HijackThis log

I have a friend who is not computer savy and is quite a distance from me so I have connected to him with Himachi and remote desktop and have retrived this log. His machine is now very slow and sluggish and has had some very strange happenings, settings changed and trouble recieving email in outlook etc. Any help would be greatly appreciated.
Thank you

1Techwreck

Logfile of HijackThis v1.99.1
Scan saved at 4:41:49 PM, on 2/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\Symantec AntiVirus\DefWatch.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\system32\fxssvc.exe
E:\WINDOWS\system32\WgaTray.exe
E:\Program Files\Creative\ShareDLL\CtNotify.exe
E:\PROGRA~1\SYMANT~1\VPTray.exe
E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
E:\WINDOWS\SM1BG.EXE
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Creative\ShareDLL\MediaDet.Exe
E:\Program Files\HP\HP Software Update\HPWuSchd2.exe
E:\WINDOWS\system32\winsystems16.exe
E:\PROGRA~1\Webshots\webshots.scr
E:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
E:\Program Files\Hamachi\hamachi.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\logonui.exe
E:\WINDOWS\system32\rdpclip.exe
E:\WINDOWS\system32\logon.scr
E:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
E:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
E:\Documents and Settings\Jack\Desktop\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {B528C6CC-AA98-4753-8980-A6B97A220A63} - E:\WINDOWS\system32\ddcyyya.dll (file missing)
O2 - BHO: (no name) - {CB6B9F94-6AB9-45C5-8CA0-874DDCC87844} - (no file)
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] E:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SSC_UserPrompt] E:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [AnyDVD] E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [SM1BG] E:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [ctfmon] C:\WINDOWS\system32\dlg\ctfmon.exe
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WinSystems] E:\WINDOWS\system32\winsystems16.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "E:\WINDOWS\system32\xbiorcff.dll",setvm
O4 - HKLM\..\RunServices: [WinSystems] E:\WINDOWS\system32\winsystems16.exe
O4 - Startup: Webshots.lnk = E:\Program Files\Webshots\Launcher.exe
O4 - Startup: Introducing Media Manager.lnk = E:\Program Files\Common Files\Microsoft Shared\Media Manager\SPLASHA.EXE
O4 - Startup: BitTorrent.lnk = E:\Program Files\BitTorrent\bittorrent.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = E:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .qt: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120753701497
O17 - HKLM\System\CCS\Services\Tcpip\..\{05FDA58A-708F-4A5A-BBD5-4C7D766B2697}: NameServer = 209.244.0.3 209.244.0.4
O17 - HKLM\System\CS2\Services\Tcpip\..\{05FDA58A-708F-4A5A-BBD5-4C7D766B2697}: NameServer = 209.244.0.3 209.244.0.4
O20 - Winlogon Notify: NavLogon - E:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: vtsqo - E:\WINDOWS\system32\vtsqo.dll (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Windows lsass Service (lsass) - Unknown owner - E:\WINDOWS\lsass.exe (file missing)
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - E:\WINDOWS\wkssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe

1Techwreck

Welcome to Tom Coyote . Sorry about the delay in responding but we are as most times just overwhelmed with logs.

Your friend has a few nasty programs going on, this is what we need to do first.

Download SDFix and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

In Safe Mode, right click the SDFix.zip folder and choose Extract All,
Open the extracted folder and double click RunThis.bat to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log

Post the report and a New HJT log please.

✨ Ask AI

Ask AI