What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This Log

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I do work for Rex Systems… I did have a program called Elite Keylogger a while ago.. which i do not need anymore.. It is safe to ditch that one..
Post #17

I do work for Rex Systems…

I did have a program called Elite Keylogger a while ago.. which i do not need anymore.. It is safe to ditch that one..

Good. Yes you can uninstall the keylogger. Use Add/Remove Programs.
I didn't see any bad guys in the scan, but it did clean a few. Are you still getting the pop-ups?
Post #18
as of yet no.. no more popups.. I've opened a few browser windows trying to "activate" one, but nothing yet… im going to reboot and log back in as my user and hopefully this will take.. which I suspect it should. Ill post again here in a bit with an update! Thanks in advance
Post #20
well.. it seemed to work fine as administrator.. however, when I log back into my user account, I still get the popups.. I ran the combofix as administrator from my user login, but I don't think it matters, because Im not on my domain at work right now, so my roaming profile is just cached and it can't save my profile changes to the domain.. so do you think I should run the combo fix from work so it takes my roaming profile changes?
Post #21

well.. it seemed to work fine as administrator.. however, when I log back into my user account, I still get the popups..

I ran the combofix as administrator from my user login, but I don't think it matters, because Im not on my domain at work right now, so my roaming profile is just cached and it can't save my profile changes to the domain..

so do you think I should run the combo fix from work so it takes my roaming profile changes?

By chance can you add Administrator rights to your user profile name?
If that doesn't work then wait until your at work, but your user name will need Administrator rights.
Post #22
yea, I can do that. I work in the I.T department. I'll log my machine in at work and add myself to the adminstrator group on the server. I catch back up to you on Monday!
Post #24
I'm at work now.. Here is the ComboFix Log:

"administrator" - Mon 04/02/2007 9:31:54 Service Pack 2
ComboFix 07-03-27.4.2 - Running from: "C:\WINDOWS\system32"


((((((((((((((((((((((((((((((( Files Created from 2007-03-02 to 2007-04-02 ))))))))))))))))))))))))))))))))))


2007-03-30 14:48 d——– C:\DOCUME~1\ADMINI~2.REX\tcm
2007-03-30 14:48 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Webshots
2007-03-30 14:48 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Talkback
2007-03-30 10:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\VMware
2007-03-30 10:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\VMware
2007-03-30 10:25 d——– C:\Program Files\VMware
2007-03-28 08:58 86,016 –a—— C:\WINDOWS\unvise32.exe
2007-03-28 08:58 d——– C:\Program Files\SWiSHmax
2007-03-28 08:43 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Real
2007-03-26 19:26 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-03-26 18:16 d–h—– C:\WINDOWS\msdownld.tmp
2007-03-26 18:11 d——– C:\WINDOWS\network diagnostic
2007-03-26 18:07 d——– C:\e7fdbb1174e805175122072647794b70
2007-03-24 13:54 d——– C:\WINDOWS\system32\SmitfraudFix
2007-03-24 12:54 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-03-24 12:54 d——– C:\Program Files\AVG Anti-Spyware
2007-03-24 12:53 d——– C:\DOCUME~1\ADMINI~2.REX\UserData
2007-03-24 11:41 d——– C:\DOCUME~1\ADMINI~2.REX\SmitfraudFix
2007-03-24 11:40 4,102 –a—— C:\WINDOWS\system32\tmp.reg
2007-03-24 11:36 d——– C:\DOCUME~1\veachrr\SmitfraudFix
2007-03-24 00:33 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\CuteReminderPro
2007-03-23 18:27 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-03-23 18:27 d——– C:\Program Files\Trend Micro
2007-03-22 11:59 d——– C:\Rexford
2007-03-21 15:40 d——– C:\MP3, Website & Backup, My Briefcase
2007-03-14 14:08 934 –a—— C:\WINDOWS\system32\dngxjcf_navps.dat
2007-03-14 14:08 6,549 –a—— C:\WINDOWS\system32\dngxjcf.dat
2007-03-14 14:08 313,856 –a—— C:\WINDOWS\system32\dngxjcf.exe
2007-03-14 14:08 240,097 –a—— C:\WINDOWS\system32\dngxjcf_nav.dat
2007-03-14 11:55 327,680 –a—— C:\WINDOWS\system32\psctsnmp.dll
2007-03-14 09:50 d——– C:\DOCUME~1\veachrr\WINDOWS
2007-03-14 09:50 d——– C:\DOCUME~1\veachrr\UserData
2007-03-14 09:36 d——– C:\DOCUME~1\veachrr\APPLIC~1\WeatherBug
2007-03-14 09:35 d——– C:\DOCUME~1\veachrr\APPLIC~1\uTorrent
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\Thunderbird
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\Talkback
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\Sonic
2007-03-14 09:34 d——– C:\DOCUME~1\veachrr\APPLIC~1\shockwave.com
2007-03-14 09:28 d——– C:\DOCUME~1\veachrr\APPLIC~1\McAfee.com Personal Firewall
2007-03-14 09:28 d——– C:\DOCUME~1\veachrr\APPLIC~1\McAfee
2007-03-14 09:27 d——– C:\DOCUME~1\veachrr\APPLIC~1\Leadertech
2007-03-14 09:27 d——– C:\DOCUME~1\veachrr\APPLIC~1\Help
2007-03-14 09:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\CyberLink
2007-03-14 09:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\CuteReminderPro
2007-03-14 09:26 d——– C:\DOCUME~1\veachrr\APPLIC~1\Corel Photo Album
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Corel
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Ahead
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\AdobeUM
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Adobe
2007-03-14 09:25 d——– C:\DOCUME~1\veachrr\APPLIC~1\Acoustica
2007-03-14 09:21 d–h—– C:\DOCUME~1\veachrr\.wt
2007-03-14 09:15 3,145,728 –ah—– C:\DOCUME~1\veachrr\NTUSER.DAT
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Sun
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Intel
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Gtek
2007-03-14 09:15 d——– C:\DOCUME~1\veachrr\APPLIC~1\Google
2007-03-13 16:00 2,621,440 –a—— C:\DOCUME~1\ADMINI~2.REX\NTUSER.DAT
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\WINDOWS
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Thunderbird
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\OpenOffice.org2
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Intel
2007-03-13 16:00 d——– C:\DOCUME~1\ADMINI~2.REX\APPLIC~1\Adobe
2007-03-13 15:54 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-03-12 19:20 d——– C:\Program Files\InternetGameBox
2007-03-10 18:23 d——– C:\Program Files\Virtools
2007-03-05 10:28 d——– C:\Program Files\TightVNC
2007-03-05 09:33 925,795 –a—— C:\WINDOWS\system32\RC8FE140.DLL
2007-03-05 09:33 77,824 –a—— C:\WINDOWS\system32\Rc4manNT.dll
2007-03-05 09:33 73,728 –a—— C:\WINDOWS\system32\RCPRINT.dll
2007-03-05 09:33 69,632 –a—— C:\WINDOWS\system32\TIFmtA.dll
2007-03-05 09:33 61,440 –a—— C:\WINDOWS\system32\TrackID.dll
2007-03-05 09:33 57,344 –a—— C:\WINDOWS\system32\rdrvinf.dll
2007-03-05 09:33 54,784 –a—— C:\WINDOWS\system32\rdrvlog.dll
2007-03-05 09:33 53,248 –a—— C:\WINDOWS\system32\RICDB32.dll
2007-03-05 09:33 49,152 –a—— C:\WINDOWS\system32\TIBase64.dll
2007-03-05 09:33 37,376 –a—— C:\WINDOWS\system32\MFRICRES.dll
2007-03-05 09:33 32,768 –a—— C:\WINDOWS\system32\RC00C140.dll
2007-03-05 09:33 30,720 –a—— C:\WINDOWS\system32\RC00C150.dll
2007-03-05 09:33 27,136 –a—— C:\WINDOWS\system32\RCINST.dll
2007-03-05 09:33 236,024 –a—— C:\WINDOWS\system32\rpcsecl.dll
2007-03-05 09:33 217,088 –a—— C:\WINDOWS\system32\RICJC32.dll
2007-03-05 09:33 167,936 –a—— C:\WINDOWS\system32\JCUI.exe
2007-03-05 09:33 1,126,400 –a—— C:\WINDOWS\system32\Ne35Cdat.dll
2007-03-05 09:33 d–h—– C:\_rpcs


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-02 07:52 ——– d——– C:\Program Files\mozilla thunderbird
2007-04-02 07:51 ——– d——– C:\Program Files\cutereminderpro
2007-04-01 11:42 ——– d——– C:\Program Files\zero popup
2007-03-28 15:16 6380 –a—— C:\WINDOWS\mozver.dat
2007-03-26 18:17 ——– d——– C:\Program Files\yahoo!
2007-03-24 14:05 ——– d——– C:\Program Files\intel
2007-03-19 18:05 ——– d——– C:\Program Files\trillian
2007-02-22 13:10 ——– d——– C:\Program Files\java
2007-02-20 19:53 ——– d–h—– C:\Program Files\installshield installation information
2007-02-20 16:26 ——– d——– C:\Program Files\sftpdrive
2007-02-10 16:33 ——– d——– C:\Program Files\google
2007-01-08 19:01 17408 –a—— C:\WINDOWS\system32\corpol.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"CuteReminder"="C:\\Program Files\\CuteReminderPro\\CuteReminder.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
@=""
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"MSKDetectorExe"="C:\\Program Files\\McAfee\\SpamKiller\\MSKDetct.exe /uninstall"
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"SysService"="C:\\Program Files\\XP Keylogger\\SERVICES.EXE"
"LexStart"="lexstart.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SysService"="C:\\Program Files\\XP Keylogger\\SERVICES.EXE"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (ROBERT-Veach).job


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes …

scanning hidden services …

HKLM\SYSTEM\CurrentControlSet\Services\E100Bdm

HKLM\SYSTEM\CurrentControlSet\Services\EvtEngystem

HKLM\SYSTEM\CurrentControlSet\Services\FaxtUserSwitchingCompatibility

HKLM\SYSTEM\CurrentControlSet\Services\FltMgrsk

HKLM\SYSTEM\CurrentControlSet\Services\Gpcisk

HKLM\SYSTEM\CurrentControlSet\Services\HidUsbv

HKLM\SYSTEM\CurrentControlSet\Services\hpnUsb

HKLM\SYSTEM\CurrentControlSet\Services\HSF_DPCH

HKLM\SYSTEM\CurrentControlSet\Services\HTTPDP

HKLM\SYSTEM\CurrentControlSet\Services\i2omgmtter

HKLM\SYSTEM\CurrentControlSet\Services\i2ompmt

HKLM\SYSTEM\CurrentControlSet\Services\ialm2prt

HKLM\SYSTEM\CurrentControlSet\Services\inetaccsvice

HKLM\SYSTEM\CurrentControlSet\Services\ini910us

HKLM\SYSTEM\CurrentControlSet\Services\Inportu

HKLM\SYSTEM\CurrentControlSet\Services\Ip6Fwppm

HKLM\SYSTEM\CurrentControlSet\Services\IpInIperDriver

HKLM\SYSTEM\CurrentControlSet\Services\IpNatp

HKLM\SYSTEM\CurrentControlSet\Services\isapnpearch

HKLM\SYSTEM\CurrentControlSet\Services\IWCAnp

HKLM\SYSTEM\CurrentControlSet\Services\kmixerss

HKLM\SYSTEM\CurrentControlSet\Services\lbrtfdcorkstation

HKLM\SYSTEM\CurrentControlSet\Services\ldapfdc

HKLM\SYSTEM\CurrentControlSet\Services\LmHostsService

HKLM\SYSTEM\CurrentControlSet\Services\MDMosts

HKLM\SYSTEM\CurrentControlSet\Services\mnmddnger

HKLM\SYSTEM\CurrentControlSet\Services\Modemvc

HKLM\SYSTEM\CurrentControlSet\Services\mouhidss

HKLM\SYSTEM\CurrentControlSet\Services\MRxDAV5x

HKLM\SYSTEM\CurrentControlSet\Services\MSDTCb

HKLM\SYSTEM\CurrentControlSet\Services\MsfsC

HKLM\SYSTEM\CurrentControlSet\Services\MSKSSRVer

HKLM\SYSTEM\CurrentControlSet\Services\MSPQMOCK

HKLM\SYSTEM\CurrentControlSet\Services\Mupmbios

HKLM\SYSTEM\CurrentControlSet\Services\Ndisuioi

HKLM\SYSTEM\CurrentControlSet\Services\NetBTOS

HKLM\SYSTEM\CurrentControlSet\Services\Netlogondm

HKLM\SYSTEM\CurrentControlSet\Services\Netmanon

HKLM\SYSTEM\CurrentControlSet\Services\NlaCONFIGSVC

HKLM\SYSTEM\CurrentControlSet\Services\NullSvc

HKLM\SYSTEM\CurrentControlSet\Services\nvll

HKLM\SYSTEM\CurrentControlSet\Services\omci1394

HKLM\SYSTEM\CurrentControlSet\Services\osei

HKLM\SYSTEM\CurrentControlSet\Services\ParVdmr

HKLM\SYSTEM\CurrentControlSet\Services\PCIVdm

HKLM\SYSTEM\CurrentControlSet\Services\PCIIdep

HKLM\SYSTEM\CurrentControlSet\Services\PDRELIE

HKLM\SYSTEM\CurrentControlSet\Services\perc2AME

HKLM\SYSTEM\CurrentControlSet\Services\PerfNetk

HKLM\SYSTEM\CurrentControlSet\Services\PerfOSt

HKLM\SYSTEM\CurrentControlSet\Services\PSchedtedStorage

HKLM\SYSTEM\CurrentControlSet\Services\pxcomnk

HKLM\SYSTEM\CurrentControlSet\Services\ql108020

HKLM\SYSTEM\CurrentControlSet\Services\ql12400

HKLM\SYSTEM\CurrentControlSet\Services\RasManp

HKLM\SYSTEM\CurrentControlSet\Services\Rasptioe

HKLM\SYSTEM\CurrentControlSet\Services\Rdbssi

HKLM\SYSTEM\CurrentControlSet\Services\RDPDDD

HKLM\SYSTEM\CurrentControlSet\Services\RegSrvcgr

HKLM\SYSTEM\CurrentControlSet\Services\RpcLocatorss

HKLM\SYSTEM\CurrentControlSet\Services\RpcSseRegistry

HKLM\SYSTEM\CurrentControlSet\Services\RSVPocator

HKLM\SYSTEM\CurrentControlSet\Services\SamSsentMonitor

HKLM\SYSTEM\CurrentControlSet\Services\sdbusSvr

HKLM\SYSTEM\CurrentControlSet\Services\Secdrvle

HKLM\SYSTEM\CurrentControlSet\Services\SENSrv

HKLM\SYSTEM\CurrentControlSet\Services\serenumn

HKLM\SYSTEM\CurrentControlSet\Services\SimbadAccess

HKLM\SYSTEM\CurrentControlSet\Services\sisagpWDetection

HKLM\SYSTEM\CurrentControlSet\Services\Spooler1

HKLM\SYSTEM\CurrentControlSet\Services\srarrow

HKLM\SYSTEM\CurrentControlSet\Services\Srvoler

HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRVce

HKLM\SYSTEM\CurrentControlSet\Services\STAC97k5

HKLM\SYSTEM\CurrentControlSet\Services\stisvcV

HKLM\SYSTEM\CurrentControlSet\Services\SwPrvc

HKLM\SYSTEM\CurrentControlSet\Services\sym_u30

HKLM\SYSTEM\CurrentControlSet\Services\Tcpipdio

HKLM\SYSTEM\CurrentControlSet\Services\TDPIPELog

HKLM\SYSTEM\CurrentControlSet\Services\TDTCPrv

HKLM\SYSTEM\CurrentControlSet\Services\tfsndrctice

HKLM\SYSTEM\CurrentControlSet\Services\tfsnifss

HKLM\SYSTEM\CurrentControlSet\Services\Themesol

HKLM\SYSTEM\CurrentControlSet\Services\tmcommfa

HKLM\SYSTEM\CurrentControlSet\Services\TrkWksr

HKLM\SYSTEM\CurrentControlSet\Services\TSDDDm

HKLM\SYSTEM\CurrentControlSet\Services\Udfsde

HKLM\SYSTEM\CurrentControlSet\Services\ultras

HKLM\SYSTEM\CurrentControlSet\Services\UPSra

HKLM\SYSTEM\CurrentControlSet\Services\usbehcit

HKLM\SYSTEM\CurrentControlSet\Services\usbseri

HKLM\SYSTEM\CurrentControlSet\Services\usbuhcipt

HKLM\SYSTEM\CurrentControlSet\Services\VgaSaveptxp

HKLM\SYSTEM\CurrentControlSet\Services\viaagpR

HKLM\SYSTEM\CurrentControlSet\Services\ViaIdei

HKLM\SYSTEM\CurrentControlSet\Services\VSSIde

HKLM\SYSTEM\CurrentControlSet\Services\w29n51sb

HKLM\SYSTEM\CurrentControlSet\Services\wanatwe

HKLM\SYSTEM\CurrentControlSet\Services\Winsocknt

HKLM\SYSTEM\CurrentControlSet\Services\WmiTrust

HKLM\SYSTEM\CurrentControlSet\Services\WmiApRplER

HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSLl

HKLM\SYSTEM\CurrentControlSet\Services\wscsvcrv

HKLM\SYSTEM\CurrentControlSet\Services\wuauservrkSvc

HKLM\SYSTEM\CurrentControlSet\Services\WudfPfL

HKLM\SYSTEM\CurrentControlSet\Services\WudfSvcv

scanning hidden autostart entries …

scanning hidden files …


scan completed successfully
hidden processes: 0
hidden services: 106
hidden files: 0

********************************************************************

Completion time: 07-04-02 9:35:50
C:\ComboFix2.txt … 07-03-31 10:44



Here is the Hijack log after ComboFix…Note.. I have not uninstalled the keylogger yet.. just FYI
See any problems?? I will leave my browser windows open too see if I get popups..

Logfile of HijackThis v1.99.1
Scan saved at 09:48, on 07-04-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\MP3, Website & Backup, My Briefcase\My Briefcase\Program Setups\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://downloads.yahoo.com/internetexplorer/welcome.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SysService] C:\Program Files\XP Keylogger\SERVICES.EXE
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CuteReminder] C:\Program Files\CuteReminderPro\CuteReminder.exe
O4 - Startup: OpenOffice.org 2.1.lnk = Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {050A0128-BE56-4F4B-9F2A-2F926AB5A2F2} (Pvapplite_ie Control) - https://ondemand.ptc.com/Windchill/wtcore/j…vapplite_ie.cab
O16 - DPF: {0F7A9297-7268-11D1-B81A-00A076C01B0A} - http://www.cartesianinc.com/Products/CPCVi…k/CpcViewAX.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1140064843828
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://hq-sabaweb1.ptc.com/viewer/activeXV…tivexviewer.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ptcsupport.webex.com/client/v_myweb…ort/ieatgpc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #25
I can't find any information on these. Do you know what they are?

C:\WINDOWS\system32\dngxjcf_navps.dat
C:\WINDOWS\system32\dngxjcf.dat
C:\WINDOWS\system32\dngxjcf.exe
C:\WINDOWS\system32\dngxjcf_nav.dat


Delete these Files if listed:
C:\WINDOWS\unvise32.exe
C:\Program Files\XP Keylogger\SERVICES.EXE

Delete this Folder if listed:
C:\Program Files\XP Keylogger
Post #26
Ok.. im home now.. I deleted the unvise file.. I do no have the xp keylogger program file.. I do not see those other wierd files system 32 files.. they must be linked to the domain at work.. I still have the stupid popups.. doesn't seem I get them as often.. but I still get them
Post #27 last edited
These were from the first ComboFix you ran. They look a lot like those. C:\WINDOWS\system32\chcynshdhw_navps.dat C:\WINDOWS\system32\chcynshdhw.exe C:\WINDOWS\system32\chcynshdhw.dat See if these are listed when you're at work. To be safe I'd try renaming them and make sure everything is running right, before deleting them C:\WINDOWS\system32\dngxjcf_navps.dat C:\WINDOWS\system32\dngxjcf.dat C:\WINDOWS\system32\dngxjcf.exe C:\WINDOWS\system32\dngxjcf_nav.dat It also appears to be related to your user account. Are there any other user accounts besides Administrator on that pc?
Post #28 last edited
I used to log into a rexinternal domain… and now its rexsystems domain.. my wife's login would be ljv, my old one is rveach… veach I think was an administrator account on the local machine.. my new one is veachrr on the rexsystems domain. I will check for those files tomorrow at work as well. also.. we do have Mcafee Enterprise edition at work.. would you recommend that I ditch antivir and go with that instead?
Post #29 last edited
My thoughts were logging in as a different user, other then administrator, and see if the pop-ups are still there.

Also when you login tomorrow at work make sure you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.
Post #30 last edited
Yea.. I made those changes today actually to the file options! I was just going to tell you.. those *xjcf files.. I just found 2 of those actual ones running in my processes.. I killed them and nothing bad happened.. it was the exe and one of the nav.dat files running. I wonder what those are… Im logged in as a user right now and not administrator..

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI