hijack log

Download and run - ATF Cleaner instructions here.
Ues it on all user accounts.

—————————————————–

Download and install AVG Anti-Spyware (ewido). Then scan and post the report here.
Instructions and download link can be found here.

—————————————————–


Run this online scan and post the results here.

I have done what u said and this is the AVG report also with a unknown .dmp file created on my desktop but then when i try to do the online scan with panda my comp gets freezed and i also tried using house call from micro trend but it scan until a certain point the window close itself and nothing happen. cant finish the scan. can it be posible that it is a virus or maybe registry problem. thanks for ur suggestion this problem has bugged me for a whole week already. dr watson debugger error. =.= ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 11:13:06 AM 1/29/2007 + Scan result: C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP558\A0741473.exe -> Adware.AdHelper : Cleaned. C:\WINDOWS\system32\IOTZGM.DLL -> Adware.AdMoke : Cleaned. C:\WINDOWS\system32\NUAGOVBIP.EXE -> Adware.AdMoke : Cleaned. C:\WINDOWS\system32\wbem\okads083.exe -> Adware.AdMoke : Cleaned. C:\Program Files\K-Lite\traffic.core -> Adware.Altnet : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP541\A0718447.dll -> Adware.BHO : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP550\A0731402.dll -> Adware.BHO : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP560\A0742486.exe -> Adware.Cdn : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\hc5.exe/DIYNETSetupUni.exe -> Adware.Dm : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP540\A0717392.sys -> Adware.NewWeb : Cleaned. C:\WINDOWS\system32\SCIntruder.dll -> Adware.NewWeb : Cleaned. C:\WINDOWS\system32\SCIntruder32.dll -> Adware.NewWeb : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/Mouse1.dll.zgx -> Adware.WSearch : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/SearchM.dll.zgx -> Adware.WSearch : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/abhcop.sys -> Adware.WSearch : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/hcalway.sys -> Adware.WSearch : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/mUin.exe -> Adware.WSearch : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/zsearch.exe -> Adware.WSearch : Cleaned. C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\setup.exe/zsup.exe -> Adware.WSearch : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP541\A0717417.dll -> Downloader.QQHelper.ma : Cleaned. C:\WINDOWS\system32\drivers\nwlnksipx.sys -> Hijacker.StartPage.amo : Cleaned. C:\Documents and Settings\Dad\Desktop\PLEASE ORGANISE UR RUBBISH\kz pic\Klick0rv2.zip/Klick0r v2.exe -> Not-A-Virus.Monitor.Win32.Ardamax.20 : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP558\A0741468.exe -> Not-A-Virus.Monitor.Win32.Ardamax.23 : Cleaned. C:\System Volume Information\_restore{4654D00E-ED45-4E04-90A7-F6DDB017D2AC}\RP558\A0741466.exe -> Trojan.QQPass.gs : Cleaned. C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned. C:\WINDOWS\system32\1024\ld6D50.tmp -> Trojan.Small : Cleaned. C:\WINDOWS\system32\1024\ld78D7.tmp -> Trojan.Small : Cleaned. ::Report end

Lets try running combofix.exe
Download it from one of the links below:

http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/combofix.exe

Double click combofix.exe & follow the prompts.
When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

thanks a lot i have solve the problem after i run combofix and also after this i run CleanUP! once to delete all the Internet explorer files. finally i can sleep well but i still dont know what is the problem that cause this. but heres the log from combofix. "Tommy" - 07-01-30 7:39:58 Service Pack 2 ComboFix 07-01-25 - Running from: "C:\Documents and Settings\Tommy\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\32F77AC0.094 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin1.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin10.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin11.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin2.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin3.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin4.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin5.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin6.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin7.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin8.zip C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin9.zip C:\WINDOWS\system32\QWDKSZFLSZ.DLL \Windows\System32\QWDKSZFLSZ.DLL c:\command.com C:\WINDOWS\system32\advport.dll C:\WINDOWS\system32\drivers\acpidisk.sys C:\WINDOWS\system32\guid.vxd C:\WINDOWS\system32\mprmsgse.axz C:\WINDOWS\system32\mscpx32r.det C:\WINDOWS\system32\nt.sys C:\WINDOWS\system32\rundll.exe C:\WINDOWS\system32\scia.dll C:\WINDOWS\system32\Score.txt C:\WINDOWS\system32\wbem\ocmor.dat C:\WINDOWS\system32\wbem\ocmor.dll C:\WINDOWS\system32\wmpdrm.dll C:\DOCUME~1\Tommy\Application Data\Macromedia\Flash Player\#SharedObjects\GRBT64WW\www.inter-focus.cn C:\DOCUME~1\Tommy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.inter-focus.cn C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper C:\Program Files\Common Files\Updat C:\WINDOWS\system32\1116 C:\WINDOWS\system32\mscache C:\WINDOWS\system32\spoolsv C:\WINDOWS\system32\winup C:\\WINDOWS\system32\drivers\jqdbag31.sys C:\WINDOWS\system32\drivers\lsxsvjs.sys C:\WINDOWS\system32\lsxsvjs.dll C:\WINDOWS\system32\drivers\rt_jln.sys C:\WINDOWS\system32\rt_jln.dll C:\WINDOWS\system32\msicn ((((((((((((((((((((((((((((((( Files Created from 2006-12-30 to 2007-01-30 )))))))))))))))))))))))))))))))))) 2007-01-30 07:43 d——– C:\WINDOWS\erdnt 2007-01-30 07:42 d——– C:\WINDOWS\system32\spoolsv 2007-01-30 07:42 d——– C:\WINDOWS\system32\1116 2007-01-29 23:08 d——– C:\WINDOWS\system32\ActiveScan 2007-01-29 18:49 d——– C:\DOCUME~1\ADMINI~1\Application Data\Webroot 2007-01-29 11:15 d——– C:\DOCUME~1\ADMINI~1\Application Data\Lavasoft 2007-01-29 07:26 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-29 07:26 d——– C:\Program Files\Grisoft 2007-01-29 06:26 d——– C:\DOCUME~1\Dad\Application Data\Lavasoft 2007-01-29 03:05 d——– C:\Program Files\MSXML 4.0 2007-01-29 02:29 d——– C:\Program Files\RegScrubXP 2007-01-28 07:38 d——– C:\Program Files\Webroot 2007-01-28 07:38 d——– C:\DOCUME~1\Tommy\Application Data\Webroot 2007-01-28 07:14 d——– C:\Program Files\Lavasoft 2007-01-28 07:14 d——– C:\DOCUME~1\Tommy\Application Data\Lavasoft 2007-01-28 00:32 94,424 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys 2007-01-28 00:32 85,952 –a—— C:\WINDOWS\system32\drivers\aswmon.sys 2007-01-28 00:32 43,176 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys 2007-01-28 00:32 31,560 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys 2007-01-28 00:32 23,352 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys 2007-01-28 00:31 90,112 –a—— C:\WINDOWS\system32\AVASTSS.scr 2007-01-28 00:31 689,280 –a—— C:\WINDOWS\system32\aswBoot.exe 2007-01-28 00:31 d——– C:\Program Files\Alwil Software 2007-01-27 18:10 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys 2007-01-27 18:06 d——– C:\DOCUME~1\Tommy\.housecall6.6 2007-01-27 10:29 d——– C:\DOCUME~1\Dad\Application Data\MEGAUPLOADTOOLBAR 2007-01-26 01:44 d——– C:\Program Files\MegauploadToolbar 2007-01-26 01:44 d——– C:\DOCUME~1\Tommy\Application Data\MegauploadToolbar 2007-01-25 08:01 90,112 –a—— C:\WINDOWS\system32\LQCUI2.dll 2007-01-25 08:01 856,064 –a—— C:\WINDOWS\system32\Ltwvc12n.dll 2007-01-25 08:01 78,336 –a—— C:\WINDOWS\system32\lffax12n.dll 2007-01-25 08:01 466,944 –a—— C:\WINDOWS\system32\QCUI2.dll 2007-01-25 08:01 462,848 –a—— C:\WINDOWS\system32\LCamCpl.dll 2007-01-25 08:01 406,016 –a—— C:\WINDOWS\system32\ltkrn12n.dll 2007-01-25 08:01 328,704 –a—— C:\WINDOWS\system32\LFCMP12n.DLL 2007-01-25 08:01 30,720 –a—— C:\WINDOWS\system32\lfbmp12n.dll 2007-01-25 08:01 259,072 –a—— C:\WINDOWS\system32\LTDIS12n.dll 2007-01-25 08:01 215,552 –a—— C:\WINDOWS\system32\Lvkrn12n.dll 2007-01-25 08:01 207,872 –a—— C:\WINDOWS\system32\ltefx12n.dll 2007-01-25 08:01 164,864 –a—— C:\WINDOWS\system32\ltimg12n.dll 2007-01-25 08:01 141,312 –a—— C:\WINDOWS\system32\lftif12n.dll 2007-01-25 08:01 131,072 –a—— C:\WINDOWS\system32\ltfil12n.DLL 2007-01-25 07:51 221,184 –a—— C:\WINDOWS\system32\wmpns.dll 2007-01-25 02:54 d——– C:\Program Files\Windows Media Connect 2 2007-01-25 02:44 d——– C:\WINDOWS\system32\drivers\UMDF 2007-01-24 04:07 53,248 –a—— C:\WINDOWS\rmvpeye.exe 2007-01-24 04:07 102,400 –a—— C:\WINDOWS\mmvem.exe 2007-01-24 04:07 102,400 –a—— C:\WINDOWS\japi.dll 2007-01-23 08:31 57,344 –a—— C:\WINDOWS\system32\VFWUI.dll 2007-01-23 08:31 123,052 –a—— C:\WINDOWS\system32\drivers\pfc027.sys 2007-01-22 05:42 69 –a—— C:\WINDOWS\system32\LRWCKQXD.DLL 2007-01-22 05:42 36 –a—— C:\WINDOWS\system32\QVCHPWDIP.DLL 2007-01-22 05:42 1,297 –a—— C:\WINDOWS\system32\iP1kP0w7.dll 2007-01-15 18:05 134,878 –a—— C:\WINDOWS\system32\drivers\dump_wmimmc.sys 2007-01-08 19:39 11,776 –a—— C:\WINDOWS\system\Mvvp.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-30 00:09 ——– d——– C:\Program Files\spyware doctor 2007-01-30 00:08 ——– d——– C:\Program Files\msn messenger 2007-01-30 00:08 ——– d——– C:\Program Files\itunes 2007-01-29 11:12 ——– d——– C:\Program Files\k-lite 2007-01-28 22:43 ——– d–h—– C:\Program Files\installshield installation information 2007-01-28 22:20 ——– d——– C:\Documents and Settings\Tommy\Application Data\adobe 2007-01-28 07:38 ——– d——– C:\Documents and Settings\Tommy\Application Data\webroot 2007-01-28 07:14 ——– d——– C:\Documents and Settings\Tommy\Application Data\lavasoft 2007-01-28 00:08 ——– d——– C:\Program Files\Common Files\symantec shared 2007-01-28 00:00 ——– d——– C:\Program Files\norton antivirus 2007-01-26 04:32 ——– d——– C:\Documents and Settings\Tommy\Application Data\megauploadtoolbar 2007-01-25 18:32 ——– d——– C:\Program Files\regsupreme 2007-01-25 08:01 ——– d——– C:\Program Files\Common Files\logitech 2007-01-24 17:58 ——– d——– C:\Program Files\yahoo! 2007-01-24 03:35 9744 –a—— C:\Documents and Settings\Tommy\Application Data\catspy.log 2007-01-23 05:32 ——– d——– C:\Program Files\vimicro 2007-01-19 14:57 180224 –a—— C:\WINDOWS\system32\wmpdrm.dll 2006-12-21 14:08 ——– d——– C:\Program Files\java 2006-12-13 00:48 ——– d——– C:\Program Files\njstar communicator 2006-12-07 13:29 2374472 –a—— C:\WINDOWS\system32\wmvcore.dll 2006-11-08 13:06 679424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-11-04 14:14 1245696 –a—— C:\WINDOWS\system32\msxml4.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "nwiz"="nwiz.exe /install" "MPTBox"="C:\\PROGRA~1\\Canon\\MULTIP~1\\MPTBOX.EXE" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "BigDogPath"="C:\\WINDOWS\\VM_STI.EXE VIMICRO USB PC Camera" "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "CoolSwitch"="C:\\WINDOWS\\system32\\taskswitch.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "dfsf"="RUNDLL32.EXE C:\\WINDOWS\\system\\Mvvp.dll,DImmcv" "spoolsv"="C:\\WINDOWS\\system32\\spoolsv\\spoolsv.exe -printer" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "qvmn_p"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\ 5c,72,75,6e,64,6c,6c,33,32,2e,65,78,65,20,25,73,79,73,74,65,6d,72,6f,6f,74,\ 25,5c,73,79,73,74,65,6d,33,32,5c,71,76,6d,6e,5f,70,2e,64,6c,6c,2c,52,75,6e,\ 00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "RunNarrator"="Narrator.exe" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] "RunNarrator"="Narrator.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ares"="\"C:\\Program Files\\Ares\\Ares.exe\" -h" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "spoolsv"="C:\\WINDOWS\\system32\\spoolsv\\spoolsv.exe -printer" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "res"="c:\\windows\\system32\\res.exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{35a88e51-b53d-43e9-b8a7-75d4c31b4676}"="Register LogWare" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSharedDocuments"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 Usnsvc REG_MULTI_SZ usnsvc\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* Tech Completion time: 07-01-30 8:21:57

Well it is looking better can you run panda scan now? Post a new log from hijackthis when done.

this is the save log in panda scan… what shud i do nxt ? Incident Status Location Adware:adware/ourxin Not disinfected c:\windows\system32\wmpdrm.dll Adware:adware/securityerror Not disinfected Windows Registry

Download The Avenger Copyright © Swandog46
You must extract avenger.exe to your desktop, before you run it.
The Avenger must be run from a user account with administrator privileges,
and ONLY works on Windows 2000 and XP, and only on 32-bit versions!

Copy all the text contained in the code box below to your Clipboard.

Files to delete:
C:\WINDOWS\system\Mvvp.dll
c:\windows\system32\wmpdrm.dll

The above script is for this user only, if you need help please start your own thread.

Start the Avenger.
Under "Script file to execute" choose "Input Script Manually".
Click on the Magnifying Glass icon which will open a new window titled "View/edit script".
Paste the entire text in into this window.
Click done, now click on the Green Light
Answer "Yes" twice when prompted.
Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.

After the restart, it will create a log file that should open.
This log file will be located at C:\avenger.txt
Paste the contents of the file into your reply along with a fresh HJT log.

Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.


Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.

O4 - HKLM\..\Run: [dfsf] RUNDLL32.EXE C:\WINDOWS\system\Mvvp.dll,DImmcv

Run this online scan and post the results here.

here is the scan sorry for being late not around for a while. after the scan i still find some spywares in it.. but my problem was solved.. Incident Status Location Adware:adware/ourxin Not disinfected c:\windows\system32\spoolsv Adware:adware/securityerror Not disinfected Windows Registry Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Tommy\Cookies\tommy@com[1].txt

Download BlackLight Run it and post the results here.


BlackLight Screenshots

nothing was found =]

Reboot in safe mode, instructions here.
Some of these files my have hidden atributes.
Click Here Should you need instructions for Showing hidden files and folders in Windows.
Once in safe mode, Click start / then my computer / local disk then follow the process tree.
Or using Windows Explorer, locate the first file right click then select delete.

Delete the following file(s) listed in bold.
c:\windows\system32\spoolsv