe <— file
stuffmon.exe <— file
Some malware files may be "hidden".
Be sure to
show hidden files when looking for these file(s) and/or folder(s).
Reboot in normal mode and "copy/paste" a new log file
into this thread .
Also open this file with Notepad:
C:\fixwareout\report.txt
And paste it's contents into your next post.
Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0C804B656232-3828-0FD4-8420-F525211B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6FD56766ECE2-8C6B-7724-BF6F-F93CB0C6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}682E6C3494F4-F71A-9CA4-9653-C3993F23{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AFA7DF50487F-91EB-5244-CE34-2F210A50{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A80588BD1ADA-D1E9-3B14-AF6B-FD0AF31C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8023ECD3B721-DF19-CDE4-275A-287B5CF5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BADA263672CB-1708-C6A4-909A-F706BD0E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DE8F8321CFE7-65BA-A5B4-27CE-0AE2E0DC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}02C503A457E2-C73A-B7F4-7280-46429614{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3D24A86451A-E68B-5794-9DAB-B8E10C0F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C60A4216C2F0-BA69-0314-B434-7C03561C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0972D0BD6D2D-D948-5A54-AEE5-81EE7A26{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ECA8DFAA5047-F398-8CA4-423B-BF2839A8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C4F83B0F0444-22DA-75F4-E25B-B39F75BC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2DC893C87121-EB4B-4B84-F89F-7709EC24{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E176F1D8EAC1-3E28-6814-9774-193A9D29{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CE60C9F417BF-2E38-C1D4-9CF9-D4D9805E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2489C89DF2FB-4A08-ACD4-6DAC-658CB1F2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DF8B7AF7FAEE-416A-D284-A763-01FC2B97{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}445A43759CC4-F69B-A734-61B9-673931DE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CB6C4C0693D3-90AA-FF54-196D-EFEDF232{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D6CBB77AD7D7-F09A-F004-9837-14C7D2E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9E43DD22DBFF-A7DB-4FB4-AA2B-7B96D194{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F5F89011FD8E-65D8-F084-C14B-96272471{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C0105A545A1C-7CA8-F484-CE3B-0D1D93F8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BE9ACFE58F6D-F0DA-49A4-F488-703BA976{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E302F2E236BD-6CA8-CAD4-FC3A-6C51D3D9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DB6CFFBF990F-803A-4AD4-8CA6-71D136A2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B79B680D6529-0F89-1B24-6C35-8CADB3B9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}44A63C29561A-673A-9684-1513-9BDB3A84{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}569F351EC904-E46A-A484-C0B7-A161B937{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}31A51C997AF3-95E9-FF14-070C-4E4B6242{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4317969811A6-B558-8194-F4CA-A9897746{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}95E545760DFE-ED39-0EF4-6422-95392CB8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8CD89DD8C483-D868-2854-DD99-0713AD0E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}65B7858F650E-13FB-0944-EB99-9587CD64{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}910982B7D419-140A-4F74-40C4-751C7780{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}216DE5184945-C9C9-8984-EA89-3C62FEDB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EBA3C8B278C7-D50A-B774-19D1-469427CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CEC77B68A82F-C999-00F4-2847-6B532BF1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CD8F02453769-B498-7D94-D230-D81DB29C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FBE183B4A41A-F8F8-4C04-5084-BB03D16F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}60BDE0F0175B-3C28-58C4-A640-557694FC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D1DA3A937E2F-87A9-0184-A26C-129C9098{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}14FC185FCD4A-97A9-FF14-14B9-E62DB8FA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5EF03699D583-8C38-14A4-948D-64AF7002{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}32B2FAED43D0-2CBA-6744-4ECB-10AF34D9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DB2D91E73683-DF5B-C5C4-49C5-1AC35FAC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}866705CEA60F-2638-0374-AD72-8C8530E1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8BCEE357B1B9-C70B-A6D4-598F-D3A64584{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1B0DDC6B2392-7FDA-92C4-17E2-AEC6D366{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CC5B3F745B1D-F999-4BA4-0D7F-22800E61{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7052264A25AD-5E78-8BF4-363A-07B5BC7E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5BB114E93CA8-CD0B-9E64-4BFC-946C6559{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}63C8D266937A-61D8-16F4-F06B-855631B5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4D6B1ECABEF4-61E9-3174-5905-2BC74CE2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B4CE8930C2EE-5158-BBD4-7AA9-A6A03476{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5528C58475F8-124B-F264-205A-A27857E1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}84CE4E9D3617-659A-40D4-F8AC-30FA7EFE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A1E5CF602D63-F948-C204-7581-2622E498{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B6A7858C81D0-C0B8-1984-7561-2DA5F211{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}78F5AB539EB0-034B-E734-50E5-C8ACDBBA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}93BACD77A57C-F4DA-5544-F1BD-1BADB3A7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AD3C5A55EC16-76C8-9DC4-FAE7-9E6F0267{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}335A0A524D00-D5AA-1654-164E-979CFCBB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E1146B93CCF6-FAA8-A364-DEBA-5FB53712{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1AC182CF16AE-F9FA-36B4-BF62-C951FFF6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}340C23A8559B-DEE9-1D54-6C4C-C56551A8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C873B402F9E0-081A-84E4-C6A9-BD12943A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04ABAB0E24E8-3489-3AE4-620A-328659E8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F3D35C23A80D-EA69-4A64-0FCA-F73C8F52{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B05DDBBF59F5-E3C8-88F4-B4DD-4B98CE4F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7592EFCB5EA1-BA79-4C14-8A79-1FB6F670{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DC89B1B8AFA1-D73B-5214-7B6B-BD29E648{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}44BEE6CB5C52-A40B-6444-9B00-2D2DD36D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\vkjmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C959287AFB7A-0968-80B4-C3D6-7A299585{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8457107D26F0-A06A-F2B4-3948-FD14BE1C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…
PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate
遙遙?Search by size and names…
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSXNV.EXE
遙遙?Misc files
* thequicklink C:\WINDOWS\System32\{55DB6~1.DLL
遙遙?Checking for older varients covered by the Rem3 tool
遙遙?
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSXNV.EXE 51,295 2006-07-02
C:\WINDOWS\SYSTEM32\DMJKV.EXE 44,109 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{55DB6B77-5C16-4B59-9DA5-435D39243DF9}.dll
{C1EB41DF-8493-4B2F-A60A-0F62D7017548}.exe
{585992A7-6D3C-4B08-8690-A7BFA782959C}.exe
{D63DD2D2-00B9-4446-B04A-25C5BC6EEB44}.exe
{F4EC89B4-DD4B-4F88-8C3E-5F95FBBDD50B}.exe
{A34921DB-9A6C-4E48-A180-0E9F204B378C}.exe
{8A15565C-C4C6-45D1-9EED-B9558A32C043}.exe
{6FFF159C-26FB-4B63-AF9F-EA61FC281CA1}.exe
{21735BF5-ABED-463A-8AAF-6FCC39B6411E}.exe
{BBCFC979-E461-4561-AA5D-00D425A0A533}.exe
{7620F6E9-7EAF-4CD9-8C67-61CE55A5C3DA}.exe
{7A3BDAB1-DB1F-4455-AD4F-C75A77DCAB39}.exe
{ABBDCA8C-5E05-437E-B430-0BE935BA5F87}.exe
{112F5AD2-1657-4891-8B0C-0D18C8587A6B}.exe
{894E2262-1857-402C-849F-36D206FC5E1A}.exe
{EFE7AF03-CA8F-4D04-A956-7163D9E4EC48}.exe
{1E75872A-A502-462F-B421-8F57485C8255}.exe
{67430A6A-9AA7-4DBB-8515-EE2C0398EC4B}.exe
{2EC47CB2-5095-4713-9E16-4FEBACE1B6D4}.exe
{5B136558-B60F-4F61-8D16-A739662D8C36}.exe
{9556C649-CFB4-46E9-B0DC-8AC39E411BB5}.exe
{E7CB5B70-A363-4FB8-87E5-DA52A4622507}.exe
{16E00822-F7D0-4AB4-999F-D1B547F3B5CC}.exe
{663D6CEA-2E71-4C29-ADF7-2932B6CDD0B1}.exe
{48546A3D-F895-4D6A-B07C-9B1B753EECB8}.exe
{1E0358C8-27DA-4730-8362-F06AEC507668}.exe
{CAF53CA1-5C94-4C5C-B5FD-38637E19D2BD}.exe
{9D43FA01-BCE4-4476-ABC2-0D34DEAF2B23}.exe
{2007FA46-D849-4A41-83C8-385D99630FE5}.exe
{AF8BD26E-9B41-41FF-9A79-A4DCF581CF41}.exe
{8909C921-C62A-4810-9A78-F2E739A3AD1D}.exe
{CF496755-046A-4C85-82C3-B5710F0EDB06}.exe
{F61D30BB-4805-40C4-8F8F-A14A4B381EBF}.exe
{C92BD18D-032D-49D7-894B-96735420F8DC}.exe
{1FB235B6-7482-4F00-999C-F28A86B77CEC}.exe
{CC724964-1D91-477B-A05D-7C872B8C3ABE}.exe
{BDEF26C3-98AE-4898-9C9C-5494815ED612}.exe
{0877C157-4C04-47F4-A041-914D7B289019}.exe
{46DC7859-99BE-4490-BF31-E056F8587B56}.exe
{E0DA3170-99DD-4582-868D-384C8DD98DC8}.exe
{8BC29359-2246-4FE0-93DE-EFD067545E59}.exe
{6477989A-AC4F-4918-855B-6A1189697134}.exe
{2426B4E4-C070-41FF-9E59-3FA799C15A13}.exe
{739B161A-7B0C-484A-A64E-409CE153F965}.exe
{48A3BDB9-3151-4869-A376-A16592C36A44}.exe
{9B3BDAC8-53C6-42B1-98F0-9256D086B97B}.exe
{2A631D17-6AC8-4DA4-A308-F099FBFFC6BD}.exe
{9D3D15C6-A3CF-4DAC-8AC6-DB632E2F203E}.exe
{679AB307-884F-4A94-AD0F-D6F85EFCA9EB}.exe
{8F39D1D0-B3EC-484F-8AC7-C1A545A5010C}.exe
{17427269-B41C-480F-8D56-E8DF11098F5F}.exe
{491D69B7-B2AA-4BF4-BD7A-FFBD22DD34E9}.exe
{2E2D7C41-7389-400F-A90F-7D7DA77BBC6D}.exe
{232FDEFE-D691-45FF-AA09-3D3960C4C6BC}.exe
{ED139376-9B16-437A-B96F-4CC95734A544}.exe
{79B2CF10-367A-482D-A614-EEAF7FA7B8FD}.exe
{2F1BC856-CAD6-4DCA-80A4-BF2FD98C9842}.exe
{E5089D4D-9FC9-4D1C-83E2-FB714F9C06EC}.exe
{92D9A391-4779-4186-82E3-1CAE8D1F671E}.exe
{42CE9077-F98F-48B4-B4BE-12178C398CD2}.exe
{CB57F93B-B52E-4F57-AD22-4440F0B38F4C}.exe
{8A9382FB-B324-4AC8-893F-7405AAFD8ACE}.exe
{62A7EE18-5EEA-45A5-849D-D2D6DB0D2790}.exe
{C16530C7-434B-4130-96AB-0F2C6124A06C}.exe
{F0C01E8B-BAD9-4975-B86E-A15468A42D3D}.exe
{41692464-0827-4F7B-A37C-2E754A305C20}.exe
{CD0E2EA0-EC72-4B5A-AB56-7EFC1238F8ED}.exe
{E0DB607F-A909-4A6C-8071-BC276362ADAB}.exe
{5FC5B782-A572-4EDC-91FD-127B3DCE3208}.exe
{C13FA0DF-B6FA-41B3-9E1D-ADA1DB88508A}.exe
{05A012F2-43EC-4425-BE19-F78405FD7AFA}.exe
{32F3993C-3569-4AC9-A17F-4F4943C6E286}.exe
{6C0BC39F-F6FB-4277-B6C8-2ECE66765DF6}.exe
this is the report file^^ so i continue it like what you write?
going to safe mode now?^^ thx~
That's quite a "list"….
Now, a new HijackThis! log, please.
Logfile of HijackThis v1.99.1
Scan saved at 10:09:19 PM, on 2006/7/2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\hijackthis\HijackThis.exe
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{5CC4E659-81A1-47C3-B18F-7BBCED940633}.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{5CC4E659-81A1-47C3-B18F-7BBCED940633}.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [aavzm.exe] C:\WINDOWS\system32\aavzm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2385B5C-C436-4ECC-A391-F5578F183835}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O17 - HKLM\System\CS1\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O17 - HKLM\System\CS2\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
very thx to you^^
I forgot tell you,i go in safe mode and i only found
{55db6b77-5c16-4b59-9da5-435d39243df9}.dll
And the:driver64,ms-its,powerdll,preliminary,stuffmon,
this all cant find.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "
Do a systen scan only ".
Then "check" the box to the left of these item(s):
Then click "
Fix checked " and close Hijack This!.
Reboot in
"safe" mode .
Delete all of the following
noted (in red) file(s)/
FOLDER(s) you can find:
c:\windows\system32\
aavzm.exe <— file
c:\windows\system32\
{5cc4e659-81a1-47c3-b18f-7bbced940633}.dll <— file
C:\WINDOWS\SYSTEM32\
CSXNV.EXE <— file
C:\WINDOWS\SYSTEM32\
DMJKV.EXE <— file
c:\windows\system32\
{55DB6B77-5C16-4B59-9DA5-435D39243DF9}.dll <— file
c:\windows\system32\
{C1EB41DF-8493-4B2F-A60A-0F62D7017548}.exe <— file
c:\windows\system32\
{585992A7-6D3C-4B08-8690-A7BFA782959C}.exe <— file
c:\windows\system32\
{D63DD2D2-00B9-4446-B04A-25C5BC6EEB44}.exe <— file
c:\windows\system32\
{F4EC89B4-DD4B-4F88-8C3E-5F95FBBDD50B}.exe <— file
c:\windows\system32\
{A34921DB-9A6C-4E48-A180-0E9F204B378C}.exe <— file
c:\windows\system32\
{8A15565C-C4C6-45D1-9EED-B9558A32C043}.exe <— file
c:\windows\system32\
{6FFF159C-26FB-4B63-AF9F-EA61FC281CA1}.exe <— file
c:\windows\system32\
{21735BF5-ABED-463A-8AAF-6FCC39B6411E}.exe <— file
c:\windows\system32\
{BBCFC979-E461-4561-AA5D-00D425A0A533}.exe <— file
c:\windows\system32\
{7620F6E9-7EAF-4CD9-8C67-61CE55A5C3DA}.exe <— file
c:\windows\system32\
{7A3BDAB1-DB1F-4455-AD4F-C75A77DCAB39}.exe <— file
c:\windows\system32\
{ABBDCA8C-5E05-437E-B430-0BE935BA5F87}.exe <— file
c:\windows\system32\
{112F5AD2-1657-4891-8B0C-0D18C8587A6B}.exe <— file
c:\windows\system32\
{894E2262-1857-402C-849F-36D206FC5E1A}.exe <— file
c:\windows\system32\
{EFE7AF03-CA8F-4D04-A956-7163D9E4EC48}.exe <— file
c:\windows\system32\
{1E75872A-A502-462F-B421-8F57485C8255}.exe <— file
c:\windows\system32\
{67430A6A-9AA7-4DBB-8515-EE2C0398EC4B}.exe <— file
c:\windows\system32\
{2EC47CB2-5095-4713-9E16-4FEBACE1B6D4}.exe <— file
c:\windows\system32\
{5B136558-B60F-4F61-8D16-A739662D8C36}.exe <— file
c:\windows\system32\
{9556C649-CFB4-46E9-B0DC-8AC39E411BB5}.exe <— file
c:\windows\system32\
{E7CB5B70-A363-4FB8-87E5-DA52A4622507}.exe <— file
c:\windows\system32\
{16E00822-F7D0-4AB4-999F-D1B547F3B5CC}.exe <— file
c:\windows\system32\
{663D6CEA-2E71-4C29-ADF7-2932B6CDD0B1}.exe <— file
c:\windows\system32\
{48546A3D-F895-4D6A-B07C-9B1B753EECB8}.exe <— file
c:\windows\system32\
{1E0358C8-27DA-4730-8362-F06AEC507668}.exe <— file
c:\windows\system32\
{CAF53CA1-5C94-4C5C-B5FD-38637E19D2BD}.exe <— file
c:\windows\system32\
{9D43FA01-BCE4-4476-ABC2-0D34DEAF2B23}.exe <— file
c:\windows\system32\
{2007FA46-D849-4A41-83C8-385D99630FE5}.exe <— file
c:\windows\system32\
{AF8BD26E-9B41-41FF-9A79-A4DCF581CF41}.exe <— file
c:\windows\system32\
{8909C921-C62A-4810-9A78-F2E739A3AD1D}.exe <— file
c:\windows\system32\
{CF496755-046A-4C85-82C3-B5710F0EDB06}.exe <— file
c:\windows\system32\
{F61D30BB-4805-40C4-8F8F-A14A4B381EBF}.exe <— file
c:\windows\system32\
{C92BD18D-032D-49D7-894B-96735420F8DC}.exe <— file
c:\windows\system32\
{1FB235B6-7482-4F00-999C-F28A86B77CEC}.exe <— file
c:\windows\system32\
{CC724964-1D91-477B-A05D-7C872B8C3ABE}.exe <— file
c:\windows\system32\
{BDEF26C3-98AE-4898-9C9C-5494815ED612}.exe <— file
c:\windows\system32\
{0877C157-4C04-47F4-A041-914D7B289019}.exe <— file
c:\windows\system32\
{46DC7859-99BE-4490-BF31-E056F8587B56}.exe <— file
c:\windows\system32\
{E0DA3170-99DD-4582-868D-384C8DD98DC8}.exe <— file
c:\windows\system32\
{8BC29359-2246-4FE0-93DE-EFD067545E59}.exe <— file
c:\windows\system32\
{6477989A-AC4F-4918-855B-6A1189697134}.exe <— file
c:\windows\system32\
{2426B4E4-C070-41FF-9E59-3FA799C15A13}.exe <— file
c:\windows\system32\
{739B161A-7B0C-484A-A64E-409CE153F965}.exe <— file
c:\windows\system32\
{48A3BDB9-3151-4869-A376-A16592C36A44}.exe <— file
c:\windows\system32\
{9B3BDAC8-53C6-42B1-98F0-9256D086B97B}.exe <— file
c:\windows\system32\
{2A631D17-6AC8-4DA4-A308-F099FBFFC6BD}.exe <— file
c:\windows\system32\
{9D3D15C6-A3CF-4DAC-8AC6-DB632E2F203E}.exe <— file
c:\windows\system32\
{679AB307-884F-4A94-AD0F-D6F85EFCA9EB}.exe <— file
c:\windows\system32\
{8F39D1D0-B3EC-484F-8AC7-C1A545A5010C}.exe <— file
c:\windows\system32\
{17427269-B41C-480F-8D56-E8DF11098F5F}.exe <— file
c:\windows\system32\
{491D69B7-B2AA-4BF4-BD7A-FFBD22DD34E9}.exe <— file
c:\windows\system32\
{2E2D7C41-7389-400F-A90F-7D7DA77BBC6D}.exe <— file
c:\windows\system32\
{232FDEFE-D691-45FF-AA09-3D3960C4C6BC}.exe <— file
c:\windows\system32\
{ED139376-9B16-437A-B96F-4CC95734A544}.exe <— file
c:\windows\system32\
{79B2CF10-367A-482D-A614-EEAF7FA7B8FD}.exe <— file
c:\windows\system32\
{2F1BC856-CAD6-4DCA-80A4-BF2FD98C9842}.exe <— file
c:\windows\system32\
{E5089D4D-9FC9-4D1C-83E2-FB714F9C06EC}.exe <— file
c:\windows\system32\
{92D9A391-4779-4186-82E3-1CAE8D1F671E}.exe <— file
c:\windows\system32\
{42CE9077-F98F-48B4-B4BE-12178C398CD2}.exe <— file
c:\windows\system32\
{CB57F93B-B52E-4F57-AD22-4440F0B38F4C}.exe <— file
c:\windows\system32\
{8A9382FB-B324-4AC8-893F-7405AAFD8ACE}.exe <— file
c:\windows\system32\
{62A7EE18-5EEA-45A5-849D-D2D6DB0D2790}.exe <— file
c:\windows\system32\
{C16530C7-434B-4130-96AB-0F2C6124A06C}.exe <— file
c:\windows\system32\
{F0C01E8B-BAD9-4975-B86E-A15468A42D3D}.exe <— file
c:\windows\system32\
{41692464-0827-4F7B-A37C-2E754A305C20}.exe <— file
c:\windows\system32\
{CD0E2EA0-EC72-4B5A-AB56-7EFC1238F8ED}.exe <— file
c:\windows\system32\
{E0DB607F-A909-4A6C-8071-BC276362ADAB}.exe <— file
c:\windows\system32\
{5FC5B782-A572-4EDC-91FD-127B3DCE3208}.exe <— file
c:\windows\system32\
{C13FA0DF-B6FA-41B3-9E1D-ADA1DB88508A}.exe <— file
c:\windows\system32\
{05A012F2-43EC-4425-BE19-F78405FD7AFA}.exe <— file
c:\windows\system32\
{32F3993C-3569-4AC9-A17F-4F4943C6E286}.exe <— file
c:\windows\system32\
{6C0BC39F-F6FB-4277-B6C8-2ECE66765DF6}.exe <— file
Some malware files may be "hidden".
Be sure to
show hidden files when looking for these file(s) and/or folder(s).
Reboot in normal mode and "copy/paste" a new HijackThis! log file
into this thread .
Logfile of HijackThis v1.99.1
Scan saved at 11:02:38 PM, on 2006/7/2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\hijackthis\HijackThis.exe
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\GENIUS~1\GNETMOUS.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [esprj.exe] C:\WINDOWS\system32\esprj.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2385B5C-C436-4ECC-A391-F5578F183835}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O17 - HKLM\System\CS1\Services\Tcpip\..\{0955DD0B-7FB8-4485-8683-FF9A2F50D920}: NameServer = 85.255.114.46,85.255.112.210
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.46 85.255.112.210
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
The aavzm.exe and dmjkv.exe i cant found it.
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Don't run it yet.
Download
ewido anti-spyware from
HERE and save that file to your
desktop.
This is a 30 day trial of the program Once you have downloaded ewido anti-spyware, locate the icon on the desktop Once the setup is complete you will need run ewido and update the definition On the main screen select the icon "Update " then select the "Next select the "Start Update " button, the update will start and a Once the update has completed select the "Scanner " icon at the top of Settings " tab. Once in the Settings screen click on "Recommended actions " and then Quarantine ". Under "Reports "Select "Automatically generate report after every scan " Un-Select "Only if threats were found " Close ewido anti-spyware.
Do Not run a scan yet .
Reboot in
"safe" mode .
Double-click
ATF-Cleaner.exe to run the program.
Under
Main choose:
Select All .
Click the
Empty Selected button.
Close the program.
Then please run Ewido, click on the
Scanner run a full scan and let it clean everything it finds.
Save the logfile from the scan.
Boot in normal mode.
Post:
1. A new HijackThis! log.
2. The report from Ewido
Into this thread .
Thx for your help,but i giving up already,Ewido also same as other's anti virus software,scan till some file will stop scan[Downloader.Agent.uj] <——–and this cant quarantine,delete also cant,i will take it to format,anyway,thx to you^^!
That's quite a "list"….
Now, a new HijackThis! log, please.