What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

IEXPLORE on startup

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
First of all the log:


Logfile of HijackThis v1.99.1
Scan saved at 7:47:51 PM, on 24/10/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\WINDOWS\System32\ctfmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\SiteAdvisor\4144\SiteAdv.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Rich\My Documents\BE300 downloads\cnc maps\hijackthis\HijackThis.exe

F3 - REG:win.ini: run=
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161543270030
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



Protective Services Installed and Updated:
McAfee VirusScan Plus
A-squared Trial version
Sbybot S&D
Hijack This
(all maximum scans and services enabled)

Symptoms:
-IEXPLORE (1) occurance on startup
-firefox redirects to Drivecleaner and Antivirus Pro 2006 websites
-regular (ever 20 seconds) windows popup error:
iexplore.exe-Application error
The exception unknown software exception (0xc00000fd) occured in the application at location
0x77d44105 (grammar mistakes are not me!)
-black screen instead of a folder opening
-hotmail and gmail won't log in from home network anymore (could be unrelated)


I was hopeing this is common and someone could help, it is even hard to write this post with all these popups and redirects

Sincerely,

The Quaidster
Post #2
Welcome to the forum :wavey:

Please do this.

Rename:

C:\Documents and Settings\Rich\My Documents\BE300 downloads\cnc maps\hijackthis\HijackThis.exe

To:

C:\Documents and Settings\Rich\My Documents\BE300 downloads\cnc maps\hijackthis\lister.exe

Reboot, run it, and post a new log file into this thread.

I believe you have an infection that stealths itself from HijackThis!

If so, this will bring it out into the open for us to deal with directly.
:)
Post #3
Logfile of HijackThis v1.99.1
Scan saved at 10:39:49 PM, on 25/10/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SiteAdvisor\4144\SiteAdv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Rich\My Documents\BE300 downloads\cnc maps\hijackthis\lister.exe

F3 - REG:win.ini: run=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O2 - BHO: (no name) - {09AD37F0-3572-4E74-8269-2ECE546D7DDB} - (no file)
O2 - BHO: (no name) - {1328D14F-ACC6-474D-89F8-B929B8F75A1B} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {72C04AEB-0243-4CAA-BAD7-41F18BABFF62} - C:\WINDOWS\system32\1028\ceky.dll
O2 - BHO: (no name) - {763CEEAD-6363-45A4-B85E-FA88D3EFC8DA} - (no file)
O2 - BHO: (no name) - {7ADD789F-EE8D-4CCD-90D8-DA68F02A64E8} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll
O2 - BHO: (no name) - {B0D0D8AB-2EA9-4A58-8A14-D20D8196F76A} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: PrintViewBHO Class - {D4E0C464-30CE-4075-9A10-71FD106C2847} - (no file)
O2 - BHO: (no name) - {DA48FB69-E2D8-4A80-97CC-BF2AC7E37210} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161543270030
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O20 - Winlogon Notify: ceky - C:\WINDOWS\system32\1028\ceky.dll
O20 - Winlogon Notify: winrnt32 - winrnt32.dll (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



Thanks Micah,

looks like ceky, I don't know if the SDHelper above is maybe part of spybot, or just trying to look that way
also there are a whole lot of BHO's (no name)
as well what about this guy:

O20 - Winlogon Notify: winrnt32 - winrnt32.dll (file missing) ?

let me know what you think,
changing the name of HJ this like that, never would have thought of it, genius


Quaidster
Post #4
Download VundoFix.exe to your desktop from here:

VundoFix.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

1. Double-click VundoFix.exe to run it.
2. Click the Scan for Vundo button.
3. Once it's done scanning, click the Remove Vundo button.
4. You will receive a prompt asking if you want to remove the files, click YES.
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will shutdown your computer, click OK.
7. Turn your computer back on.

Post a new HijackThis! log, along with the contents of this file:

C:\vundofix.txt

into this thread.
:)
Post #5
Logfile of HijackThis v1.99.1
Scan saved at 11:13:19 PM, on 25/10/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Rich\My Documents\BE300 downloads\cnc maps\hijackthis\lister.exe

F3 - REG:win.ini: run=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O2 - BHO: (no name) - {09AD37F0-3572-4E74-8269-2ECE546D7DDB} - (no file)
O2 - BHO: (no name) - {1328D14F-ACC6-474D-89F8-B929B8F75A1B} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {72C04AEB-0243-4CAA-BAD7-41F18BABFF62} - C:\WINDOWS\system32\1028\ceky.dll (file missing)
O2 - BHO: (no name) - {763CEEAD-6363-45A4-B85E-FA88D3EFC8DA} - (no file)
O2 - BHO: (no name) - {7ADD789F-EE8D-4CCD-90D8-DA68F02A64E8} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll
O2 - BHO: (no name) - {B0D0D8AB-2EA9-4A58-8A14-D20D8196F76A} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: PrintViewBHO Class - {D4E0C464-30CE-4075-9A10-71FD106C2847} - (no file)
O2 - BHO: (no name) - {DA48FB69-E2D8-4A80-97CC-BF2AC7E37210} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161543270030
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\4144\SiteAdv.dll
O20 - Winlogon Notify: winrnt32 - winrnt32.dll (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

VundoFix V6.2.6

Checking Java version…

Java version is 1.5.0.3

Scan started at 10:58:26 PM 25/10/2006

Listing files found while scanning….

C:\WINDOWS\system32\adihxsxn.dll
C:\WINDOWS\system32\apcintti.dll
C:\WINDOWS\system32\ayqeoych.dll
C:\WINDOWS\system32\bferjhin.dll
C:\WINDOWS\system32\bodhxnpb.dll
C:\WINDOWS\system32\bwuwfoog.dll
C:\WINDOWS\system32\byxotads.dll
C:\WINDOWS\system32\cddpgepg.dll
C:\WINDOWS\system32\cdvkkqpx.dll
C:\WINDOWS\system32\ckcpkfcd.dll
C:\WINDOWS\system32\dnlxqepf.dll
C:\WINDOWS\system32\exvuplqu.dll
C:\WINDOWS\system32\eypehhav.dll
C:\WINDOWS\system32\fgkijltk.dll
C:\WINDOWS\system32\fowknvav.dll
C:\WINDOWS\system32\hbxkmikt.dll
C:\WINDOWS\system32\helwpnmv.dll
C:\WINDOWS\system32\huwyvkat.dll
C:\WINDOWS\system32\hwdiweuc.dll
C:\WINDOWS\system32\ioumqjea.dll
C:\WINDOWS\system32\iwlviyik.dll
C:\WINDOWS\system32\jxklngik.dll
C:\WINDOWS\system32\kmbauqvw.dll
C:\WINDOWS\system32\lkyranlm.dll
C:\WINDOWS\system32\mfmajblh.dll
C:\WINDOWS\system32\mokhifnw.dll
C:\WINDOWS\system32\nghjnyga.dll
C:\WINDOWS\system32\ollydgpn.dll
C:\WINDOWS\system32\ophnhaqn.dll
C:\WINDOWS\system32\pvtucryb.dll
C:\WINDOWS\system32\pwmthhmg.dll
C:\WINDOWS\system32\qcdfagnr.dll
C:\WINDOWS\system32\qnlhrmcc.dll
C:\WINDOWS\system32\qtssxtcr.dll
C:\WINDOWS\system32\rogfgwgh.dll
C:\WINDOWS\system32\ruqgmnyb.dll
C:\WINDOWS\system32\sixurlvg.dll
C:\WINDOWS\system32\skdnusaa.dll
C:\WINDOWS\system32\smhylcbe.dll
C:\WINDOWS\system32\smvakhbs.dll
C:\WINDOWS\system32\svjvldbl.dll
C:\WINDOWS\system32\toctcisj.dll
C:\WINDOWS\system32\uvlwlhvv.dll
C:\WINDOWS\system32\vpdegeuu.dll
C:\WINDOWS\system32\vvlstipt.dll
C:\WINDOWS\system32\wjkupaya.dll
C:\WINDOWS\system32\xialevnv.dll
C:\WINDOWS\system32\yrmeisuv.dll
C:\WINDOWS\system32\bcrxeigq.exe
C:\WINDOWS\system32\qqmiaajn.exe
C:\WINDOWS\system32\1028\ceky.dll
C:\WINDOWS\system32\1028\ceky.dll
C:\WINDOWS\system32\1028\ykec.ini
C:\WINDOWS\system32\1028\ykec.bak1
C:\WINDOWS\system32\1028\ykec.bak2
C:\WINDOWS\system32\1028\ykec.ini2
C:\WINDOWS\system32\1028\ykec.tmp
C:\WINDOWS\system32\1028\ykec.ini
C:\WINDOWS\system32\1028\ykec.bak1
C:\WINDOWS\system32\1028\ykec.bak2
C:\WINDOWS\system32\1028\ykec.ini2
C:\WINDOWS\system32\1028\ykec.tmp

Beginning removal…

Attempting to delete C:\WINDOWS\system32\adihxsxn.dll
C:\WINDOWS\system32\adihxsxn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\apcintti.dll
C:\WINDOWS\system32\apcintti.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ayqeoych.dll
C:\WINDOWS\system32\ayqeoych.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bferjhin.dll
C:\WINDOWS\system32\bferjhin.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bodhxnpb.dll
C:\WINDOWS\system32\bodhxnpb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bwuwfoog.dll
C:\WINDOWS\system32\bwuwfoog.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxotads.dll
C:\WINDOWS\system32\byxotads.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cddpgepg.dll
C:\WINDOWS\system32\cddpgepg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cdvkkqpx.dll
C:\WINDOWS\system32\cdvkkqpx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ckcpkfcd.dll
C:\WINDOWS\system32\ckcpkfcd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\dnlxqepf.dll
C:\WINDOWS\system32\dnlxqepf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\exvuplqu.dll
C:\WINDOWS\system32\exvuplqu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\eypehhav.dll
C:\WINDOWS\system32\eypehhav.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fgkijltk.dll
C:\WINDOWS\system32\fgkijltk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fowknvav.dll
C:\WINDOWS\system32\fowknvav.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hbxkmikt.dll
C:\WINDOWS\system32\hbxkmikt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\helwpnmv.dll
C:\WINDOWS\system32\helwpnmv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\huwyvkat.dll
C:\WINDOWS\system32\huwyvkat.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hwdiweuc.dll
C:\WINDOWS\system32\hwdiweuc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ioumqjea.dll
C:\WINDOWS\system32\ioumqjea.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iwlviyik.dll
C:\WINDOWS\system32\iwlviyik.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jxklngik.dll
C:\WINDOWS\system32\jxklngik.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kmbauqvw.dll
C:\WINDOWS\system32\kmbauqvw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\lkyranlm.dll
C:\WINDOWS\system32\lkyranlm.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mfmajblh.dll
C:\WINDOWS\system32\mfmajblh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mokhifnw.dll
C:\WINDOWS\system32\mokhifnw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nghjnyga.dll
C:\WINDOWS\system32\nghjnyga.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ollydgpn.dll
C:\WINDOWS\system32\ollydgpn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ophnhaqn.dll
C:\WINDOWS\system32\ophnhaqn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pvtucryb.dll
C:\WINDOWS\system32\pvtucryb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pwmthhmg.dll
C:\WINDOWS\system32\pwmthhmg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qcdfagnr.dll
C:\WINDOWS\system32\qcdfagnr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qnlhrmcc.dll
C:\WINDOWS\system32\qnlhrmcc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtssxtcr.dll
C:\WINDOWS\system32\qtssxtcr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rogfgwgh.dll
C:\WINDOWS\system32\rogfgwgh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ruqgmnyb.dll
C:\WINDOWS\system32\ruqgmnyb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\sixurlvg.dll
C:\WINDOWS\system32\sixurlvg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\skdnusaa.dll
C:\WINDOWS\system32\skdnusaa.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\smhylcbe.dll
C:\WINDOWS\system32\smhylcbe.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\smvakhbs.dll
C:\WINDOWS\system32\smvakhbs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\svjvldbl.dll
C:\WINDOWS\system32\svjvldbl.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\toctcisj.dll
C:\WINDOWS\system32\toctcisj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\uvlwlhvv.dll
C:\WINDOWS\system32\uvlwlhvv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vpdegeuu.dll
C:\WINDOWS\system32\vpdegeuu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vvlstipt.dll
C:\WINDOWS\system32\vvlstipt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wjkupaya.dll
C:\WINDOWS\system32\wjkupaya.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xialevnv.dll
C:\WINDOWS\system32\xialevnv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yrmeisuv.dll
C:\WINDOWS\system32\yrmeisuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcrxeigq.exe
C:\WINDOWS\system32\bcrxeigq.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\qqmiaajn.exe
C:\WINDOWS\system32\qqmiaajn.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\1028\ceky.dll
C:\WINDOWS\system32\1028\ceky.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\1028\ykec.ini
C:\WINDOWS\system32\1028\ykec.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\1028\ykec.bak1
C:\WINDOWS\system32\1028\ykec.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\1028\ykec.bak2
C:\WINDOWS\system32\1028\ykec.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\1028\ykec.ini2
C:\WINDOWS\system32\1028\ykec.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\1028\ykec.tmp
C:\WINDOWS\system32\1028\ykec.tmp Has been deleted!

Performing Repairs to the registry.
Done!


Thanks!

Quaidster
Post #6
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

F3 - REG:win.ini: run=

O2 - BHO: (no name) - {09AD37F0-3572-4E74-8269-2ECE546D7DDB} - (no file)

O2 - BHO: (no name) - {1328D14F-ACC6-474D-89F8-B929B8F75A1B} - (no file)

O2 - BHO: (no name) - {72C04AEB-0243-4CAA-BAD7-41F18BABFF62} - C:\WINDOWS\system32\1028\ceky.dll (file missing)

O2 - BHO: (no name) - {763CEEAD-6363-45A4-B85E-FA88D3EFC8DA} - (no file)

O2 - BHO: (no name) - {7ADD789F-EE8D-4CCD-90D8-DA68F02A64E8} - (no file)

O2 - BHO: (no name) - {B0D0D8AB-2EA9-4A58-8A14-D20D8196F76A} - (no file)

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O2 - BHO: PrintViewBHO Class - {D4E0C464-30CE-4075-9A10-71FD106C2847} - (no file)

O2 - BHO: (no name) - {DA48FB69-E2D8-4A80-97CC-BF2AC7E37210} - (no file)

O20 - Winlogon Notify: winrnt32 - winrnt32.dll (file missing)

Then click "Fix checked" and close Hijack This!.

Things working OK for you now?
:unsure:

Securing Your PC After An Attack
Post #7
Micah 6:8 Thanks for all your help, I followed the steps, IEXPLORE doesn't appear on start-up computer seems a bit faster and more responsive now too Thanks Again, Quaidster
Post #9
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI