IE6.0 hijacked

I am currently looking over your log. As I am an Undergraduate, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix. Thanks for your patience!

Thanks…….any help is greatly appreciated!

Goto this folder C:\Documents and Settings\Administrator\Desktop\Downloads\HiJackThis\hijackthis and rename HijackThis.exe file to scanner.exe


1. Download this file -
combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your
next reply together with new hjt log.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause
it to stall

This is what ComboFix came up with: Administrator - Thu 10/19/2006 12:04:01.20 Service Pack 4 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Administrator\Desktop\Downloads\HiJackThis" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINNT\system32\ismini.exe C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe C:\WINNT\system32\components C:\Program Files\Common Files\{3F3FD9C0-0544-1033-0326-030001} C:\Program Files\Common Files\{5F3FD9C0-0544-1033-0326-030001} ((((((((((((((((((((((((((((((( Files Created from 2006-09-19 to 2006-10-19 )))))))))))))))))))))))))))))))))) 2006-10-19 06:09 523,310 —hs—- C:\WINNT\system32\svuvw.bak2 2006-10-18 12:29 4,928 –a—— C:\WINNT\system32\drivers\avg7rsw.sys 2006-10-18 12:29 348,704 –a—— C:\WINNT\system32\drivers\avg7core.sys 2006-10-18 12:29 17,952 –a—— C:\WINNT\system32\drivers\avg7rsnt.sys 2006-10-18 12:29 17,664 –a—— C:\WINNT\system32\drivers\avg7rsxp.sys 2006-10-18 07:16 84,744 –a—— C:\WINNT\system32\drivers\mfeavfk.sys 2006-10-18 07:16 37,832 –a—— C:\WINNT\system32\drivers\mfesmfk.sys 2006-10-18 07:16 33,928 –a—— C:\WINNT\system32\drivers\mfebopk.sys 2006-10-18 07:16 31,752 –a—— C:\WINNT\system32\drivers\mferkdk.sys 2006-10-18 07:16 162,504 –a—— C:\WINNT\system32\drivers\mfehidk.sys 2006-10-18 07:16 104,536 –a—— C:\WINNT\system32\drivers\Mpfp.sys 2006-10-18 06:09 684,084 —hs—- C:\WINNT\system32\wvuvs.dll 2006-10-18 06:09 465,903 —hs—- C:\WINNT\system32\svuvw.bak1 2006-10-18 05:51 93,696 –a—— C:\WINNT\system32\lwjsfzi.dll 2006-10-18 05:51 72,704 –a—— C:\WINNT\system32\mzmggue.dll 2006-10-09 07:06 61,440 –a—— C:\WINNT\system32\WebIQInstall.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-19 12:04 ——– d-a—— C:\Program Files\Common Files 2006-10-19 10:12 ——– d——– C:\Documents and Settings\Administrator\Application Data\AVG7 2006-10-19 03:00 ——– d——– C:\Program Files\CCleaner 2006-10-18 12:56 ——– d——– C:\Program Files\McAfee 2006-10-18 12:29 ——– d——– C:\Program Files\Grisoft 2006-10-18 12:27 ——– d——– C:\Program Files\WinRAR 2006-10-18 08:13 ——– d——– C:\Program Files\VSToolbar 2006-10-18 07:16 ——– d——– C:\Program Files\Common Files\McAfee 2006-10-18 07:15 ——– d——– C:\Program Files\McAfee.com 2006-10-18 06:09 ——– d——– C:\Documents and Settings\Administrator\Application Data\SearchToolbarCorp 2006-10-09 07:06 ——– d——– C:\Program Files\WebIQ 2006-10-05 16:30 ——– d——– C:\Program Files\Trend Micro 2006-10-02 23:31 ——– d——– C:\Documents and Settings\Administrator\Application Data\Apple Computer 2006-10-01 20:56 ——– d——– C:\Program Files\OfficeUpdate11 2006-09-30 05:59 ——– d——– C:\Program Files\DVD Decrypter 2006-09-13 02:51 ——– d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft 2006-09-12 07:48 1713536 –a—— C:\WINNT\system32\NTKRNLPA.EXE 2006-09-12 07:48 1690880 –a—— C:\WINNT\system32\NTOSKRNL.EXE 2006-09-11 00:51 ——– d——– C:\Program Files\DVDFab Decrypter 2006-09-07 18:57 ——– d–h—– C:\Documents and Settings\Administrator\Application Data\yahoo! 2006-09-07 00:24 ——– d——– C:\Documents and Settings\Administrator\Application Data\Help 2006-09-07 00:15 ——– d——– C:\Program Files\Lavasoft 2006-09-07 00:15 ——– d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft 2006-09-06 04:48 76560 –a—— C:\WINNT\system32\drivers\tmcomm.sys 2006-09-06 00:58 1110528 –a—— C:\WINNT\system32\msxml3.dll 2006-09-04 08:14 ——– d-a—— C:\Program Files\Common Files\Microsoft Shared 2006-09-04 08:13 ——– d——– C:\Program Files\Microsoft Office 2006-08-28 08:29 ——– d——– C:\Program Files\AMP Font Viewer 2006-08-28 08:27 ——– d——– C:\Documents and Settings\Administrator\Application Data\Real 2006-08-28 08:24 ——– d——– C:\Program Files\Real 2006-08-28 08:24 ——– d——– C:\Program Files\Common Files\xing shared 2006-08-28 08:24 ——– d——– C:\Program Files\Common Files\Real 2006-08-28 04:44 530192 –a—— C:\WINNT\system32\comctl32.dll 2006-08-28 01:58 ——– d——– C:\Program Files\Overland 2006-08-28 01:57 ——– d——– C:\Program Files\HP 2006-08-28 01:55 5629 –a—— C:\Documents and Settings\Administrator\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log 2006-08-25 22:31 ——– d——– C:\Program Files\Outlook Express 2006-08-25 22:31 ——– d——– C:\Program Files\Common Files\System 2006-08-25 22:30 ——– d——– C:\Program Files\Windows Media Player 2006-08-25 22:27 ——– d——– C:\Program Files\Internet Explorer 2006-08-25 22:25 ——– d——– C:\Program Files\NetMeeting 2006-08-25 22:23 ——– d——– C:\Program Files\MSXML 4.0 2006-08-25 02:00 ——– d——– C:\Program Files\Windows NT 2006-08-22 21:19 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-08-22 21:18 ——– d——– C:\Program Files\QuickTime 2006-08-22 12:48 136912 ——— C:\WINNT\system32\drivers\fltmgr.sys 2006-08-21 15:38 ——– d——– C:\Program Files\Common Files\InstallShield 2006-08-21 15:32 ——– d——– C:\Program Files\Common Files\Logitech 2006-08-21 15:31 ——– d——– C:\Program Files\Logitech 2006-08-21 04:47 ——– d——– C:\Program Files\AnyTime Deluxe 2006-08-21 00:42 98304 –a—— C:\WINNT\W2BNEUnin.exe 2006-08-21 00:42 2829 –a—— C:\WINNT\W2BNEUnin.pif 2006-08-20 19:32 ——– d——– C:\Program Files\DVD Shrink 2006-08-20 14:48 ——– d——– C:\Program Files\Common Files\Adobe 2006-08-20 14:48 ——– d——– C:\Program Files\Adobe 2006-08-20 14:48 ——– d——– C:\Documents and Settings\Administrator\Application Data\Adobe 2006-08-20 14:47 ——– d——– C:\Documents and Settings\Administrator\Application Data\InterTrust 2006-08-20 13:20 ——– d——– C:\Program Files\Riada 2006-08-20 13:01 ——– d——– C:\Program Files\RFA 2006-08-20 12:53 ——– d——– C:\Program Files\AnalogX 2006-08-20 04:00 ——– d——– C:\Program Files\microsoft frontpage 2006-08-20 03:08 ——– d——– C:\Program Files\Yahoo! 2006-08-20 03:06 ——– d——– C:\Documents and Settings\Administrator\Application Data\Sun 2006-08-20 03:05 ——– d——– C:\Program Files\Java 2006-08-20 03:02 ——– d——– C:\Program Files\Common Files\Java 2006-08-20 02:54 ——– d——– C:\Program Files\IrfanView 2006-08-20 02:53 ——– d——– C:\Program Files\Common Files\Nero 2006-08-20 02:52 ——– d——– C:\Program Files\Common Files\Ahead 2006-08-20 02:52 ——– d——– C:\Program Files\Ahead 2006-08-20 01:56 ——– d——– C:\Program Files\Common Files\Designer 2006-08-20 01:55 ——– d——– C:\Documents and Settings\Administrator\Application Data\Microsoft Web Folders 2006-08-19 23:43 ——– d–h—– C:\Program Files\Uninstall Information 2006-08-19 23:41 ——– d——– C:\Program Files\Common Files\HP 2006-08-19 23:40 ——– d——– C:\Program Files\Hewlett-Packard 2006-08-19 23:39 ——– d——– C:\Program Files\Common Files\Hewlett-Packard 2006-08-19 23:31 ——– d——– C:\Program Files\APC 2006-08-19 01:28 ——– d——– C:\Program Files\Zone Labs 2006-08-19 01:25 ——– d——– C:\Documents and Settings\Administrator\Application Data\Macromedia 2006-08-19 00:40 58000 –a—— C:\WINNT\system32\drivers\cdr4_2K.sys 2006-08-19 00:40 57344 –a—— C:\WINNT\uneng.exe 2006-08-19 00:40 49152 –a—— C:\WINNT\system32\cdrtc.dll 2006-08-19 00:40 45056 –a—— C:\WINNT\system32\cdral.dll 2006-08-19 00:40 23420 –a—— C:\WINNT\system32\drivers\cdralw2k.sys 2006-08-19 00:40 ——– d——– C:\Program Files\Common Files\Adaptec Shared 2006-08-19 00:39 ——– d——– C:\Program Files\EuroTool 2006-08-19 00:30 ——– d-ah—– C:\Program Files\WindowsUpdate 2006-08-19 00:23 ——– d——– C:\Program Files\D-Link 2006-08-19 00:18 ——– d——– C:\Program Files\Common Files\Services 2006-08-19 00:13 ——– d——– C:\Program Files\VIA Technologies, Inc 2006-08-19 00:11 ——– d——– C:\Program Files\C-Media 3D Audio 2006-08-18 23:28 271 —h—– C:\Program Files\desktop.ini 2006-08-18 23:28 21952 —h—– C:\Program Files\folder.htt 2006-08-18 23:28 0 -rahs—- C:\MSDOS.SYS 2006-08-18 23:28 0 -rahs—- C:\IO.SYS 2006-08-18 23:28 0 —h—– C:\CONFIG.SYS 2006-08-18 23:28 0 —h—– C:\AUTOEXEC.BAT 2006-07-25 01:08 840976 –a—— C:\WINNT\system32\mmcndmgr.dll 2006-07-21 11:08 72704 –a—— C:\WINNT\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "Synchronization Manager"="mobsync.exe /logon" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "Logitech Utility"="Logi_MwX.Exe" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\"" "LVCOMSX"="C:\\WINNT\\System32\\LVCOMSX.EXE" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "lwjsfzi.dll"="C:\\WINNT\\system32\\rundll32.exe C:\\WINNT\\system32\\lwjsfzi.dll,okkxfmf" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgemc.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000003 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,44,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=dword:40000004 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 "CDRAutoRun"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winouz32 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvs [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\MCODS Contents of the 'Scheduled Tasks' folder C:\WINNT\tasks\McQcTask.job Completion time: Thu 2006-10-19 12:05:04.00 C:\ComboFix.txt … 06-10-19 12:05

Could you post also a fresh hjt log, please?

Please download
VundoFix.exe
to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files,
  click YES
• Once you click yes, your desktop will go blank as it starts removing
  Vundo.
• When completed, it will prompt that it will reboot your computer,
  click OK.
• Please post the contents of C:\vundofix.txt and a new
  HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button."
when VundoFix appears at reboot.

Should be in C:\vundofix.txt file.

This is what was stored in the vundo fix file log: C:\WINNT\system32\mzmggue.dll C:\WINNT\system32\wvuvs.dll

Those two lines only? Log should be much longer.

that was it

I re-ran the vundo fix.exe—just to be sure. Now the log file is empty.

Also, the log isn't stored there. It is stored at C:\ vundofix backups\ addmorefiles.txt