What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HIJACKTHIS log help please

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hi Kath,

I'm at a loss to explain why the HJT entry will not delete. I'll consult on this to see if there's any suggestions from the other helpers.

Apart from that entry I can see nothing in any of the logs you've returned that would indicate the presence of any Malware.

How is your computer behaving?

I'll wait for your answer before makng any suggestions for securing your computer.
Post #32
Hi Gary, Computer appears to be working fine. The only problem is the changes to the ID tags on the MP3's i previously mentioned. I can't show you what they have been changed to as it is obscure text. Thanks again, Kath
Post #33
Hi Kath,

One last try at the obstinate line.

The regfix I gave you earlier may have been written wrongly.
  • Click Start > Run type Notepad click OK.
  • This will open a Notepad file.
  • Copy/Paste the contents of the quote box below into the Notepad file.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NI.ERS_9999_N91S2007"=-


  • Click on Format and make sure Wordwrap is unchecked.
  • Save as Regfix2.reg
  • Save as file type All Files or it won't work.
  • Double click Regfix2.reg to launch it, and allow it to merge with the Registry when prompted.
Also, I'd like you to run another scan for me.
  • Download combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log for you. Post that log in your next reply please, along with a new HJT log.
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

This tool produces a log of all files created within the last 30 days, and may give some indication to what it is we haven't found yet.
Post #34
Hi Gary, I can't see it. But I shall wait for your opinion. Here are the two new logs you requested.

Gordon - 07-01-01 17:46:33.18 Service Pack 2
ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Gordon.GORDON-MAINPC\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tracert.com
C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon


((((((((((((((((((((((((((((((( Files Created from 2006-12-01 to 2007-01-01 ))))))))))))))))))))))))))))))))))


2006-12-25 18:44 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll
2006-12-23 19:49 d——– C:\X BOX GAMES 3
2006-12-23 14:30 d——– C:\avenger
2006-12-23 14:22 d——– C:\Rustbfix
2006-12-23 12:56 d——– C:\Documents and Settings\Gordon.GORDON-MAINPC\Application Data\Prevx
2006-12-23 12:55 9,728 –a—— C:\WINDOWS\system32\drivers\pxscinst.dll
2006-12-23 12:55 7,680 –a—— C:\WINDOWS\system32\drivers\pxinst.dll
2006-12-23 12:55 7,552 –a—— C:\WINDOWS\system32\drivers\pxcom.sys
2006-12-23 12:55 274,688 –a—— C:\WINDOWS\system32\drivers\pxfsf.sys
2006-12-23 12:55 18,560 –a—— C:\WINDOWS\system32\drivers\pxtdi.sys
2006-12-23 12:55 13,568 –a—— C:\WINDOWS\system32\drivers\pxrd.sys
2006-12-23 12:55 11,648 –a—— C:\WINDOWS\system32\drivers\pxscrmbl.sys
2006-12-23 12:55 100,864 –a—— C:\WINDOWS\system32\drivers\PxEmu.sys
2006-12-23 12:55 d——– C:\Program Files\Prevx1
2006-12-23 12:55 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Prevx
2006-12-23 10:52 0 –a—— C:\WINDOWS\system32\CMMGR32.EXE
2006-12-23 10:45 d——– C:\Documents and Settings\Gordon.GORDON-MAINPC\Application Data\SUPERAntiSpyware.com
2006-12-22 20:20 d——– C:\Program Files\VIRTUA~1
2006-12-22 12:55 d——– C:\XBOX GAMES 2
2006-12-20 10:39 d——– C:\XBOX GAMES
2006-12-18 12:48 d——– C:\Program Files\WinRAR
2006-12-18 11:24 d——– C:\Program Files\WinRAR(2)
2006-12-16 11:02 80 –a—— C:\WINDOWS\gmer_uninstall.cmd
2006-12-14 22:54 d——– C:\Backlight Beta
2006-12-14 00:14 d——– C:\!KillBox
2006-12-13 12:14 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-13 11:33 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg7
2006-12-12 20:34 dr-h—– C:\Documents and Settings\Gordon.GORDON-MAINPC\Recent
2006-12-12 17:32 d——– C:\Program Files\hijackthis
2006-12-12 17:22 d-a—— C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2006-12-12 10:15 d–h—– C:\Program Files\Common Files\Uninstall Information
2006-12-12 10:15 d–h—– C:\Documents and Settings\All Users.WINDOWS\Application Data\vidmon
2006-12-12 10:15 d–h—– C:\Documents and Settings\All Users.WINDOWS\Application Data\nfo
2006-12-11 18:00 d——– C:\Program Files\Team Craxtion
2006-12-10 13:28 d——– C:\Downloads
2006-12-10 11:51 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\PlayFirst
2006-12-07 16:46 89,184 –a—— C:\WINDOWS\system32\drivers\imagedrv.sys
2006-12-07 16:46 d——– C:\Documents and Settings\Gordon.GORDON-MAINPC\Application Data\Ahead
2006-12-07 16:44 24,064 ——— C:\WINDOWS\system32\msxml3a.dll
2006-12-07 16:44 d——– C:\Program Files\Common Files\Ahead
2006-12-07 16:44 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Ahead
2006-12-04 11:05 d——– C:\Program Files\Elaborate Bytes
2006-12-03 22:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-01 17:47 ——– d——– C:\Program Files\DC++
2007-01-01 17:42 ——– d——– C:\Program Files\kath dc
2007-01-01 10:38 ——– d——– C:\Program Files\Symantec
2007-01-01 10:38 ——– d——– C:\Program Files\NavNT
2007-01-01 10:37 ——– d——– C:\Program Files\Common Files\Symantec Shared
2007-01-01 10:34 ——– d——– C:\Program Files\Lavasoft
2006-12-30 13:18 ——– d—s—- C:\Documents and Settings\Gordon.GORDON-MAINPC\Application Data\Microsoft
2006-12-29 09:42 ——– d——– C:\Program Files\Common Files
2006-12-25 18:45 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-12-25 18:34 ——– d——– C:\Program Files\Microsoft Games
2006-12-23 16:40 14848 –a—— C:\WINDOWS\system32\BASSMOD.dll
2006-12-22 21:28 ——– d——– C:\Program Files\Grisoft
2006-12-22 13:45 ——– d——– C:\Program Files\Visiosonic
2006-12-22 12:10 ——– d——– C:\Program Files\MixMeister Fusion
2006-12-18 12:47 ——– d——– C:\Program Files\ahead
2006-12-12 22:35 ——– d——– C:\Program Files\EPSON
2006-12-12 21:06 ——– d——– C:\Program Files\Yahoo!
2006-12-06 21:35 1150587 –a—— C:\Program Files\Qwix101.rar
2006-12-04 11:36 ——– d——– C:\Program Files\QuickTime
2006-11-11 06:05 57779330 –a—— C:\Program Files\instdjs1000100tr_en.exe
2006-11-08 18:56 869 –a—— C:\Documents and Settings\Gordon.GORDON-MAINPC\Application Data\AdobeDLM.log
2006-11-08 18:56 21290704 –a—— C:\Program Files\AdbeRdr708_en_US.exe
2006-11-08 18:56 ——– d——– C:\Program Files\Adobe
2006-11-08 18:50 ——– d——– C:\Documents and Settings\Gordon.GORDON-MAINPC\Application Data\Adobe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\""
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"EPSON Stylus D68 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAAE.EXE /P23 \"EPSON Stylus D68 Series\" /O6 \"USB001\" /M \"Stylus D68\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"PrevxOne"="\"C:\\Program Files\\Prevx1\\PXConsole.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,00,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{CDEFEE3D-EDCB-4226-931B-90E184C11CAC}"="rjgoitr"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 07-01-01 17:47:59.48
C:\ComboFix.txt … 07-01-01 17:47


Logfile of HijackThis v1.99.1
Scan saved at 17:55:43, on 01/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 3.73\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 3.73\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.21.10/ttinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Thanks again
Post #35
Hi Kath,

Looks like the 04 entry is gone (about time too), sorry for taking so long about it.

Going to take me a while to go through the combofix log to see if there's anything to explain the MP3 file problems, I'm not totally confident of being able to resolve it, but I'll give it my best try.

Could I ask you to run yet another scan for me please.

Download FindAWF by noahdfear and save it to your Desktop.
  • Double click FindAWF.exe and follow the instructions.
  • When the tool has finished scanning, the results will be saved as awf.txt on your Desktop.
  • If any results, copy and paste them into your next reply please, let me know if not.
Post #36
Hi Gary, The funny thing about the mp3's is that not all mp3's in a folder have been changed, just random ones and then the majoirty of ones in another folder. here are the results of the FINDAWF scan. Find AWF report by noahdfear ©2006 21504 byte files found ~~~~~~~~~~~~~ 21504 "C:\Documents and Settings\Gordon.GORDON-MAINPC\Local Settings\Temporary Internet Files\Content.IE5\RV1MMQKA\masthead_pc[1].jpg" 21504 byte files sorted with strings ~~~~~~~~~~~~~~~~~~~~~ 25600 byte files found ~~~~~~~~~~~~~ 25600 byte files sorted with strings ~~~~~~~~~~~~~~~~~~~~~ 26450 byte files found ~~~~~~~~~~~~~ 26450 byte files sorted with strings ~~~~~~~~~~~~~~~~~~~~~ bak folders found ~~~~~~~~~~~ Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ end of report
Post #37
Hi Kath, Gone through the Combofix log, and nothing there, ditto the AWF (that was just a shot in the dark really, didn't expect to find anything). Can't find any Malware reason for the corrupted MP3 files, though that's not to say that malware wasn't responsible for the initial corruption, just that I can't find any remaining infection on your machine. I'll ask the other helpers if anyone's come across this type of problem, but I'm afraid its possible we may not be able to recover those files. Can you give me as much detail as you can into how they are corrupted, this may give a clue to the reason for it, have you tried re-naming one of the corrupted files and seeing if it will play?
Post #38 last edited
Hi Kath,

Been thinking again about one of the entries in your Combofix log, and I'd like to explore a little further.

Download RegSearch by Bobbi Flekman.
  • Create a folder in your C: drive C:\Regsearch, and extract all the files from the zip archive into that folder.
  • Double click regsearch.exe to launch the programme.
  • Copy/Paste the following into the Search Box CDEFEE3D-EDCB-4226-931B-90E184C11CAC
  • On the next line Copy/Paste rjgoitr
  • Click OK.
Regsearch will now search your Registry for the required strings, when it is finished it will open a Notepad file RegSearch.txt, saved to the Regsearch folder.

Copy/Paste that file into your next post please.
Post #39
Hi Gary, Tried to run that last program and got the following message; Integer Overflow As for the Mp3's they still play, but have lost all the tag information, the tag information being replaced with 3 digits, what looks like a y with two dots above it, a b with an abnormally long stick and either a letter or a number at the end. Kath
Post #40
Did you UNZIP the file before trying to run it? If not, unzip it first before running it. If you did, can you try downloading it again and trying it once more.
Post #41
Hi Gary, Tag iformation on MP3's looks very much like this ýþΑ Still no luck with that last program, when it opens there are two boxes each with three lines. Am i putting the search strings in the top box? Thanks Kath
Post #42
Hi Kath,

Yes, both need to be in the top box, the CLSID (the number) on the 1st line, and rjgoitr on the 2nd line.

The programme takes a while to run (usually about 20 mins on my machine, but will vary a bit dependent on how big your registry is) and will not appear to be doing anything.

The log will po-up on your desktop when it's finished.

Let me know if you still have problems with it, and I'll see if there's another way to get the info I'm looking for.
Post #43
Hi Gary, Sorry to drag this out for so long but not been very weel. Have tried to download that last program again and am still unable to run it. Thanks Kath
Post #44
Hi Kath, Sorry to be so late replying, didn't get an auto notification for your last post, then I was away on a ski vacation, so this is my first day back. If you still want help, please send me a new HJT log please, as its been a while and I'd like to see that nothing untoward has infested you since last we talked. Can you also give me a brief resume of how things are with your computer.
Post #45
Hi Gary,
Hope you had a nice time skiing. Here is the HIJACKTHIS log.

Logfile of HijackThis v1.99.1
Scan saved at 14:59:52, on 28/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 3.73\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 3.73\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.21.10/ttinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


Computer appears to be running ok, still the same old problem with the ID tags for MP3's.

Many thanks

Kath

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI