Sean007
Please not that reformat thing again!!!!!!!!!!!!!
Spyware / Malware / Virus Removal
HiJack This
17 min read
Micah_6:8
If you read the info at that link, its says that rootkit removal can make Windows so unstable, it's useless.
Think about this….
I'm assuming this is a rootkit.
When I can know for sure, I'll post again.
By then you may have decided which way you prefer to go.
Sean007
Thank you for all your help.
Micah_6:8
Great news!!!
We don't believe this is a "rootkit".
If you've rebooted since running since posting the last "fixwareout" log, run "fixwareout" again, then post the log, and a new HijackThis! log.
THEN DO NOT REBOOT!!!
We don't believe this is a "rootkit".
If you've rebooted since running since posting the last "fixwareout" log, run "fixwareout" again, then post the log, and a new HijackThis! log.
THEN DO NOT REBOOT!!!
Micah_6:8
Copy the text in the following quote box into Notepad:
Save it to your desktop as ff.bat
Now, the ff.bat file on the desktop. A Notepad window will open up.
Please paste it's contents into your next post, as well.
Do this AFTER running "fixwareout".
dir c:\WINDOWS\system32\{*.* /ah > files.txt
dir c:\WINDOWS\system32\{*.* >> files.txt
notepad files.txt
Save it to your desktop as ff.bat
Now, the ff.bat file on the desktop. A Notepad window will open up.
Please paste it's contents into your next post, as well.
Do this AFTER running "fixwareout".
Sean007
Fixwareout did not create a report althiugh it ran. Here are the others.
Logfile of HijackThis v1.99.1
Scan saved at 5:06:22 AM, on 7/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [sowyb.exe] C:\WINDOWS\system32\sowyb.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0
Directory of c:\WINDOWS\system32
Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0
Directory of c:\WINDOWS\system32
07/09/2006 07:52 AM 4,608 {0033E437-6D56-47BF-A1AF-CDA5CA070834}.exe
07/08/2006 05:06 AM 4,608 {020F9556-A324-4C9D-9729-D4770136B0CB}.exe
07/09/2006 05:20 AM 4,608 {07D432BB-EE2D-4A93-858B-F81753753F81}.exe
07/09/2006 05:45 AM 4,608 {085ED495-1656-4FD7-995D-DE71182E7926}.exe
07/08/2006 07:49 AM 4,608 {1236FA4D-34FB-40AB-B6E1-FC579FE02558}.exe
07/07/2006 07:38 AM 4,608 {15E9693C-AC2A-4B76-B9C0-33BC368504A3}.exe
07/08/2006 06:19 AM 4,608 {1BA07900-4850-44A9-8E67-7FD5C371026F}.exe
07/09/2006 03:10 PM 4,608 {1F9343CD-1EB3-4216-81DD-E4A12C9F7C29}.exe
07/07/2006 07:26 AM 4,608 {2068B8B3-98C1-4D3A-A004-5691F65D78CD}.exe
07/07/2006 07:20 AM 424,718 {231DD987-7E5B-40B7-9653-9F538A949D8C}.exe
07/07/2006 07:19 AM 155,648 {305D825A-6944-4B99-A261-947936995270}.dll
07/09/2006 06:46 AM 4,608 {342BAB4F-B131-435D-9BC3-2F69BB07F1DB}.exe
07/10/2006 05:08 AM 155,648 {3506D637-6929-4A99-B49E-3A2AD365E44D}.dll
07/09/2006 07:28 AM 4,608 {3507D4B1-2D98-4D71-A3DA-E0C1E95288BF}.exe
07/09/2006 03:28 PM 4,608 {396DB0BA-221F-4432-9058-A2556CC77817}.exe
07/08/2006 06:37 AM 4,608 {39AA45F6-7349-4EF2-9024-D97A8D407F83}.exe
07/08/2006 04:54 AM 4,608 {40ED4BB0-8A30-4232-AAA3-7A2BE9A3354D}.exe
07/09/2006 07:58 AM 4,608 {44836CD4-1F38-4B3D-B9E1-AB6A5CDFCD74}.exe
07/09/2006 07:46 AM 4,608 {4836CD88-D251-4843-B8EE-E66C703AD963}.exe
07/07/2006 07:32 AM 4,608 {515F1187-16D5-48D4-8BFC-B9E61E9E7733}.exe
07/08/2006 06:25 AM 4,608 {61D5C641-4256-4150-B4CF-CAA0690C6DC3}.exe
07/08/2006 05:42 AM 4,608 {635D4BB7-7B44-4240-9311-7C4A736987DB}.exe
07/08/2006 08:07 AM 4,608 {6BF5373A-3BA6-4965-B2F2-CB945572DFDF}.exe
07/08/2006 05:24 AM 4,608 {6E8854F7-BD77-4A26-BB30-7190E7FA0ACE}.exe
07/09/2006 07:40 AM 4,608 {8755DE91-A5F4-4BA4-B0BD-94DBA9BE6422}.exe
07/09/2006 02:58 PM 4,608 {901AD617-4DA0-479C-99DE-00998A3C2368}.exe
07/08/2006 07:37 AM 4,608 {9345CD80-AB68-4486-8F9B-DFCD6E3F744F}.exe
07/08/2006 06:31 AM 4,608 {93E6EC3F-1BEF-4745-BE02-FCD3AB935444}.exe
07/08/2006 05:30 AM 4,608 {94452A2E-A7DC-407F-A952-0961953FFE1D}.exe
07/08/2006 06:01 AM 4,608 {AB34B74C-1C0E-4B49-BACA-A6A1D7CF1D3F}.exe
07/09/2006 10:16 AM 4,608 {AC0DD5D1-9923-4AD3-878A-FE935930E420}.exe
07/08/2006 05:00 AM 4,608 {AC5A2EFC-8F2F-4244-8128-536AC1C222F0}.exe
07/08/2006 05:18 AM 4,608 {B63398E1-2032-45CE-AE67-AB1E2F563645}.exe
07/08/2006 05:55 AM 4,608 {B795B7EC-2658-470B-ABF7-A750970E39F0}.exe
07/08/2006 07:19 AM 4,608 {B807C9FF-9F9F-4C18-9AE8-987FFC7AB2EA}.exe
07/08/2006 08:01 AM 4,608 {BB2C845E-27B8-46B0-82D2-57F1426D386F}.exe
07/07/2006 07:19 AM 3,117 {BDCEACA3-4B9A-4620-AF93-08FB9A855882}.exe
07/09/2006 02:52 PM 4,608 {C134EB89-1F1E-4D9F-82CF-9022FBEBAE39}.exe
07/09/2006 03:04 PM 4,608 {C2E496D1-CAAF-48C3-A37D-E3FA3BAFA66B}.exe
07/07/2006 07:19 AM 4,608 {C6BA7FB9-9485-4E56-8161-2E3B685174A4}.exe
07/09/2006 08:04 AM 4,608 {C93A2408-15D5-4FC7-A6A2-E25ACE9CE402}.exe
07/09/2006 05:08 AM 4,608 {CD8168E7-E561-4CAD-BC24-6D8250493AE4}.exe
07/08/2006 07:31 AM 4,608 {D1AABA36-3086-4B93-A4CA-1B9ED6B286F2}.exe
07/07/2006 07:19 AM 45,568 {E2BEABE7-FA9A-4D1E-900B-CB3F0FF1D98F}.exe
07/07/2006 07:20 AM 5,214 {E4279BFA-1229-48DD-B84E-135D1C178A79}.exe
07/09/2006 05:14 AM 4,608 {E7598B7A-C24B-4CE1-AE6F-FA631C85B8E2}.exe
07/08/2006 07:43 AM 4,608 {E8FD65CA-0F57-4C64-BC5C-3D7A5B25D65C}.exe
07/08/2006 05:12 AM 4,608 {E9A7C61D-566A-4BAC-A4DB-77BDDEFD07F2}.exe
07/08/2006 05:36 AM 4,608 {EB255ED4-469F-4295-B3BF-5221AFC02DB5}.exe
07/09/2006 03:34 PM 4,608 {EC3441A4-A5F9-4554-B4B9-70FF21A6918F}.exe
07/09/2006 07:34 AM 4,608 {ED6D0468-A052-4281-B067-49D19643AAE3}.exe
07/08/2006 08:13 AM 4,608 {ED9B4695-9EDB-4F0D-822F-91128C60D3BD}.exe
07/08/2006 06:07 AM 4,608 {F48FA274-667E-40F6-BF11-42EDDC582726}.exe
07/08/2006 07:07 AM 4,608 {F4E4C85C-498A-4A1F-90D7-C93794537FB3}.exe
07/09/2006 03:16 PM 4,608 {F8B8F4F9-D2F4-4522-9737-287F10CDF109}.exe
07/08/2006 05:48 AM 4,608 {FB55BF09-0EBE-4755-9925-81F8194A97A1}.exe
07/08/2006 07:13 AM 4,608 {FC7BCF4F-1C70-4ACF-B219-ABA3F5C00B7C}.exe
07/08/2006 07:25 AM 4,608 {FD2D210F-8E7C-418B-93E6-287C336F78F0}.exe
07/08/2006 06:13 AM 4,608 {FD944622-BEA1-488F-B009-50EA1ABE2B41}.exe
59 File(s) 1,034,137 bytes
0 Dir(s) 47,370,297,344 bytes free
Logfile of HijackThis v1.99.1
Scan saved at 5:06:22 AM, on 7/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [sowyb.exe] C:\WINDOWS\system32\sowyb.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0
Directory of c:\WINDOWS\system32
Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0
Directory of c:\WINDOWS\system32
07/09/2006 07:52 AM 4,608 {0033E437-6D56-47BF-A1AF-CDA5CA070834}.exe
07/08/2006 05:06 AM 4,608 {020F9556-A324-4C9D-9729-D4770136B0CB}.exe
07/09/2006 05:20 AM 4,608 {07D432BB-EE2D-4A93-858B-F81753753F81}.exe
07/09/2006 05:45 AM 4,608 {085ED495-1656-4FD7-995D-DE71182E7926}.exe
07/08/2006 07:49 AM 4,608 {1236FA4D-34FB-40AB-B6E1-FC579FE02558}.exe
07/07/2006 07:38 AM 4,608 {15E9693C-AC2A-4B76-B9C0-33BC368504A3}.exe
07/08/2006 06:19 AM 4,608 {1BA07900-4850-44A9-8E67-7FD5C371026F}.exe
07/09/2006 03:10 PM 4,608 {1F9343CD-1EB3-4216-81DD-E4A12C9F7C29}.exe
07/07/2006 07:26 AM 4,608 {2068B8B3-98C1-4D3A-A004-5691F65D78CD}.exe
07/07/2006 07:20 AM 424,718 {231DD987-7E5B-40B7-9653-9F538A949D8C}.exe
07/07/2006 07:19 AM 155,648 {305D825A-6944-4B99-A261-947936995270}.dll
07/09/2006 06:46 AM 4,608 {342BAB4F-B131-435D-9BC3-2F69BB07F1DB}.exe
07/10/2006 05:08 AM 155,648 {3506D637-6929-4A99-B49E-3A2AD365E44D}.dll
07/09/2006 07:28 AM 4,608 {3507D4B1-2D98-4D71-A3DA-E0C1E95288BF}.exe
07/09/2006 03:28 PM 4,608 {396DB0BA-221F-4432-9058-A2556CC77817}.exe
07/08/2006 06:37 AM 4,608 {39AA45F6-7349-4EF2-9024-D97A8D407F83}.exe
07/08/2006 04:54 AM 4,608 {40ED4BB0-8A30-4232-AAA3-7A2BE9A3354D}.exe
07/09/2006 07:58 AM 4,608 {44836CD4-1F38-4B3D-B9E1-AB6A5CDFCD74}.exe
07/09/2006 07:46 AM 4,608 {4836CD88-D251-4843-B8EE-E66C703AD963}.exe
07/07/2006 07:32 AM 4,608 {515F1187-16D5-48D4-8BFC-B9E61E9E7733}.exe
07/08/2006 06:25 AM 4,608 {61D5C641-4256-4150-B4CF-CAA0690C6DC3}.exe
07/08/2006 05:42 AM 4,608 {635D4BB7-7B44-4240-9311-7C4A736987DB}.exe
07/08/2006 08:07 AM 4,608 {6BF5373A-3BA6-4965-B2F2-CB945572DFDF}.exe
07/08/2006 05:24 AM 4,608 {6E8854F7-BD77-4A26-BB30-7190E7FA0ACE}.exe
07/09/2006 07:40 AM 4,608 {8755DE91-A5F4-4BA4-B0BD-94DBA9BE6422}.exe
07/09/2006 02:58 PM 4,608 {901AD617-4DA0-479C-99DE-00998A3C2368}.exe
07/08/2006 07:37 AM 4,608 {9345CD80-AB68-4486-8F9B-DFCD6E3F744F}.exe
07/08/2006 06:31 AM 4,608 {93E6EC3F-1BEF-4745-BE02-FCD3AB935444}.exe
07/08/2006 05:30 AM 4,608 {94452A2E-A7DC-407F-A952-0961953FFE1D}.exe
07/08/2006 06:01 AM 4,608 {AB34B74C-1C0E-4B49-BACA-A6A1D7CF1D3F}.exe
07/09/2006 10:16 AM 4,608 {AC0DD5D1-9923-4AD3-878A-FE935930E420}.exe
07/08/2006 05:00 AM 4,608 {AC5A2EFC-8F2F-4244-8128-536AC1C222F0}.exe
07/08/2006 05:18 AM 4,608 {B63398E1-2032-45CE-AE67-AB1E2F563645}.exe
07/08/2006 05:55 AM 4,608 {B795B7EC-2658-470B-ABF7-A750970E39F0}.exe
07/08/2006 07:19 AM 4,608 {B807C9FF-9F9F-4C18-9AE8-987FFC7AB2EA}.exe
07/08/2006 08:01 AM 4,608 {BB2C845E-27B8-46B0-82D2-57F1426D386F}.exe
07/07/2006 07:19 AM 3,117 {BDCEACA3-4B9A-4620-AF93-08FB9A855882}.exe
07/09/2006 02:52 PM 4,608 {C134EB89-1F1E-4D9F-82CF-9022FBEBAE39}.exe
07/09/2006 03:04 PM 4,608 {C2E496D1-CAAF-48C3-A37D-E3FA3BAFA66B}.exe
07/07/2006 07:19 AM 4,608 {C6BA7FB9-9485-4E56-8161-2E3B685174A4}.exe
07/09/2006 08:04 AM 4,608 {C93A2408-15D5-4FC7-A6A2-E25ACE9CE402}.exe
07/09/2006 05:08 AM 4,608 {CD8168E7-E561-4CAD-BC24-6D8250493AE4}.exe
07/08/2006 07:31 AM 4,608 {D1AABA36-3086-4B93-A4CA-1B9ED6B286F2}.exe
07/07/2006 07:19 AM 45,568 {E2BEABE7-FA9A-4D1E-900B-CB3F0FF1D98F}.exe
07/07/2006 07:20 AM 5,214 {E4279BFA-1229-48DD-B84E-135D1C178A79}.exe
07/09/2006 05:14 AM 4,608 {E7598B7A-C24B-4CE1-AE6F-FA631C85B8E2}.exe
07/08/2006 07:43 AM 4,608 {E8FD65CA-0F57-4C64-BC5C-3D7A5B25D65C}.exe
07/08/2006 05:12 AM 4,608 {E9A7C61D-566A-4BAC-A4DB-77BDDEFD07F2}.exe
07/08/2006 05:36 AM 4,608 {EB255ED4-469F-4295-B3BF-5221AFC02DB5}.exe
07/09/2006 03:34 PM 4,608 {EC3441A4-A5F9-4554-B4B9-70FF21A6918F}.exe
07/09/2006 07:34 AM 4,608 {ED6D0468-A052-4281-B067-49D19643AAE3}.exe
07/08/2006 08:13 AM 4,608 {ED9B4695-9EDB-4F0D-822F-91128C60D3BD}.exe
07/08/2006 06:07 AM 4,608 {F48FA274-667E-40F6-BF11-42EDDC582726}.exe
07/08/2006 07:07 AM 4,608 {F4E4C85C-498A-4A1F-90D7-C93794537FB3}.exe
07/09/2006 03:16 PM 4,608 {F8B8F4F9-D2F4-4522-9737-287F10CDF109}.exe
07/08/2006 05:48 AM 4,608 {FB55BF09-0EBE-4755-9925-81F8194A97A1}.exe
07/08/2006 07:13 AM 4,608 {FC7BCF4F-1C70-4ACF-B219-ABA3F5C00B7C}.exe
07/08/2006 07:25 AM 4,608 {FD2D210F-8E7C-418B-93E6-287C336F78F0}.exe
07/08/2006 06:13 AM 4,608 {FD944622-BEA1-488F-B009-50EA1ABE2B41}.exe
59 File(s) 1,034,137 bytes
0 Dir(s) 47,370,297,344 bytes free
Micah_6:8
To eradicate this you'll need to "kill" explorer and iexplore. When explorer is killed, your desktop, start and taskbar will disappear, this is normal. So you will have to perform everything via the taskmanager.
I recommend you save these instructions in Notepad, because you are not allowed to open your browser!!
Leave the notepad file (with these instructions in it) open!!!
Run Hijackthis and leave it open!!!
Open your taskmanager by holding CTRL-ALT-DEL together
Select the "Processes" tab.
Click on "Image name" to sort them alphabetically.
Search for explorer.exe in the list, on it and choose "End process". Your desktop will disappear. This is normal. It will come back when you reboot.
Search for iexplore.exe in the list, on it and choose "End process".
Then, leave your taskmanager open!!
In HijackThis!, click scan and "fix" these entries:
O4 - HKLM\..\Run: [sowyb.exe] C:\WINDOWS\system32\sowyb.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
Close HijackThis!
In your taskmanager again, click the "Applications" tab.
Click 'New task'.
Click 'browse'
Below in the window, select: 'all files' next to 'files of type'
Now browse to then files listed below and delete them (rightclick them and select 'delete') - (remember, you still have no desktop!!):
C:\WINDOWS\system32\cswjo.exe
C:\WINDOWS\system32\dmxxy.exe
C:\WINDOWS\system32\sowyb.exe
C:\WINDOWS\system32\{0033E437-6D56-47BF-A1AF-CDA5CA070834}.exe
C:\WINDOWS\system32\{020F9556-A324-4C9D-9729-D4770136B0CB}.exe
C:\WINDOWS\system32\{07D432BB-EE2D-4A93-858B-F81753753F81}.exe
C:\WINDOWS\system32\{085ED495-1656-4FD7-995D-DE71182E7926}.exe
C:\WINDOWS\system32\{1236FA4D-34FB-40AB-B6E1-FC579FE02558}.exe
C:\WINDOWS\system32\{15E9693C-AC2A-4B76-B9C0-33BC368504A3}.exe
C:\WINDOWS\system32\{1BA07900-4850-44A9-8E67-7FD5C371026F}.exe
C:\WINDOWS\system32\{1F9343CD-1EB3-4216-81DD-E4A12C9F7C29}.exe
C:\WINDOWS\system32\{2068B8B3-98C1-4D3A-A004-5691F65D78CD}.exe
C:\WINDOWS\system32\{231DD987-7E5B-40B7-9653-9F538A949D8C}.exe
C:\WINDOWS\system32\{305D825A-6944-4B99-A261-947936995270}.dll
C:\WINDOWS\system32\{342BAB4F-B131-435D-9BC3-2F69BB07F1DB}.exe
C:\WINDOWS\system32\{3506D637-6929-4A99-B49E-3A2AD365E44D}.dll
C:\WINDOWS\system32\{3507D4B1-2D98-4D71-A3DA-E0C1E95288BF}.exe
C:\WINDOWS\system32\{396DB0BA-221F-4432-9058-A2556CC77817}.exe
C:\WINDOWS\system32\{39AA45F6-7349-4EF2-9024-D97A8D407F83}.exe
C:\WINDOWS\system32\{40ED4BB0-8A30-4232-AAA3-7A2BE9A3354D}.exe
C:\WINDOWS\system32\{44836CD4-1F38-4B3D-B9E1-AB6A5CDFCD74}.exe
C:\WINDOWS\system32\{4836CD88-D251-4843-B8EE-E66C703AD963}.exe
C:\WINDOWS\system32\{515F1187-16D5-48D4-8BFC-B9E61E9E7733}.exe
C:\WINDOWS\system32\{61D5C641-4256-4150-B4CF-CAA0690C6DC3}.exe
C:\WINDOWS\system32\{635D4BB7-7B44-4240-9311-7C4A736987DB}.exe
C:\WINDOWS\system32\{6BF5373A-3BA6-4965-B2F2-CB945572DFDF}.exe
C:\WINDOWS\system32\{6E8854F7-BD77-4A26-BB30-7190E7FA0ACE}.exe
C:\WINDOWS\system32\{8755DE91-A5F4-4BA4-B0BD-94DBA9BE6422}.exe
C:\WINDOWS\system32\{901AD617-4DA0-479C-99DE-00998A3C2368}.exe
C:\WINDOWS\system32\{9345CD80-AB68-4486-8F9B-DFCD6E3F744F}.exe
C:\WINDOWS\system32\{93E6EC3F-1BEF-4745-BE02-FCD3AB935444}.exe
C:\WINDOWS\system32\{94452A2E-A7DC-407F-A952-0961953FFE1D}.exe
C:\WINDOWS\system32\{AB34B74C-1C0E-4B49-BACA-A6A1D7CF1D3F}.exe
C:\WINDOWS\system32\{AC0DD5D1-9923-4AD3-878A-FE935930E420}.exe
C:\WINDOWS\system32\{AC5A2EFC-8F2F-4244-8128-536AC1C222F0}.exe
C:\WINDOWS\system32\{B63398E1-2032-45CE-AE67-AB1E2F563645}.exe
C:\WINDOWS\system32\{B795B7EC-2658-470B-ABF7-A750970E39F0}.exe
C:\WINDOWS\system32\{B807C9FF-9F9F-4C18-9AE8-987FFC7AB2EA}.exe
C:\WINDOWS\system32\{BB2C845E-27B8-46B0-82D2-57F1426D386F}.exe
C:\WINDOWS\system32\{BDCEACA3-4B9A-4620-AF93-08FB9A855882}.exe
C:\WINDOWS\system32\{C134EB89-1F1E-4D9F-82CF-9022FBEBAE39}.exe
C:\WINDOWS\system32\{C2E496D1-CAAF-48C3-A37D-E3FA3BAFA66B}.exe
C:\WINDOWS\system32\{C6BA7FB9-9485-4E56-8161-2E3B685174A4}.exe
C:\WINDOWS\system32\{C93A2408-15D5-4FC7-A6A2-E25ACE9CE402}.exe
C:\WINDOWS\system32\{CD8168E7-E561-4CAD-BC24-6D8250493AE4}.exe
C:\WINDOWS\system32\{D1AABA36-3086-4B93-A4CA-1B9ED6B286F2}.exe
C:\WINDOWS\system32\{E2BEABE7-FA9A-4D1E-900B-CB3F0FF1D98F}.exe
C:\WINDOWS\system32\{E4279BFA-1229-48DD-B84E-135D1C178A79}.exe
C:\WINDOWS\system32\{E7598B7A-C24B-4CE1-AE6F-FA631C85B8E2}.exe
C:\WINDOWS\system32\{E8FD65CA-0F57-4C64-BC5C-3D7A5B25D65C}.exe
C:\WINDOWS\system32\{E9A7C61D-566A-4BAC-A4DB-77BDDEFD07F2}.exe
C:\WINDOWS\system32\{EB255ED4-469F-4295-B3BF-5221AFC02DB5}.exe
C:\WINDOWS\system32\{EC3441A4-A5F9-4554-B4B9-70FF21A6918F}.exe
C:\WINDOWS\system32\{ED6D0468-A052-4281-B067-49D19643AAE3}.exe
C:\WINDOWS\system32\{ED9B4695-9EDB-4F0D-822F-91128C60D3BD}.exe
C:\WINDOWS\system32\{F48FA274-667E-40F6-BF11-42EDDC582726}.exe
C:\WINDOWS\system32\{F4E4C85C-498A-4A1F-90D7-C93794537FB3}.exe
C:\WINDOWS\system32\{F8B8F4F9-D2F4-4522-9737-287F10CDF109}.exe
C:\WINDOWS\system32\{FB55BF09-0EBE-4755-9925-81F8194A97A1}.exe
C:\WINDOWS\system32\{FC7BCF4F-1C70-4ACF-B219-ABA3F5C00B7C}.exe
C:\WINDOWS\system32\{FD2D210F-8E7C-418B-93E6-287C336F78F0}.exe
C:\WINDOWS\system32\{FD944622-BEA1-488F-B009-50EA1ABE2B41}.exe
Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat
This starts the fixwareoutfix again and will ask to reboot.
After reboot, post a new HijackThis! log together with the fixwareout log.
I recommend you save these instructions in Notepad, because you are not allowed to open your browser!!
Leave the notepad file (with these instructions in it) open!!!
Run Hijackthis and leave it open!!!
Open your taskmanager by holding CTRL-ALT-DEL together
Select the "Processes" tab.
Click on "Image name" to sort them alphabetically.
Search for explorer.exe in the list, on it and choose "End process". Your desktop will disappear. This is normal. It will come back when you reboot.
Search for iexplore.exe in the list, on it and choose "End process".
Then, leave your taskmanager open!!
In HijackThis!, click scan and "fix" these entries:
O4 - HKLM\..\Run: [sowyb.exe] C:\WINDOWS\system32\sowyb.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
Close HijackThis!
In your taskmanager again, click the "Applications" tab.
Click 'New task'.
Click 'browse'
Below in the window, select: 'all files' next to 'files of type'
Now browse to then files listed below and delete them (rightclick them and select 'delete') - (remember, you still have no desktop!!):
C:\WINDOWS\system32\cswjo.exe
C:\WINDOWS\system32\dmxxy.exe
C:\WINDOWS\system32\sowyb.exe
C:\WINDOWS\system32\{0033E437-6D56-47BF-A1AF-CDA5CA070834}.exe
C:\WINDOWS\system32\{020F9556-A324-4C9D-9729-D4770136B0CB}.exe
C:\WINDOWS\system32\{07D432BB-EE2D-4A93-858B-F81753753F81}.exe
C:\WINDOWS\system32\{085ED495-1656-4FD7-995D-DE71182E7926}.exe
C:\WINDOWS\system32\{1236FA4D-34FB-40AB-B6E1-FC579FE02558}.exe
C:\WINDOWS\system32\{15E9693C-AC2A-4B76-B9C0-33BC368504A3}.exe
C:\WINDOWS\system32\{1BA07900-4850-44A9-8E67-7FD5C371026F}.exe
C:\WINDOWS\system32\{1F9343CD-1EB3-4216-81DD-E4A12C9F7C29}.exe
C:\WINDOWS\system32\{2068B8B3-98C1-4D3A-A004-5691F65D78CD}.exe
C:\WINDOWS\system32\{231DD987-7E5B-40B7-9653-9F538A949D8C}.exe
C:\WINDOWS\system32\{305D825A-6944-4B99-A261-947936995270}.dll
C:\WINDOWS\system32\{342BAB4F-B131-435D-9BC3-2F69BB07F1DB}.exe
C:\WINDOWS\system32\{3506D637-6929-4A99-B49E-3A2AD365E44D}.dll
C:\WINDOWS\system32\{3507D4B1-2D98-4D71-A3DA-E0C1E95288BF}.exe
C:\WINDOWS\system32\{396DB0BA-221F-4432-9058-A2556CC77817}.exe
C:\WINDOWS\system32\{39AA45F6-7349-4EF2-9024-D97A8D407F83}.exe
C:\WINDOWS\system32\{40ED4BB0-8A30-4232-AAA3-7A2BE9A3354D}.exe
C:\WINDOWS\system32\{44836CD4-1F38-4B3D-B9E1-AB6A5CDFCD74}.exe
C:\WINDOWS\system32\{4836CD88-D251-4843-B8EE-E66C703AD963}.exe
C:\WINDOWS\system32\{515F1187-16D5-48D4-8BFC-B9E61E9E7733}.exe
C:\WINDOWS\system32\{61D5C641-4256-4150-B4CF-CAA0690C6DC3}.exe
C:\WINDOWS\system32\{635D4BB7-7B44-4240-9311-7C4A736987DB}.exe
C:\WINDOWS\system32\{6BF5373A-3BA6-4965-B2F2-CB945572DFDF}.exe
C:\WINDOWS\system32\{6E8854F7-BD77-4A26-BB30-7190E7FA0ACE}.exe
C:\WINDOWS\system32\{8755DE91-A5F4-4BA4-B0BD-94DBA9BE6422}.exe
C:\WINDOWS\system32\{901AD617-4DA0-479C-99DE-00998A3C2368}.exe
C:\WINDOWS\system32\{9345CD80-AB68-4486-8F9B-DFCD6E3F744F}.exe
C:\WINDOWS\system32\{93E6EC3F-1BEF-4745-BE02-FCD3AB935444}.exe
C:\WINDOWS\system32\{94452A2E-A7DC-407F-A952-0961953FFE1D}.exe
C:\WINDOWS\system32\{AB34B74C-1C0E-4B49-BACA-A6A1D7CF1D3F}.exe
C:\WINDOWS\system32\{AC0DD5D1-9923-4AD3-878A-FE935930E420}.exe
C:\WINDOWS\system32\{AC5A2EFC-8F2F-4244-8128-536AC1C222F0}.exe
C:\WINDOWS\system32\{B63398E1-2032-45CE-AE67-AB1E2F563645}.exe
C:\WINDOWS\system32\{B795B7EC-2658-470B-ABF7-A750970E39F0}.exe
C:\WINDOWS\system32\{B807C9FF-9F9F-4C18-9AE8-987FFC7AB2EA}.exe
C:\WINDOWS\system32\{BB2C845E-27B8-46B0-82D2-57F1426D386F}.exe
C:\WINDOWS\system32\{BDCEACA3-4B9A-4620-AF93-08FB9A855882}.exe
C:\WINDOWS\system32\{C134EB89-1F1E-4D9F-82CF-9022FBEBAE39}.exe
C:\WINDOWS\system32\{C2E496D1-CAAF-48C3-A37D-E3FA3BAFA66B}.exe
C:\WINDOWS\system32\{C6BA7FB9-9485-4E56-8161-2E3B685174A4}.exe
C:\WINDOWS\system32\{C93A2408-15D5-4FC7-A6A2-E25ACE9CE402}.exe
C:\WINDOWS\system32\{CD8168E7-E561-4CAD-BC24-6D8250493AE4}.exe
C:\WINDOWS\system32\{D1AABA36-3086-4B93-A4CA-1B9ED6B286F2}.exe
C:\WINDOWS\system32\{E2BEABE7-FA9A-4D1E-900B-CB3F0FF1D98F}.exe
C:\WINDOWS\system32\{E4279BFA-1229-48DD-B84E-135D1C178A79}.exe
C:\WINDOWS\system32\{E7598B7A-C24B-4CE1-AE6F-FA631C85B8E2}.exe
C:\WINDOWS\system32\{E8FD65CA-0F57-4C64-BC5C-3D7A5B25D65C}.exe
C:\WINDOWS\system32\{E9A7C61D-566A-4BAC-A4DB-77BDDEFD07F2}.exe
C:\WINDOWS\system32\{EB255ED4-469F-4295-B3BF-5221AFC02DB5}.exe
C:\WINDOWS\system32\{EC3441A4-A5F9-4554-B4B9-70FF21A6918F}.exe
C:\WINDOWS\system32\{ED6D0468-A052-4281-B067-49D19643AAE3}.exe
C:\WINDOWS\system32\{ED9B4695-9EDB-4F0D-822F-91128C60D3BD}.exe
C:\WINDOWS\system32\{F48FA274-667E-40F6-BF11-42EDDC582726}.exe
C:\WINDOWS\system32\{F4E4C85C-498A-4A1F-90D7-C93794537FB3}.exe
C:\WINDOWS\system32\{F8B8F4F9-D2F4-4522-9737-287F10CDF109}.exe
C:\WINDOWS\system32\{FB55BF09-0EBE-4755-9925-81F8194A97A1}.exe
C:\WINDOWS\system32\{FC7BCF4F-1C70-4ACF-B219-ABA3F5C00B7C}.exe
C:\WINDOWS\system32\{FD2D210F-8E7C-418B-93E6-287C336F78F0}.exe
C:\WINDOWS\system32\{FD944622-BEA1-488F-B009-50EA1ABE2B41}.exe
Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat
This starts the fixwareoutfix again and will ask to reboot.
After reboot, post a new HijackThis! log together with the fixwareout log.
Sean007
Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FDA313B36C7A-CD5A-51C4-D22C-5335EEC4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}58B791A4E5C8-3C2A-C704-AFED-2F9E24E7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5B0C59FEEA93-9398-AA84-5E28-FF11377E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7B77AB3B82A8-B578-50B4-EB8F-89F5A750{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A6B8224E30F9-54BB-EBC4-CAA2-5B2D3917{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3F0B66D2E46B-D598-7ED4-AA3F-7B24967A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}391164746D8B-3479-AB14-96C9-3E82419F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C953B71E5401-5829-A6C4-EECF-937194AF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04A43FEDE4BC-EC8A-8E74-734A-358747A6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BCE8025002AF-74CA-39A4-5A68-DBC5C338{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}988918122B4A-F48A-BB04-A779-1FBA1C81{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D0E38A23B944-49CA-B1E4-2AD9-9EB96B94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A9E7FBC2D651-5AE9-03A4-82D0-53D61FDB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\bmtmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}74F22350E2C4-4D5A-22F4-6E0B-1C911DF9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}08FBFF932846-D77A-C5C4-CE6F-DDE83171{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2AABEFBF959B-0028-BAE4-18A7-C6ECF3B4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0A2624569F0-D5C8-F204-7882-48F11D7C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2B65F9D77443-B618-0E54-3F1D-39C1B406{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…
Microsoft ® Windows Script Host Version 5.6
Microsoft ® Windows Script Host Version 5.6
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmtmb.exe"=-
…
PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate
»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSQKW.EXE
* csr.exe C:\WINDOWS\System32\CSVKI.EXE
»»»»» Misc files
»»»»» Checking for older varients covered by the Rem3 tool
»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSQKW.EXE 51,297 2006-07-07
C:\WINDOWS\SYSTEM32\CSVKI.EXE 51,297 2006-07-10
C:\WINDOWS\SYSTEM32\DMJBA.EXE 44,071 2004-08-04
C:\WINDOWS\SYSTEM32\DMTMB.EXE 44,071 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{604B1C93-D1F3-45E0-816B-34477D9F56B2}.exe
{C7D11F84-2887-402F-8C5D-0F9654262A0B}.exe
{4B3FCE6C-7A81-4EAB-8200-B959FBFEBAA2}.exe
{17138EDD-F6EC-4C5C-A77D-648239FFBF80}.exe
{9FD119C1-B0E6-4F22-A5D4-4C2E05322F47}.exe
{6A747853-A437-47E8-A8CE-CB4EDEF34A40}.exe
{FA491739-FCEE-4C6A-9285-1045E17B359C}.exe
{F91428E3-9C69-41BA-9743-B8D647461193}.exe
{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
{E77311FF-82E5-48AA-8939-39AEEF95C0B5}.exe
{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
Logfile of HijackThis v1.99.1
Scan saved at 7:42:10 AM, on 7/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [yivgv.exe] C:\WINDOWS\system32\yivgv.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Last edited 07/1/2006
Post this report in the forums please
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FDA313B36C7A-CD5A-51C4-D22C-5335EEC4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}58B791A4E5C8-3C2A-C704-AFED-2F9E24E7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5B0C59FEEA93-9398-AA84-5E28-FF11377E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7B77AB3B82A8-B578-50B4-EB8F-89F5A750{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A6B8224E30F9-54BB-EBC4-CAA2-5B2D3917{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3F0B66D2E46B-D598-7ED4-AA3F-7B24967A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}391164746D8B-3479-AB14-96C9-3E82419F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C953B71E5401-5829-A6C4-EECF-937194AF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04A43FEDE4BC-EC8A-8E74-734A-358747A6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BCE8025002AF-74CA-39A4-5A68-DBC5C338{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}988918122B4A-F48A-BB04-A779-1FBA1C81{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D0E38A23B944-49CA-B1E4-2AD9-9EB96B94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A9E7FBC2D651-5AE9-03A4-82D0-53D61FDB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\bmtmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}74F22350E2C4-4D5A-22F4-6E0B-1C911DF9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}08FBFF932846-D77A-C5C4-CE6F-DDE83171{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2AABEFBF959B-0028-BAE4-18A7-C6ECF3B4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0A2624569F0-D5C8-F204-7882-48F11D7C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2B65F9D77443-B618-0E54-3F1D-39C1B406{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…
Microsoft ® Windows Script Host Version 5.6
Microsoft ® Windows Script Host Version 5.6
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmtmb.exe"=-
…
PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate
»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSQKW.EXE
* csr.exe C:\WINDOWS\System32\CSVKI.EXE
»»»»» Misc files
»»»»» Checking for older varients covered by the Rem3 tool
»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSQKW.EXE 51,297 2006-07-07
C:\WINDOWS\SYSTEM32\CSVKI.EXE 51,297 2006-07-10
C:\WINDOWS\SYSTEM32\DMJBA.EXE 44,071 2004-08-04
C:\WINDOWS\SYSTEM32\DMTMB.EXE 44,071 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{604B1C93-D1F3-45E0-816B-34477D9F56B2}.exe
{C7D11F84-2887-402F-8C5D-0F9654262A0B}.exe
{4B3FCE6C-7A81-4EAB-8200-B959FBFEBAA2}.exe
{17138EDD-F6EC-4C5C-A77D-648239FFBF80}.exe
{9FD119C1-B0E6-4F22-A5D4-4C2E05322F47}.exe
{6A747853-A437-47E8-A8CE-CB4EDEF34A40}.exe
{FA491739-FCEE-4C6A-9285-1045E17B359C}.exe
{F91428E3-9C69-41BA-9743-B8D647461193}.exe
{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
{E77311FF-82E5-48AA-8939-39AEEF95C0B5}.exe
{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
Logfile of HijackThis v1.99.1
Scan saved at 7:42:10 AM, on 7/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [yivgv.exe] C:\WINDOWS\system32\yivgv.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Micah_6:8
We're going to need another "stab" at it.
Run the ff.bat file again, and post the results.
Run the ff.bat file again, and post the results.
Micah_6:8
Oh… and DON'T REBOOT!!!
Sean007
I'm not sure about the ffbat. If I run fixwareout it ask to reboot, but you said don't.
Micah_6:8
Just don't reboot after the reboot caused by running fixwareout.
Sean007
Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0
Directory of c:\WINDOWS\system32
Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0
Directory of c:\WINDOWS\system32
07/10/2006 07:36 AM 5,214 {027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
07/10/2006 05:08 AM 45,568 {057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
07/10/2006 07:36 AM 45,568 {0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
07/12/2006 05:40 AM 4,608 {1FF9C484-DA39-4B12-81DC-25C180C68B98}.exe
07/12/2006 05:46 AM 4,608 {59DC70AD-00E1-44A2-AE64-C9CD2432ED5E}.exe
07/10/2006 07:36 AM 155,648 {69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
07/12/2006 05:58 AM 4,608 {6FE3D6A3-F21E-4315-AEC4-BA6930BC6C22}.exe
07/10/2006 05:08 AM 5,214 {7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
07/10/2006 05:08 AM 3,117 {7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
07/10/2006 05:08 AM 424,718 {A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
07/10/2006 07:36 AM 424,718 {ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
07/10/2006 07:36 AM 3,117 {AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
07/12/2006 05:52 AM 4,608 {BFAB0CA5-29F2-48CC-A536-257FD4A1254C}.exe
07/12/2006 05:28 AM 4,608 {C3FBC837-DECC-442E-BABE-71A8FA088F40}.exe
07/12/2006 06:04 AM 4,608 {C5B472FC-3711-435E-A9F4-3595E73FE624}.exe
07/12/2006 05:34 AM 4,608 {F5E273F5-E72B-4E6D-8062-6506F7A189CF}.exe
16 File(s) 1,145,138 bytes
0 Dir(s) 47,461,724,160 bytes free
Micah_6:8
Now please post the contents of:
C:\fixwareout\report.txt
into your next post.
C:\fixwareout\report.txt
into your next post.
Micah_6:8
And a fresh HijackThis!, log, please.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI