What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Got Me Good

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This one is nasty.

Symptoms include a popup every few minutes on Mozilla - popups every second on IE6.

The hijack log is even hijacked… I think. When I ran it - it had errors at the end and shut down - so take this log with a grain of salt.

Weird stuff:

* Wacky32.exe triggers a popup screen on startup that encourages the user to install WinRar…
* In the programs folder - there is c:/program files/faronicsAE which is where the bug makes it's home. It regenerates continuously.
* WZQKPICK.EXE is part of the problem… I found that as a running task.
* There is something pretending to be a google search bar in IE - but it produces results from searchcolors.com

Popups come from: http://www.amaena.com/vista/index.php?ax=0…a8fa79364110c34
Also there are lots of winantivirus.com popups…

Any help would be appreciated. I went through the steps of spybot/Adaware/then AVG Anti-Virus but hit a wall when I had no mouse in SafeMode and couldn't activate AVG Anti-Virus 7.3 with the keyboard.

Thanks… here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 7:31:01 AM, on 10/31/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\tcpsvcs.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\UltraVNC\winvnc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\TEMP\PR91FC.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - F:\Program Files\VSAdd-in\VSAdd-in.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: Microsoft Windows TCPIP Protocol Driver (TCP IP Protocol Driver) - Unknown owner - C:\WINNT\tcpsvcs.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\winvnc.exe" -service (file missing)
Post #2 last edited
Opeongo :D

Welcome to Tom Coyote


Are you aware of this?

C:\Program Files\UltraVNC\winvnc.exe

winvnc.exe is a remote desktop control toll which allows you control someone's computer from remote or vice versa. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.


WZQKPICK.EXE <–This is related to Winzip



DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix.
  • just go to My Computer > YOUR C:\ DRIVE > Program Files and create a new folder and name it Hijackthis .
  • Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
  • Now open the new folder you just created and right click within that folder and select PASTE .
  • Now HJT should reside in C:\Program Files\Hijackthis\Hijackthis.exe
Please do not proceed until you have moved HJT




Open HJT Scan Only, close your browser and all open windows, check this and click on Fix Checked

O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - F:\Program Files\VSAdd-in\VSAdd-in.dll

Download Pocket Killbox to your desktop, unzip it to a folder that you can find

F:\Program Files\VSAdd-in


Highlight the file with the complete path in the Quote Box and press Ctrl C on your keyboard.
  • Open Pocket Killbox
  • Go to File > Paste from clipboard
  • Set it to Delete on Reboot
  • Make sure Single File is selected
  • Click on the Red circle with the white X
  • It will ask you to confirm the deletion…Say yes
  • It will ask you to reboot, say yes

Run this system cleaner.

Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Go to where you have HJT installed and right click on the HJT Icon ( looks like a red stick of dynamite with a plunger ) and click on Rename and rename it to Analyse.exe and run it to scan and save a log file and post a new log into this thread.
Post #3
Hi Ken…

Just want to thank you for taking the time. The problem seems to have gotten worse over the last few days. (I was away and came back to more nastiness.)

I did as you said and here is the latest Hijack this log…


Logfile of HijackThis v1.99.1
Scan saved at 10:29:31 AM, on 11/4/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\atapid.exe
C:\WINNT\system32\msasvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\TEMP\KD9EA3.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\WINNT\Mixer.exe
C:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
F:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\explorer.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\tuvuvww.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - F:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O2 - BHO: (no name) - {485A0112-98E3-4DAB-AA4E-5C38FAF8799E} - C:\WINNT\system32\jkhfg.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{38656286-03EA-1033-1226-010106000001}\888Bar.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\tsreiydq.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{38656286-03EA-1033-1226-010106000001}\888Bar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Configuration Manager] C:\WINNT\cfg32.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e47.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e47.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e47.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O20 - AppInit_DLLs: c:\winnt\system32\ldcore.dll
O20 - Winlogon Notify: jkhfg - C:\WINNT\system32\jkhfg.dll
O20 - Winlogon Notify: LogonLauncher - C:\WINNT\SYSTEM32\LogLaun.dll
O20 - Winlogon Notify: tuvuvww - C:\WINNT\SYSTEM32\tuvuvww.dll
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows CDROM Drivers (Microsoft Windows Atapi Drivers) - Unknown owner - C:\WINNT\atapid.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
Post #4
Opeongo :D

Sorry for the delay in responding but I was offline most of the day. Your log is showing multiple infections, we have some work ahead of us. Lets start by running two programs, I need to see the logs from both programs along with a new HJT log.


Please download ComboFix by sUBs from either of these two locations

BleepingComputerComboFix
TechSupportForumComboFix
  • Double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply along with a new HJT log please.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.





Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Put a check next to Run VundoFix as a task.
  • You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
  • When VundoFix re-opens, click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will shutdown your computer, click OK.
  • Turn your computer back on.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Post #5
I did as you asked…

Thanks Ken… ready to work at this….

Here is the combo log:

Administrator - Sat 11/04/2006 21:36:44.39 Service Pack 4
ComboFix 06.10.19 - Running from: "F:\Program Files\Mozilla Firefox"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\dfndrff_e47.exe
C:\dfndrff_e48.exe
C:\drsmartload.exe
C:\deskbar_e47.exe
C:\deskbar_e48.exe
C:\kybrdff_e47.exe
C:\kybrdff_e48.exe
C:\nwnmff_e47.exe
C:\nwnmff_e48.exe
C:\Program Files\Common Files\{38656286-03EA-1033-1226-010106000001}


((((((((((((((((((((((((((((((( Files Created from 2006-10-04 to 2006-11-04 ))))))))))))))))))))))))))))))))))


2006-11-04 21:31 3,584 –a—— C:\WINNT\system32\msasvc.exe
2006-11-04 21:30 40,973 —hs—- C:\WINNT\system32\nnnkllm.dll
2006-11-04 20:45 40,973 —hs—- C:\WINNT\system32\pmnoono.dll
2006-11-04 19:16 40,973 —hs—- C:\WINNT\system32\awtrrrs.dll
2006-11-04 18:41 40,973 —hs—- C:\WINNT\system32\gebcccc.dll
2006-11-04 15:49 40,973 —hs—- C:\WINNT\system32\rqronon.dll
2006-11-04 12:48 1,465 –a—— C:\rrtejlig.exe
2006-11-04 12:40 74,752 –a—— C:\bctpra.exe
2006-11-04 12:40 40,973 —hs—- C:\WINNT\system32\ddcbxwt.dll
2006-11-04 11:18 28,672 –a—— C:\mc44a48.exe
2006-11-04 11:14 40,973 —hs—- C:\WINNT\system32\xxyxwwv.dll
2006-11-04 10:11 40,973 —hs—- C:\WINNT\system32\xxyxutu.dll
2006-11-04 09:55 40,973 —hs—- C:\WINNT\system32\ssqqopm.dll
2006-11-04 08:48 40,973 —hs—- C:\WINNT\system32\mljhgec.dll
2006-11-04 00:06 1,465 –a—— C:\qyrih.exe
2006-11-03 23:37 40,973 —hs—- C:\WINNT\system32\ssqpmlm.dll
2006-11-03 23:32 74,752 –a—— C:\ogrm.exe
2006-11-03 23:30 40,973 —hs—- C:\WINNT\system32\opnonml.dll
2006-11-03 23:10 277,504 –a—— C:\WINNT\system32\durvil1.exe
2006-11-03 23:06 28,672 –a—— C:\mc44a47.exe
2006-11-03 23:05 9,767 –a—— C:\dollarrev.exe
2006-11-03 23:04 323,072 –a—— C:\165.exe
2006-11-03 23:03 48,128 –a—— C:\mainboard.exe
2006-11-03 23:03 40,973 —hs—- C:\WINNT\system32\tuvuvww.dll
2006-11-03 23:02 80,384 -r-hs—- C:\WINNT\atapid.exe
2006-10-31 07:27 60,436 –a—— C:\WINNT\system32\tsreiydq.dll
2006-10-30 21:02 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-10-30 07:26 110,612 –a—— C:\WINNT\system32\ydcjfcfh.exe
2006-10-28 06:13 499,853 —hs—- C:\WINNT\system32\gfhkj.bak2
2006-10-26 23:40 98,324 –a—— C:\WINNT\system32\etpuunji.dll
2006-10-26 23:40 69,652 –a—— C:\WINNT\system32\xqbhxsrg.exe
2006-10-26 23:40 492,988 —hs—- C:\WINNT\system32\gfhkj.bak1
2006-10-26 23:39 688,180 —hs—- C:\WINNT\system32\jkhfg.dll
2006-10-26 22:50 40,973 —hs—- C:\WINNT\system32\tuvuvwt.dll
2006-10-24 11:57 80,384 -r-hs—- C:\WINNT\tcpsvcs.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-04 21:37 ——– d-a—— C:\Program Files\Common Files
2006-11-04 21:15 ——– d——– C:\Program Files\Hijackthis
2006-11-04 11:08 ——– d——– C:\Program Files\Eudora
2006-11-04 10:59 ——– d——– C:\Program Files\FirstClass
2006-11-04 10:59 ——– d——– C:\Program Files\Common Files\InstallShield
2006-11-04 09:20 ——– d——– C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2006-10-30 22:26 ——– d——– C:\Program Files\Google
2006-10-30 21:54 ——– d——– C:\Documents and Settings\Administrator\Application Data\SearchToolbarCorp
2006-10-27 07:26 ——– d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2006-10-26 11:33 ——– d——– C:\Documents and Settings\Administrator\Application Data\Real
2006-10-26 06:05 ——– d——– C:\Program Files\Mozilla Firefox
2006-10-25 21:18 ——– d——– C:\Documents and Settings\Administrator\Application Data\Google
2006-10-25 20:01 ——– d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-09-12 05:48 1713536 –a—— C:\WINNT\system32\NTKRNLPA.EXE
2006-09-12 05:48 1690880 –a—— C:\WINNT\system32\NTOSKRNL.EXE
2006-09-05 22:58 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-28 02:44 530192 –a—— C:\WINNT\system32\comctl32.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NVMCTRAY.DLL,NvTaskbarInit"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"OfficeScanNT Monitor"="\"C:\\Program Files\\Trend Micro\\OfficeScan Client\\pccntmon.exe\" -HideWindow"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Acronis Scheduler2 Service"="\"C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe\""
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
"C-Media Mixer"="Mixer.exe /startup"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"WinampAgent"="F:\\Program Files\\Winamp\\winampa.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="Eudora's Shell Extension"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{2856021F-4568-454E-8F4D-501BA83D80AA}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
"CDRAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"disablecad"=dword:00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"{38656286-03EA-1033-1226-010106000001}"="\"C:\\Program Files\\Common Files\\{38656286-03EA-1033-1226-010106000001}\\Update.exe\" mc-110-12-0000297"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhfg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuvww

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\KxNT
Completion time: Sat 2006-11-04 21:37:55.42
C:\ComboFix.txt … 06-11-04 21:37


Here is the latest Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 9:40:47 PM, on 11/4/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\atapid.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\TEMP\IZ2E9E.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\WINNT\TEMP\eraseme_7526.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\msasvc.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {0F8A1199-50BC-4A2D-BA0B-2CDB11940993} - C:\WINNT\system32\jkhfg.dll
O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\tuvuvww.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\tsreiydq.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O20 - AppInit_DLLs: c:\winnt\system32\ldcore.dll
O20 - Winlogon Notify: jkhfg - C:\WINNT\system32\jkhfg.dll
O20 - Winlogon Notify: tuvuvww - C:\WINNT\SYSTEM32\tuvuvww.dll
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows CDROM Drivers (Microsoft Windows Atapi Drivers) - Unknown owner - C:\WINNT\atapid.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe


VundoFix V6.2.6

Checking Java version…

Java version is 1.5.0.6

Scan started at 9:43:11 PM 11/4/2006

Listing files found while scanning….

C:\WINNT\system32\etpuunji.dll
C:\WINNT\system32\jkhfg.dll
C:\WINNT\system32\gfhkj.ini
C:\WINNT\system32\gfhkj.bak1
C:\WINNT\system32\gfhkj.bak2

Beginning removal…

Attempting to delete C:\WINNT\system32\etpuunji.dll
C:\WINNT\system32\etpuunji.dll Has been deleted!

Attempting to delete C:\WINNT\system32\jkhfg.dll
C:\WINNT\system32\jkhfg.dll Could not be deleted.

Attempting to delete C:\WINNT\system32\gfhkj.ini
C:\WINNT\system32\gfhkj.ini Has been deleted!

Attempting to delete C:\WINNT\system32\gfhkj.bak1
C:\WINNT\system32\gfhkj.bak1 Has been deleted!

Attempting to delete C:\WINNT\system32\gfhkj.bak2
C:\WINNT\system32\gfhkj.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete C:\WINNT\system32\jkhfg.dll
C:\WINNT\system32\jkhfg.dll Has been deleted!

Performing Repairs to the registry.
Done!
Post #6
Your doing well :thumbup: We are about 75% of the way there but still more to do.


We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.




There are still some markers in your log for Vundo, they may just be leftover but lets run this second Vundo tool and make sure its all gone.


Please start by downloading VirtumondoBegone to your desktop.
  • Reboot your computer into Safemode
  • Go to START/ SHUT OF YOUR COMPUTER/ RESTART
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
  • Then press the ENTER KEY ON YOUR KEYBOARD
  • Doubleclick on VirtumundoBeGone.exe and follow the instructions.
  • Do not worry if you see a BLUE SCREEN "Fatal Error" Message, it is normal and expected.
  • When it has finished, reboot and post the log that is created on your desktop called VBG.TXT in your next reply.





Download and install the 30 day trial of AVG Anti-Spyware 7.5 to your desktop.
  • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run Ewido and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.




Open HJT Scan Only, close all open windows and your browser, check all of these entries and click on Fix Checked.

O2 - BHO: (no name) - {0F8A1199-50BC-4A2D-BA0B-2CDB11940993} - C:\WINNT\system32\jkhfg.dll
O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\tuvuvww.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\tsreiydq.dll

O20 - AppInit_DLLs: c:\winnt\system32\ldcore.dll
O20 - Winlogon Notify: jkhfg - C:\WINNT\system32\jkhfg.dll
O20 - Winlogon Notify: tuvuvww - C:\WINNT\SYSTEM32\tuvuvww.dll

O23 - Service: Windows CDROM Drivers (Microsoft Windows Atapi Drivers) - Unknown owner - C:\WINNT\atapid.exe



Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • Ewido will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG Anti-Spyware 7.5



Still in Safemode, look for these files and delete them if still present.

C:\WINNT\atapid.exe

C:\WINNT\TEMP\IZ2E9E.EXE
C:\WINNT\TEMP\eraseme_7526.exe

C:\WINNT\system32\jkhfg.dll
c:\winnt\system32\ldcore.dll
C:\WINNT\system32\tsreiydq.dll
C:\WINNT\system32\tuvuvww.dll



Reboot normally and run this system cleaner

Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.


Let me see the report from Vundobegone, the AVG report and a new HJT log.
Post #7
Hi Ken: Go through most of this to the Ewido portion. I am ready to boot into safe mode but I have no mouse in safemode and I don't believe there is a way to activate Ewido without a mouse. Ideas?
Post #8
Are you using a wireless mouse, if so it may not work in safemode, if you have a regular mouse for the USB or or the regular port, just substitute it. If not, just run AVG in normal mode. Ken :D
Post #9
The mouse plugs into a com port… It's one of my little mysteries as to why it doesn't boot up in safe mode. Even took a look in the BIOS at one point. I'm not beyond getting a new mouse as I have had this one for a zillion years. The AVG won't work in normal mode because it gets bogged down with the running processes that are hurting the machine. How about an older version of AVG? Or a new mouse?
Post #10
I have an older version of Ewido, but its to big to attach. I guess you need to run down to the store and get a new mouse. Get a USB mouse .

In the meantime, you can download and run Spysweeper, look over the link closely, be sure to run the Free trial and not the free online scan.

Download the trial version of Spy Sweeper from Here

Scroll to the bottom of the page and be sure to download and install the Free 5.2 Trial and not t the free online scan.

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C.
Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Restart your computer, and then please copy and paste the SpySweeper log into this thread along with a new HJT log.
Post #11
Okay… not sure if we've taken a step back or what but here's how it played out….

Did The AVG scan and the system didn't let it finish. Did another one with Spy Sweeper with the same results… I did manage to save that log… it is below.

Did a full scan with Spy Sweeper in SAFE MODE and got some success. 9 pieces of virus/spyware removed. - (many of those pieces are listed in the log from the scan that was done without SAFE MODE.

So what follows is the following:

(1) The VBG log
(2) The Log from the first unsuccessful scan. (Didn't get a log from the more successful scan - but the culprits seem to be listed
(3) The latest hijack this log.


[11/05/2006, 8:57:33] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrator\Desktop\VirtumundoBeGone.exe" )
[11/05/2006, 8:57:40] - Detected System Information:
[11/05/2006, 8:57:40] - Windows Version: 5.0.2195, Service Pack 4
[11/05/2006, 8:57:40] - Current Username: Administrator (Admin)
[11/05/2006, 8:57:40] - Windows is in SAFE mode with Networking.
[11/05/2006, 8:57:40] - Searching for Browser Helper Objects:
[11/05/2006, 8:57:40] - BHO 1: {088E144E-3132-430A-87C5-FB9A351D0320} ()
[11/05/2006, 8:57:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:40] - Checking for HKLM\…\Winlogon\Notify\ddayy
[11/05/2006, 8:57:40] - Found: HKLM\…\Winlogon\Notify\ddayy - This is probably Virtumundo.
[11/05/2006, 8:57:40] - Assigning {088E144E-3132-430A-87C5-FB9A351D0320} MSEvents Object
[11/05/2006, 8:57:40] - BHO list has been changed! Starting over…
[11/05/2006, 8:57:40] - BHO 1: {088E144E-3132-430A-87C5-FB9A351D0320} (MSEvents Object)
[11/05/2006, 8:57:40] - ALERT: Found MSEvents Object!
[11/05/2006, 8:57:40] - BHO 2: {0F8A1199-50BC-4A2D-BA0B-2CDB11940993} ()
[11/05/2006, 8:57:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:40] - Checking for HKLM\…\Winlogon\Notify\jkhfg
[11/05/2006, 8:57:40] - Key not found: HKLM\…\Winlogon\Notify\jkhfg, continuing.
[11/05/2006, 8:57:40] - BHO 3: {2856021F-4568-454E-8F4D-501BA83D80AA} ()
[11/05/2006, 8:57:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:40] - Checking for HKLM\…\Winlogon\Notify\mljhhef
[11/05/2006, 8:57:40] - Found: HKLM\…\Winlogon\Notify\mljhhef - This is probably Virtumundo.
[11/05/2006, 8:57:40] - Assigning {2856021F-4568-454E-8F4D-501BA83D80AA} MSEvents Object
[11/05/2006, 8:57:40] - BHO list has been changed! Starting over…
[11/05/2006, 8:57:40] - BHO 1: {088E144E-3132-430A-87C5-FB9A351D0320} (MSEvents Object)
[11/05/2006, 8:57:40] - ALERT: Found MSEvents Object!
[11/05/2006, 8:57:41] - BHO 2: {0F8A1199-50BC-4A2D-BA0B-2CDB11940993} ()
[11/05/2006, 8:57:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:41] - Checking for HKLM\…\Winlogon\Notify\jkhfg
[11/05/2006, 8:57:41] - Key not found: HKLM\…\Winlogon\Notify\jkhfg, continuing.
[11/05/2006, 8:57:41] - BHO 3: {2856021F-4568-454E-8F4D-501BA83D80AA} (MSEvents Object)
[11/05/2006, 8:57:41] - ALERT: Found MSEvents Object!
[11/05/2006, 8:57:41] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/05/2006, 8:57:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:41] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[11/05/2006, 8:57:41] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[11/05/2006, 8:57:41] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/05/2006, 8:57:41] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/05/2006, 8:57:41] - BHO 7: {F18F04B0-9CF1-4b93-B004-77A288BEE28B} ()
[11/05/2006, 8:57:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:41] - Checking for HKLM\…\Winlogon\Notify\tsreiydq
[11/05/2006, 8:57:41] - Key not found: HKLM\…\Winlogon\Notify\tsreiydq, continuing.
[11/05/2006, 8:57:41] - Finished Searching Browser Helper Objects
[11/05/2006, 8:57:41] - *** Detected MSEvents Object
[11/05/2006, 8:57:41] - Trying to remove MSEvents Object…
[11/05/2006, 8:57:42] - Terminating Process: IEXPLORE.EXE
[11/05/2006, 8:57:42] - Terminating Process: RUNDLL32.EXE
[11/05/2006, 8:57:42] - Disabling Automatic Shell Restart
[11/05/2006, 8:57:42] - Terminating Process: EXPLORER.EXE
[11/05/2006, 8:57:42] - Suspending the NT Session Manager System Service
[11/05/2006, 8:57:42] - Terminating Windows NT Logon/Logoff Manager
[11/05/2006, 8:57:42] - Re-enabling Automatic Shell Restart
[11/05/2006, 8:57:42] - File to disable: C:\WINNT\system32\ddayy.dll
[11/05/2006, 8:57:42] - Renaming C:\WINNT\system32\ddayy.dll -> C:\WINNT\system32\ddayy.dll.vir
[11/05/2006, 8:57:42] - File successfully renamed!
[11/05/2006, 8:57:42] - Removing HKLM\…\Browser Helper Objects\{088E144E-3132-430A-87C5-FB9A351D0320}
[11/05/2006, 8:57:42] - Removing HKCR\CLSID\{088E144E-3132-430A-87C5-FB9A351D0320}
[11/05/2006, 8:57:42] - Adding Kill Bit for ActiveX for GUID: {088E144E-3132-430A-87C5-FB9A351D0320}
[11/05/2006, 8:57:42] - Deleting ATLEvents/MSEvents Registry entries
[11/05/2006, 8:57:42] - Removing HKLM\…\Winlogon\Notify\ddayy
[11/05/2006, 8:57:42] - Searching for Browser Helper Objects:
[11/05/2006, 8:57:42] - BHO 1: {0F8A1199-50BC-4A2D-BA0B-2CDB11940993} ()
[11/05/2006, 8:57:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:42] - Checking for HKLM\…\Winlogon\Notify\jkhfg
[11/05/2006, 8:57:42] - Key not found: HKLM\…\Winlogon\Notify\jkhfg, continuing.
[11/05/2006, 8:57:42] - BHO 2: {2856021F-4568-454E-8F4D-501BA83D80AA} (MSEvents Object)
[11/05/2006, 8:57:42] - ALERT: Found MSEvents Object!
[11/05/2006, 8:57:42] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/05/2006, 8:57:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:42] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[11/05/2006, 8:57:42] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[11/05/2006, 8:57:42] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/05/2006, 8:57:42] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/05/2006, 8:57:42] - BHO 6: {F18F04B0-9CF1-4b93-B004-77A288BEE28B} ()
[11/05/2006, 8:57:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:42] - Checking for HKLM\…\Winlogon\Notify\tsreiydq
[11/05/2006, 8:57:42] - Key not found: HKLM\…\Winlogon\Notify\tsreiydq, continuing.
[11/05/2006, 8:57:42] - Finished Searching Browser Helper Objects
[11/05/2006, 8:57:42] - *** Detected MSEvents Object
[11/05/2006, 8:57:42] - Trying to remove MSEvents Object…
[11/05/2006, 8:57:43] - Terminating Process: IEXPLORE.EXE
[11/05/2006, 8:57:43] - Terminating Process: RUNDLL32.EXE
[11/05/2006, 8:57:44] - Disabling Automatic Shell Restart
[11/05/2006, 8:57:44] - Terminating Process: EXPLORER.EXE
[11/05/2006, 8:57:44] - Suspending the NT Session Manager System Service
[11/05/2006, 8:57:44] - Terminating Windows NT Logon/Logoff Manager
[11/05/2006, 8:57:44] - Re-enabling Automatic Shell Restart
[11/05/2006, 8:57:44] - File to disable: C:\WINNT\system32\mljhhef.dll
[11/05/2006, 8:57:44] - Renaming C:\WINNT\system32\mljhhef.dll -> C:\WINNT\system32\mljhhef.dll.vir
[11/05/2006, 8:57:44] - File successfully renamed!
[11/05/2006, 8:57:44] - Removing HKLM\…\Browser Helper Objects\{2856021F-4568-454E-8F4D-501BA83D80AA}
[11/05/2006, 8:57:44] - Removing HKCR\CLSID\{2856021F-4568-454E-8F4D-501BA83D80AA}
[11/05/2006, 8:57:44] - Adding Kill Bit for ActiveX for GUID: {2856021F-4568-454E-8F4D-501BA83D80AA}
[11/05/2006, 8:57:44] - Deleting ATLEvents/MSEvents Registry entries
[11/05/2006, 8:57:44] - Removing HKLM\…\Winlogon\Notify\mljhhef
[11/05/2006, 8:57:44] - Searching for Browser Helper Objects:
[11/05/2006, 8:57:44] - BHO 1: {0F8A1199-50BC-4A2D-BA0B-2CDB11940993} ()
[11/05/2006, 8:57:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:44] - Checking for HKLM\…\Winlogon\Notify\jkhfg
[11/05/2006, 8:57:44] - Key not found: HKLM\…\Winlogon\Notify\jkhfg, continuing.
[11/05/2006, 8:57:44] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/05/2006, 8:57:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:44] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[11/05/2006, 8:57:44] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[11/05/2006, 8:57:44] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/05/2006, 8:57:44] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/05/2006, 8:57:44] - BHO 5: {F18F04B0-9CF1-4b93-B004-77A288BEE28B} ()
[11/05/2006, 8:57:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/05/2006, 8:57:44] - Checking for HKLM\…\Winlogon\Notify\tsreiydq
[11/05/2006, 8:57:44] - Key not found: HKLM\…\Winlogon\Notify\tsreiydq, continuing.
[11/05/2006, 8:57:44] - Finished Searching Browser Helper Objects
[11/05/2006, 8:57:44] - Finishing up…
[11/05/2006, 8:57:44] - A restart is needed.
[11/05/2006, 8:57:54] - Attempting to Restart via STOP error (Blue Screen!)


7:32 PM: | End of Session, Sunday, November 05, 2006 |
7:29 PM: Program Version 5.2.3.2125 Using Spyware Definitions 790
7:29 PM: Informational: Loaded AntiVirus Engine: 2.38.2; SDK Version: 4.10; Virus Definitions: 11/5/2006 4:19:52 PM (GMT)
4:50 PM: | End of Session, Sunday, November 05, 2006 |
4:49 PM: Access to Hosts file allowed for C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\DESKTOP\KILLBOX.EXE
4:49 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:49 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:49 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:49 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:49 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Adware: command, version 1.0.0.0
4:48 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
4:48 PM: Access to Hosts file blocked for F:\PROGRA~1\MOZILL~1\FIREFOX.EXE
4:47 PM: Spy Installation Shield: found: Virus: Troj/DwnLdr-FTB, version
Keylogger: Off
4:47 PM: Spy Installation Shield: found: Virus: Troj/DwnLdr-FTB, version
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
4:47 PM: Spy Installation Shield: found: Virus: Troj/DwnLdr-FTB, version
4:47 PM: Spy Installation Shield: found: Virus: Troj/DwnLdr-FTB, version
4:47 PM: Spy Installation Shield: found: Virus: Troj/DwnLdr-FTB, version
Common Ad Sites: Off
4:47 PM: Spy Installation Shield: found: Virus: Troj/DwnLdr-FTB, version
Hosts File Shield: On
Internet Communication Shield: On
4:47 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
ActiveX Shield: On
4:47 PM: Spy Installation Shield: found: Trojan Horse: trojan-backdoor-us15info, version 1.0.0.0
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
4:46 PM: Shield States
4:45 PM: Spyware Definitions: 790
4:45 PM: Informational: Loaded AntiVirus Engine: 2.38.2; SDK Version: 4.10; Virus Definitions: 11/5/2006 4:19:52 PM (GMT)
4:41 PM: Spy Sweeper 5.2.3.2125 started
4:41 PM: Spy Sweeper 5.2.3.2125 started
4:41 PM: | Start of Session, Sunday, November 05, 2006 |

Logfile of HijackThis v1.99.1
Scan saved at 12:07:56 AM, on 11/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\atapid.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
F:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\TEMP\VX1EA8.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINNT\Mixer.exe
C:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Winamp\winampa.exe
F:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\TEMP\eraseme_7526.exe
F:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINNT\system32\msasvc.exe
F:\Program Files\Mozilla Firefox\firefox.exe
c:\xmaurwc.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {0617841D-DFB9-41C5-A103-9F1D3117020E} - C:\WINNT\system32\awvvu.dll
O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\nnnligd.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SpySweeper] "F:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O20 - Winlogon Notify: awvvu - C:\WINNT\system32\awvvu.dll
O20 - Winlogon Notify: nnnligd - C:\WINNT\SYSTEM32\nnnligd.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Windows CDROM Drivers (Microsoft Windows Atapi Drivers) - Unknown owner - C:\WINNT\atapid.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - F:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Post #12
Your kind of tying my hands behind my back not being able to boot to safemode. If your serious about cleaning up your computer, you need to buy a new mouse that works and run AVG in Safemode. In the meantime we can try a few things manually.


Open a command prompt
start>run type cmd press enter
type
sc delete "Microsoft Windows Atapi Drivers"
press enter, type exit and press enter to exit the command prompt
Please notice the quote marks, there needed


Then do it for this also
sc delete "MsaSvc"


Open HJT Scan Only , close all open windows and your browser and remove these entries by checking them and clicking on Fix Checked


O2 - BHO: (no name) - {0617841D-DFB9-41C5-A103-9F1D3117020E} - C:\WINNT\system32\awvvu.dll
O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\nnnligd.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll

O4 - HKLM\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe

O20 - Winlogon Notify: awvvu - C:\WINNT\system32\awvvu.dll
O20 - Winlogon Notify: nnnligd - C:\WINNT\SYSTEM32\nnnligd.dll

O23 - Service: Windows CDROM Drivers (Microsoft Windows Atapi Drivers) - Unknown owner - C:\WINNT\atapid.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe




Download Pocket Killbox to your desktop, unzip it to a folder that you can find

C:\WINNT\atapid.exe
C:\WINNT\system32\awvvu.dll
C:\WINNT\system32\hdfdhxle.dll
C:\WINNT\system32\nnnligd.dll
C:\WINNT\system32\_mzu_stonedrv8.exe
C:\WINNT\TEMP\VX1EA8.EXE
C:\WINNT\TEMP\eraseme_7526.exe


Highlight all the files at once with the complete path inside the quote and press Ctrl C on your keyboard.
  • Open Pocket Killbox
  • Go to File > Paste from clipboard
  • Set it to Delete on Reboot
  • Tick the box that says End Explorer shell while killing file
  • If its not greyed out..Click the radio button that say Unregister .dll before deleting.
  • Make sure ALL Files is selected
  • Click on the Red circle with the white X
  • It will ask you to confirm the deletion…Say yes
  • It will ask you to reboot, say yes

Reboot and post a new HJT log.
Post #13
Ken: I will be making the purchase of a nice new mouse today… it is long overdue. The sc delete command is not recognized internal or external command…. is there another way to delete services with a command prompt?
Post #14
Do this…
  • Go to Start> Run and type in services.msc then press Enter
  • Scroll down to Windows CDROM Drivers
  • Double Click that service to open it.
  • Click on Stop Service.
  • Then change the Startup Type to Disabled.
  • OK your way out of the program.
  • Open HJT > Misc Tools > Delete an NT Service
  • Type in Microsoft Windows Atapi Drivers
  • Then click on OK, it will ask you to reboot, do so.

Then do it again for this one

  • Go to Start> Run and type in services.msc then press Enter
  • Scroll down to Microsoft authenticate service
  • Double Click that service to open it.
  • Click on Stop Service.
  • Then change the Startup Type to Disabled.
  • OK your way out of the program.
  • Open HJT > Misc Tools > Delete an NT Service
  • Type in MsaSvc
  • Then click on OK, it will ask you to reboot, do so.

Then if you have not done so, remove all the entries with HJT in my earlier post and delete all those files.

Add this one to the killbox list

C:\WINNT\system32\msasvc.exe

So it should include all these

C:\WINNT\atapid.exe
C:\WINNT\system32\awvvu.dll
C:\WINNT\system32\hdfdhxle.dll
C:\WINNT\system32\nnnligd.dll
C:\WINNT\system32\msasvc.exe
C:\WINNT\system32\_mzu_stonedrv8.exe
C:\WINNT\TEMP\VX1EA8.EXE
C:\WINNT\TEMP\eraseme_7526.exe
Post #15 last edited
There is nothing called Windows CDROM Drivers in the services area. (I have a .jpg if you want to see it)

Maybe it's listed as something else. Also it didn't recognize Microsoft Windows Atapi Drivers when I went to delete it.

Other than that… I just saved $150 by switching to Geico….

Just kidding. I did buy a new mouse today.

Here is the latest hijack log….

Opeongo


Logfile of HijackThis v1.99.1
Scan saved at 6:37:24 PM, on 11/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Agent\agent.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\TEMP\JTB089.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\WINNT\Mixer.exe
F:\Program Files\Winamp\winampa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\system32\RUNDLL32.EXE
F:\Program Files\WinZip\WZQKPICK.EXE
F:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\elRecvr.exe
C:\WINNT\TEMP\eraseme_1065.exe
C:\WINNT\TEMP\eraseme_7526.exe
C:\WINNT\system32\msasvc.exe
C:\Program Files\Hijackthis\Analyse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {2856021F-4568-454E-8F4D-501BA83D80AA} - C:\WINNT\system32\nnnligd.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: (no name) - {B56BDA75-300B-4DBA-99EE-7CB3A96A9C2D} - C:\WINNT\system32\awvvu.dll
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINNT\system32\hdfdhxle.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Tweak UI] "RUNDLL32.EXE" TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e49.exe
O4 - HKLM\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e49.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [_mzu_stonedrv8] C:\WINNT\system32\_mzu_stonedrv8.exe
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153499979273
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153834256367
O20 - Winlogon Notify: awvvu - C:\WINNT\system32\awvvu.dll
O20 - Winlogon Notify: nnnligd - C:\WINNT\SYSTEM32\nnnligd.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Program Files\Common Files\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Extended Windows Security (Microsoft Extended Windows Security) - Unknown owner - C:\WINNT\elRecvr.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI