What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Regedit closes seconds after opening

28 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
What needs removed?

Logfile of HijackThis v1.99.1
Scan saved at 1:56:34 PM, on 2/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D4\D4.exe
C:\Program Files\Common Files\AOL\1137510455\ee\AOLSoftware.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Documents and Settings\jtyo.ABC\Desktop\HijackTh\HijackThi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 spywareinfo.com
O1 - Hosts: 1.1.1.1 www.spywareinfo.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137510455\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\jtyo.ABC\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol…scueControl.cab
O16 - DPF: {2DE0C501-4D2A-11D4-BA31-0008C7F472F4} (EposOperations Control) - http://enc01pe/Encore/ActiveX/eposOperations.cab
O16 - DPF: {32998E04-50FF-11D4-BA34-0008C7F472F4} (EposReports Control) - http://enc01pe/Encore/ActiveX/eposReports.cab
O16 - DPF: {3527C5BD-4A46-4362-94B6-12341D087A4B} - http://epitonic.echospin.com/wizard/files/esWizard.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {40C52972-E535-42A0-9D3B-BC76217E63D9} (eposVerCtl Class) - http://enc01pe/Encore/ActiveX/eposVersionCtl.cab
O16 - DPF: {47D39363-D193-47EA-8A75-41144B099491} (EposHostView Control) - http://enc01pe/Encore/ActiveX/eposHostView.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - https://coe.amerisourcebergen.com/coeweb/bin/iftwclix.cab
O16 - DPF: {594EF4A4-50F2-11D4-BA34-0008C7F472F4} (EposLogTrace Control) - http://enc01pe/Encore/ActiveX/eposLogTrace.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128516497793
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1134502063005
O16 - DPF: {7BEA4D18-62F2-11D4-9917-00010233DC97} (EposEDBFormCtl Control) - http://enc01pe/Encore/ActiveX/eposEDBFormCtl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.airport-nuernberg.de/_/tools/AxisCamControl.cab
O16 - DPF: {94811A83-D5BA-46D3-96AF-BC94B9C311EB} (EposHelpMenu Control) - http://enc01pe/Encore/ActiveX/EposHelpMenu.cab
O16 - DPF: {96556AA0-4325-11d5-8AA7-006008A71E67} (ROAM Help) - http://enc01pe/Encore/ActiveX/ROAMUser.cab
O16 - DPF: {97A789C6-8C70-11D3-B390-006008A71FAA} (EposACCA Control) - http://enc01pe/Encore/ActiveX/eposACCA.cab
O16 - DPF: {A44B2DE3-7AD0-42A8-B428-E44283B3973E} (EposDisplay Control) - http://enc01pe/Encore/ActiveX/eposDisplay.cab
O16 - DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} (Desktop.Smdesk) - http://www.servicemagic.com/smod/smdesktop.CAB
O16 - DPF: {A9699323-B893-4DE4-8A77-35167ECFFDD7} (EposMaintenance Control) - http://enc01pe/Encore/ActiveX/EposMaintenance.cab
O16 - DPF: {B213E7A3-9E5D-4B42-9091-7A913D2D7A59} (EposFileDown Control) - http://enc01pe/Encore/ActiveX/EposFileDown.cab
O16 - DPF: {C55910F4-2EC6-404F-8545-476CA94E7503} (eposHelpViewer Class) - http://enc01pe/Encore/ActiveX/eposHelpView.cab
O16 - DPF: {C7442243-FAEC-46AF-8157-E1736636C037} (eposDBMaintenance Control) - http://enc01pe/Encore/ActiveX/eposDBMaintenance.cab
O16 - DPF: {C8671BE3-53EA-4460-A830-4C508F09EA19} (EposLog Control) - http://enc01pe/Encore/ActiveX/eposLog.cab
O16 - DPF: {D2BBE042-8152-4B0B-9674-9A7292B83355} (EncSetupCtl Class) - http://enc01pe/Encore/ActiveX/eposActiveSetup.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = abc.local
O17 - HKLM\Software\..\Telephony: DomainName = abc.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = abc.local
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Client Access Express Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #2
Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
  • Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
  • Click on Tools, General Settings.
  • Under Real-time protection options, unselect the Turn on real-time protection check box
  • Click Save
After all of the fixes are complete it is very important that you enable Real-time Protection again.

Scan with HijackThis. Place a check against each of the following:
Check all the O1 - Hosts: 1.1.1.1 entries

Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit.
  • Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update AVG Anti-spyware.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      [external image: Posted Image]
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
______________________________

Please post:
  • AVG Anti-spyware log
  • A new HijackThis log
Your may need several replies to post the requested logs, otherwise they might get cut off.
Post #3
——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 3:12:57 PM 2/8/2007 + Scan result: E:\data -> Downloader.IstBar.kc : Cleaned with backup (quarantined). F:\data -> Downloader.IstBar.kc : Cleaned with backup (quarantined). E:\WINDOWS\Cookies\jtyo@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned. E:\WINDOWS\Cookies\jtyo@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. E:\WINDOWS\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Burstbeacon : Cleaned. F:\Documents and Settings\jtyo\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned. E:\WINDOWS\Cookies\jtyo@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. E:\WINDOWS\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned. F:\Documents and Settings\jtyo\Cookies\jtyo@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. E:\WINDOWS\Cookies\jtyo@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. E:\WINDOWS\Cookies\jtyo@com[1].txt -> TrackingCookie.Com : Cleaned. E:\WINDOWS\Cookies\jtyo@com[3].txt -> TrackingCookie.Com : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Com : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Com : Cleaned. F:\Documents and Settings\jtyo\Cookies\jtyo@com[2].txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned. E:\WINDOWS\Cookies\jtyo@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned. E:\WINDOWS\Cookies\[removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned. E:\WINDOWS\Cookies\[removed][3].txt -> TrackingCookie.Overture : Cleaned. E:\WINDOWS\Cookies\[removed][1].txt -> TrackingCookie.Realmedia : Cleaned. F:\Documents and Settings\jtyo\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned. E:\WINDOWS\Cookies\jtyo@edge.ru4[3].txt -> TrackingCookie.Ru4 : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned. E:\WINDOWS\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned. F:\Documents and Settings\jtyo\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\jtyo@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned. E:\WINDOWS\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\jtyo@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\jtyo.ABC\Cookies\jtyo@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned. F:\Documents and Settings\jtyo\Cookies\[removed][2].txt -> TrackingCookie.Tribalfusion : Cleaned. E:\WINDOWS\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end
Post #4
Logfile of HijackThis v1.99.1
Scan saved at 11:40:38 AM, on 2/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D4\D4.exe
C:\Program Files\Common Files\AOL\1137510455\ee\AOLSoftware.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jtyo.ABC\Desktop\HijackTh\HijackThi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 spywareinfo.com
O1 - Hosts: 1.1.1.1 www.spywareinfo.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 services.google.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137510455\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\jtyo.ABC\Desktop\HijackTh\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\jtyo.ABC\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol…scueControl.cab
O16 - DPF: {2DE0C501-4D2A-11D4-BA31-0008C7F472F4} (EposOperations Control) - http://enc01pe/Encore/ActiveX/eposOperations.cab
O16 - DPF: {32998E04-50FF-11D4-BA34-0008C7F472F4} (EposReports Control) - http://enc01pe/Encore/ActiveX/eposReports.cab
O16 - DPF: {3527C5BD-4A46-4362-94B6-12341D087A4B} - http://epitonic.echospin.com/wizard/files/esWizard.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {40C52972-E535-42A0-9D3B-BC76217E63D9} (eposVerCtl Class) - http://enc01pe/Encore/ActiveX/eposVersionCtl.cab
O16 - DPF: {47D39363-D193-47EA-8A75-41144B099491} (EposHostView Control) - http://enc01pe/Encore/ActiveX/eposHostView.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - https://coe.amerisourcebergen.com/coeweb/bin/iftwclix.cab
O16 - DPF: {594EF4A4-50F2-11D4-BA34-0008C7F472F4} (EposLogTrace Control) - http://enc01pe/Encore/ActiveX/eposLogTrace.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128516497793
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1134502063005
O16 - DPF: {7BEA4D18-62F2-11D4-9917-00010233DC97} (EposEDBFormCtl Control) - http://enc01pe/Encore/ActiveX/eposEDBFormCtl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.airport-nuernberg.de/_/tools/AxisCamControl.cab
O16 - DPF: {94811A83-D5BA-46D3-96AF-BC94B9C311EB} (EposHelpMenu Control) - http://enc01pe/Encore/ActiveX/EposHelpMenu.cab
O16 - DPF: {96556AA0-4325-11d5-8AA7-006008A71E67} (ROAM Help) - http://enc01pe/Encore/ActiveX/ROAMUser.cab
O16 - DPF: {97A789C6-8C70-11D3-B390-006008A71FAA} (EposACCA Control) - http://enc01pe/Encore/ActiveX/eposACCA.cab
O16 - DPF: {A44B2DE3-7AD0-42A8-B428-E44283B3973E} (EposDisplay Control) - http://enc01pe/Encore/ActiveX/eposDisplay.cab
O16 - DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} (Desktop.Smdesk) - http://www.servicemagic.com/smod/smdesktop.CAB
O16 - DPF: {A9699323-B893-4DE4-8A77-35167ECFFDD7} (EposMaintenance Control) - http://enc01pe/Encore/ActiveX/EposMaintenance.cab
O16 - DPF: {B213E7A3-9E5D-4B42-9091-7A913D2D7A59} (EposFileDown Control) - http://enc01pe/Encore/ActiveX/EposFileDown.cab
O16 - DPF: {C55910F4-2EC6-404F-8545-476CA94E7503} (eposHelpViewer Class) - http://enc01pe/Encore/ActiveX/eposHelpView.cab
O16 - DPF: {C7442243-FAEC-46AF-8157-E1736636C037} (eposDBMaintenance Control) - http://enc01pe/Encore/ActiveX/eposDBMaintenance.cab
O16 - DPF: {C8671BE3-53EA-4460-A830-4C508F09EA19} (EposLog Control) - http://enc01pe/Encore/ActiveX/eposLog.cab
O16 - DPF: {D2BBE042-8152-4B0B-9674-9A7292B83355} (EncSetupCtl Class) - http://enc01pe/Encore/ActiveX/eposActiveSetup.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = abc.local
O17 - HKLM\Software\..\Telephony: DomainName = abc.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = abc.local
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Client Access Express Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #5
HostsXpert

Please download HoxtXpert.
  • Unzip HostXpert.zip
  • Open HostXpert.exe.
  • Then click on "Restore Original Hosts"
  • Close program when complete.
  • Empty Recycle Bin
Reboot please post (reply) with a fresh hijackthis log. Let me know how your computer is running.
Post #6
Logfile of HijackThis v1.99.1
Scan saved at 6:14:10 PM, on 2/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cbynuh\winlogon.exe
C:\Program Files\D4\D4.exe
C:\Program Files\Common Files\AOL\1137510455\ee\AOLSoftware.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\MESSEN~1\Msmsgs.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Personal Communications\pcsws.exe
C:\Program Files\Personal Communications\PCSCM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jtyo.ABC\Desktop\HijackTh\HijackThi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
F3 - REG:win.ini: load=C:\WINDOWS\system32\cbynuh\winlogon.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\cbynuh\winlogon.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137510455\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: winlogon.lnk = ?
O8 - Extra context menu item: Add Feed to Tristana RSS Reader - res://C:\Program Files\Tristana RSS Reader\Reader.exe/AddContent.js
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\jtyo.ABC\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol…scueControl.cab
O16 - DPF: {2DE0C501-4D2A-11D4-BA31-0008C7F472F4} (EposOperations Control) - http://enc01pe/Encore/ActiveX/eposOperations.cab
O16 - DPF: {32998E04-50FF-11D4-BA34-0008C7F472F4} (EposReports Control) - http://enc01pe/Encore/ActiveX/eposReports.cab
O16 - DPF: {3527C5BD-4A46-4362-94B6-12341D087A4B} - http://epitonic.echospin.com/wizard/files/esWizard.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {40C52972-E535-42A0-9D3B-BC76217E63D9} (eposVerCtl Class) - http://enc01pe/Encore/ActiveX/eposVersionCtl.cab
O16 - DPF: {47D39363-D193-47EA-8A75-41144B099491} (EposHostView Control) - http://enc01pe/Encore/ActiveX/eposHostView.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - https://coe.amerisourcebergen.com/coeweb/bin/iftwclix.cab
O16 - DPF: {594EF4A4-50F2-11D4-BA34-0008C7F472F4} (EposLogTrace Control) - http://enc01pe/Encore/ActiveX/eposLogTrace.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128516497793
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1134502063005
O16 - DPF: {7BEA4D18-62F2-11D4-9917-00010233DC97} (EposEDBFormCtl Control) - http://enc01pe/Encore/ActiveX/eposEDBFormCtl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.airport-nuernberg.de/_/tools/AxisCamControl.cab
O16 - DPF: {94811A83-D5BA-46D3-96AF-BC94B9C311EB} (EposHelpMenu Control) - http://enc01pe/Encore/ActiveX/EposHelpMenu.cab
O16 - DPF: {96556AA0-4325-11d5-8AA7-006008A71E67} (ROAM Help) - http://enc01pe/Encore/ActiveX/ROAMUser.cab
O16 - DPF: {97A789C6-8C70-11D3-B390-006008A71FAA} (EposACCA Control) - http://enc01pe/Encore/ActiveX/eposACCA.cab
O16 - DPF: {A44B2DE3-7AD0-42A8-B428-E44283B3973E} (EposDisplay Control) - http://enc01pe/Encore/ActiveX/eposDisplay.cab
O16 - DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} (Desktop.Smdesk) - http://www.servicemagic.com/smod/smdesktop.CAB
O16 - DPF: {A9699323-B893-4DE4-8A77-35167ECFFDD7} (EposMaintenance Control) - http://enc01pe/Encore/ActiveX/EposMaintenance.cab
O16 - DPF: {B213E7A3-9E5D-4B42-9091-7A913D2D7A59} (EposFileDown Control) - http://enc01pe/Encore/ActiveX/EposFileDown.cab
O16 - DPF: {C55910F4-2EC6-404F-8545-476CA94E7503} (eposHelpViewer Class) - http://enc01pe/Encore/ActiveX/eposHelpView.cab
O16 - DPF: {C7442243-FAEC-46AF-8157-E1736636C037} (eposDBMaintenance Control) - http://enc01pe/Encore/ActiveX/eposDBMaintenance.cab
O16 - DPF: {C8671BE3-53EA-4460-A830-4C508F09EA19} (EposLog Control) - http://enc01pe/Encore/ActiveX/eposLog.cab
O16 - DPF: {D2BBE042-8152-4B0B-9674-9A7292B83355} (EncSetupCtl Class) - http://enc01pe/Encore/ActiveX/eposActiveSetup.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = abc.local
O17 - HKLM\Software\..\Telephony: DomainName = abc.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = abc.local
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Client Access Express Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #7
I STILL CAN NOT SEEM TO OPEN MSCONFIG OR REGEDIT WITHOUT EITHER OF THEM CLOSING IN A MATTER OF SECONDS… I DONT GET IT… EVEN IF I ATTEMPT TO RUN HIJACKTHIS OR READ THE LOG FILE, THEY ALSO CLOSE….. HOWEVER… IF I RENAME THE LOG FILE .. IT OPENS SUCCESSFULLY AND IT DOES NOT CLOSE………… WHAT IN THE WORLD?? AND IM SUPPOSED TO BE A TECH SUPPORT AGENT. HEHE
Post #8
http://www.auditmysoftware.com/process/pcsws

Pcsws.exe is part of PCOMM and enables a non IBM server computer to start/create a connection profile that is used to create a session on an IBM server. Personal Comunications (PCOMM) is family of software that enables connections from other operatings systems (DOS, Windows, OS2, …) to an IBM Server.


This entry showed up in your latest hijackthis log. Are you using this computer to connect to an IBM server?
C:\Program Files\Personal Communications\pcsws.exe

======
Combofix
  • Download this file - combofix.exe
  • Double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.
  • Download GMER and extract it to the C:\program files\GMER folder.
  • Please rename the GMER file
    Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
    Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
    You may be prompted to scan immediately if GMER detects rootkit activity.
  • If you are prompted to scan your system click "yes" to begin the scan.
  • If you are not prompted, Click the "Rootkit" tab, then click "Scan".
DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
  • Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
  • Click on Tools, General Settings.
  • Under Real-time protection options, unselect the Turn on real-time protection check box
  • Click Save
After all of the fixes are complete it is very important that you enable Real-time Protection again.

Scan with HijackThis. Place a check against each of the following:
F3 - REG:win.ini: load=C:\WINDOWS\system32\cbynuh\winlogon.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\cbynuh\winlogon.exe
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Please post (reply) with the ComboFix log, the results from the GMER scan, and a fresh hijackthis log.

Please let me know about the Pcsws.exe application.
Post #9
yes, i use ibm personal communications to connect to an AS400. i work in a call center for tech support… imagin that… smile…
Post #10
"jtyo" - 07-02-09 14:11:53 Service Pack 2
ComboFix 07-02-08.2 - Running from: "C:\Documents and Settings\jtyo.ABC\Desktop\New Folder"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\cbynuh\winlogon.exe
C:\WINDOWS\system32\cbynuh\winlogon.ini
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\Downloaded Program Files\Temp


((((((((((((((((((((((((((((((( Files Created from 2007-01-09 to 2007-02-09 ))))))))))))))))))))))))))))))))))


2007-02-09 13:44 d——– C:\Program Files\GMER folder
2007-02-08 18:04 d——– C:\Program Files\SpywareBlaster
2007-02-08 11:55 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-02-08 11:55 d——– C:\Program Files\Grisoft
2007-02-07 09:01 d——– C:\DOCUME~1\ADMINI~1\Application Data\Lavasoft
2007-02-06 15:17 d——– C:\Program Files\CCleaner
2007-02-05 17:29 d——– C:\Program Files\Lavasoft
2007-02-05 17:29 d——– C:\DOCUME~1\jtyo.ABC\Application Data\Lavasoft
2007-02-05 17:23 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy
2007-02-05 10:54 48,816 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2007-02-05 10:54 110,256 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-02-05 10:53 d——– C:\Program Files\Symantec
2007-02-05 10:53 d——– C:\Program Files\Common Files\Symantec Shared
2007-02-01 13:57 538 –a—— C:\DOCUME~1\jtyo.ABC\Application Data\internaldb8467.dat
2007-02-01 13:57 374 –a—— C:\DOCUME~1\jtyo.ABC\Application Data\internaldb6334.dat
2007-02-01 13:57 18,432 –a—— C:\DOCUME~1\jtyo.ABC\Application Data\internaldb41.dat
2007-02-01 13:57 139,264 –a—— C:\WINDOWS\mirar_distro_876260.exe
2007-02-01 08:45 d–hs—- C:\WINDOWS\system32\cbynuh
2007-01-19 08:00 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Adobe
2007-01-18 14:40 d——– C:\DOCUME~1\jtyo.ABC\Application Data\Viewpoint
2007-01-15 07:50 d——– C:\DOCUME~1\jtyo.ABC\Application Data\OfficeUpdate12
2007-01-11 10:34 d——– C:\ECHOS Setup


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-02-09 11:15 ——– d——– C:\Program Files\personal communications
2007-02-05 17:05 ——– d——– C:\Program Files\logmein rescue
2007-02-05 10:53 ——– d——– C:\Program Files\symantec antivirus
2007-02-05 09:46 ——– d——– C:\Program Files\morpheus
2007-02-01 15:10 ——– d——– C:\DOCUME~1\jtyo.ABC\Application Data\limewire
2007-02-01 13:21 ——– d——– C:\Program Files\java
2007-02-01 08:50 359808 –a—— C:\WINDOWS\system32\drivers\tcpip.sys
2007-01-30 10:32 ——– d–h—– C:\Program Files\installshield installation information
2007-01-19 07:45 ——– d——– C:\DOCUME~1\jtyo.ABC\Application Data\adobeum
2006-12-28 07:35 ——– d——– C:\Program Files\winamp
2006-12-26 07:45 ——– d——– C:\Program Files\Common Files\aol
2006-12-22 11:02 ——– d——– C:\Program Files\Common Files\adobe
2006-12-15 08:19 ——– d——– C:\Program Files\aim6
2006-12-07 01:40 2362184 –a—— C:\WINDOWS\system32\wmvcore.dll
2006-11-16 19:47 524288 –a—— C:\WINDOWS\opuc.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Communicator"="\"C:\\Program Files\\Microsoft Office Communicator\\Communicator.exe\""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Dimension4"="C:\\Program Files\\D4\\D4.exe"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jtyo.ABC^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
"path"="C:\\Documents and Settings\\jtyo.ABC\\Start Menu\\Programs\\Startup\\LimeWire On Startup.lnk"
"backup"="C:\\WINDOWS\\pss\\LimeWire On Startup.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\LimeWire\\LimeWire.exe -startup"
"item"="LimeWire On Startup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Check Version]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cwbckver"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\IBM\\Client Access\\cwbckver.exe\" LOGIN"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Express Welcome]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cwbwlwiz"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\IBM\\Client Access\\cwbwlwiz.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Help Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cwbinhlp"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\IBM\\Client Access\\cwbinhlp.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Service]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cwbsvstr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\IBM\\Client Access\\cwbsvstr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="gcasServ"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AOLSoftware"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\AOL\\1137510455\\ee\\AOLSoftware.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="issch"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DrgToDsc"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Roxio\\Easy Media Creator 7\\Drag to Disc\\DrgToDsc.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SM1BG"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\SM1BG.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MSASCui"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"inimapping"="0"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\defrag.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\RoxioUpdator.job


********************************************************************

catchme 0.1 W2K/XP - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-02-09 14:13:14
Post #11
Thanks, I look forward to seeing the logs. I had not seen the pscws entry before in a log so I wanted to make check about it. If you had replied that you did not know anything about connecting to an IBM server, I would have been very concerned. When we got rid of those host entries, these showed up in the hijackthis log. F3 - REG:win.ini: load=C:\WINDOWS\system32\cbynuh\winlogon.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\cbynuh\winlogon.exe
Post #12
GMER 1.0.12.12027 - http://www.gmer.net
Rootkit scan 2007-02-09 14:40:00
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.12 —-

SSDT 89A5CCF8 ZwAlertResumeThread
SSDT 89A5B680 ZwAlertThread
SSDT 89993BF8 ZwAllocateVirtualMemory
SSDT 89A3FCC8 ZwConnectPort
SSDT 89A60088 ZwCreateMutant
SSDT 89993D30 ZwCreateThread
SSDT 899DC530 ZwFreeVirtualMemory
SSDT 89A5F658 ZwImpersonateAnonymousToken
SSDT 89A5EE00 ZwImpersonateThread
SSDT 89993858 ZwMapViewOfSection
SSDT 89A60C70 ZwOpenEvent
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess
SSDT 899DBE40 ZwOpenProcessToken
SSDT 899DD638 ZwOpenThreadToken
SSDT 899D6C48 ZwResumeThread
SSDT 899DE080 ZwSetContextThread
SSDT 899DD560 ZwSetInformationProcess
SSDT 899DF8E8 ZwSetInformationThread
SSDT 89A61290 ZwSuspendProcess
SSDT 898E2118 ZwSuspendThread
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess
SSDT 899E20C0 ZwTerminateThread
SSDT 899DC608 ZwUnmapViewOfSection
SSDT 89993410 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.12 —-

.text ntoskrnl.exe!_abnormal_termination + F9 804E2755 3 Bytes [ 00, A6, 89 ]

—- EOF - GMER 1.0.12 —-
Post #13 last edited
Please post (reply) with another hijackthis log. It appears that ComboFix deleted those files but I would like to check the hijackthis log please.
Post #14
Logfile of HijackThis v1.99.1
Scan saved at 16:38, on 07-02-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D4\D4.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec AntiVirus\vpc32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Personal Communications\pcsws.exe
C:\Program Files\Personal Communications\PCSCM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jtyo.ABC\Desktop\junk\HijackTh\Hi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add Feed to Tristana RSS Reader - res://C:\Program Files\Tristana RSS Reader\Reader.exe/AddContent.js
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\jtyo.ABC\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol…scueControl.cab
O16 - DPF: {2DE0C501-4D2A-11D4-BA31-0008C7F472F4} (EposOperations Control) - http://enc01pe/Encore/ActiveX/eposOperations.cab
O16 - DPF: {32998E04-50FF-11D4-BA34-0008C7F472F4} (EposReports Control) - http://enc01pe/Encore/ActiveX/eposReports.cab
O16 - DPF: {3527C5BD-4A46-4362-94B6-12341D087A4B} - http://epitonic.echospin.com/wizard/files/esWizard.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {40C52972-E535-42A0-9D3B-BC76217E63D9} (eposVerCtl Class) - http://enc01pe/Encore/ActiveX/eposVersionCtl.cab
O16 - DPF: {47D39363-D193-47EA-8A75-41144B099491} (EposHostView Control) - http://enc01pe/Encore/ActiveX/eposHostView.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - https://coe.amerisourcebergen.com/coeweb/bin/iftwclix.cab
O16 - DPF: {594EF4A4-50F2-11D4-BA34-0008C7F472F4} (EposLogTrace Control) - http://enc01pe/Encore/ActiveX/eposLogTrace.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1128516497793
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1134502063005
O16 - DPF: {7BEA4D18-62F2-11D4-9917-00010233DC97} (EposEDBFormCtl Control) - http://enc01pe/Encore/ActiveX/eposEDBFormCtl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.airport-nuernberg.de/_/tools/AxisCamControl.cab
O16 - DPF: {94811A83-D5BA-46D3-96AF-BC94B9C311EB} (EposHelpMenu Control) - http://enc01pe/Encore/ActiveX/EposHelpMenu.cab
O16 - DPF: {96556AA0-4325-11d5-8AA7-006008A71E67} (ROAM Help) - http://enc01pe/Encore/ActiveX/ROAMUser.cab
O16 - DPF: {97A789C6-8C70-11D3-B390-006008A71FAA} (EposACCA Control) - http://enc01pe/Encore/ActiveX/eposACCA.cab
O16 - DPF: {A44B2DE3-7AD0-42A8-B428-E44283B3973E} (EposDisplay Control) - http://enc01pe/Encore/ActiveX/eposDisplay.cab
O16 - DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} (Desktop.Smdesk) - http://www.servicemagic.com/smod/smdesktop.CAB
O16 - DPF: {A9699323-B893-4DE4-8A77-35167ECFFDD7} (EposMaintenance Control) - http://enc01pe/Encore/ActiveX/EposMaintenance.cab
O16 - DPF: {B213E7A3-9E5D-4B42-9091-7A913D2D7A59} (EposFileDown Control) - http://enc01pe/Encore/ActiveX/EposFileDown.cab
O16 - DPF: {C55910F4-2EC6-404F-8545-476CA94E7503} (eposHelpViewer Class) - http://enc01pe/Encore/ActiveX/eposHelpView.cab
O16 - DPF: {C7442243-FAEC-46AF-8157-E1736636C037} (eposDBMaintenance Control) - http://enc01pe/Encore/ActiveX/eposDBMaintenance.cab
O16 - DPF: {C8671BE3-53EA-4460-A830-4C508F09EA19} (EposLog Control) - http://enc01pe/Encore/ActiveX/eposLog.cab
O16 - DPF: {D2BBE042-8152-4B0B-9674-9A7292B83355} (EncSetupCtl Class) - http://enc01pe/Encore/ActiveX/eposActiveSetup.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = abc.local
O17 - HKLM\Software\..\Telephony: DomainName = abc.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = abc.local
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Client Access Express Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #15
======
Please show all files for your system.
You will need to reverse this process when all steps are done.


Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
C:\WINDOWS\mirar_distro_876260.exe
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.

ComboFix deleted two files located in this directory. Does this directory still exist and is there anything else in it?
C:\WINDOWS\system32\cbynuh

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
  • Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
  • Click on Tools, General Settings.
  • Under Real-time protection options, unselect the Turn on real-time protection check box
  • Click Save
After all of the fixes are complete it is very important that you enable Real-time Protection again.

Updating Java
  • Download the latest version of Java Runtime Environment (JRE) 6.0.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.

Scan with HijackThis. Place a check against each of the following:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

* Turn off the real time scanner of any existing antivirus program while performing the online scan
Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
Copy and paste that information from Kapersky in your next post.


Post (reply) with the log from Kapersky, and a fresh HijackThis log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI