Hijackthis Logs

Hello and welcome to TomCoyote! My name is silver and I'm currently looking over your log. Please hold on while I research a fix for you.

Hi napyhd,

First off, I have some bad news, your computer is infected by a backdoor trojan. This program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

• Use a another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
• Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
• Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

I will now continue with instructions for cleaning but if you decide to reformat then please let me know in your next response.

Next, it appears that you have two antivirus programs running - Symantec and Authentium. Running one antivirus program is essential, but having two providing active protection at the same time can cause conflicts, slow your system down and even cause stability problems, and it will not measurably improve your security. You can keep both installed if you wish, but only one should have active protection turned on, the other should only be active when you choose to perform a system scan.

Before proceeding, please deactivate one of these programs' real-time protection features. If you have any problems, please stop and let me know.

Next download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).

Now open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your deskop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.

Once complete, please post the SDFix report, the uninstall log and a new HijackThis log.

SDFix: Version 1.76 Run by [removed] Microsoft Windows XP [Version 5.1.2600] Running From: C:\sdfix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Entries Restoring Default Hosts File Rebooting… Normal Mode: Checking Files: Below files will be copied to Backups folder then removed: C:\WINDOWS\system32\winsvcup.exe - Deleted C:\WINDOWS\system32\winupsvc.exe - Deleted C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\tmp*.tmp - Deleted ADS Check: C:\WINDOWS\system32 No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\BitLord\\BitLord.exe"="C:\\Program Files\\BitLord\\BitLord.exe:*:Enabled:BitLord" "C:\\Program Files\\utorrent\\utorrent.exe"="C:\\Program Files\\utorrent\\utorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail" "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail" "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe:*:Disabled:Earthlink" "C:\\Documents and Settings\\HP_Owner\\Desktop\\Bitlord Pro (UseNext)\\Bitlord Pro (UseNext) incl acount-maker 100% working. Download with ur whole bandwitch. Enjoy\\svchost.exe"="C:\\Documents and Settings\\HP_Owner\\Desktop\\Bitlord Pro (UseNext)\\Bitlord Pro (UseNext) incl acount-maker 100% working. Download with ur whole bandwitch. Enjoy\\svchost.exe:*:Disabled:Generic Host Process for Win32 Services" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\\Program Files\\iolo\\System Mechanic Professional 7\\Personal Firewall\\ioloFW.exe"="C:\\Program Files\\iolo\\System Mechanic Professional 7\\Personal Firewall\\ioloFW.exe:*:Enabled:iolo Firewall®" "C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\ioloAV.exe"="C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\ioloAV.exe:*:Enabled:iolo AntiVirus®" "C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\iAVEmailScanner.exe"="C:\\Program Files\\iolo\\System Mechanic Professional 7\\AntiVirus\\iAVEmailScanner.exe:*:Enabled:iolo AntiVirus® Email Protection" "C:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"="C:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe:*:Disabled:BackWeb for Pavilion" "C:\\Program Files\\DiskTrix\\UltimateDefrag\\UDefrag.exe"="C:\\Program Files\\DiskTrix\\UltimateDefrag\\UDefrag.exe:*:Enabled:UltimateDefrag V1" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files: ————— Checking For Files with Hidden Attributes : C:\Documents and Settings\HP_Owner\Application Data\uTorrent\38HH[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\AvivaJuda.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BBWanna.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BigBootyGurls.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BigFatChics[1].com.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Bootyfulworld[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BootySeeker.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BootySeeker.com[0].torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BootySeeker.com[1].torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BreastWatching.com Final Rip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BustyBabydolls[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Cornbreadasses.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\DivineBreasts[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\GainingGoddess[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\HotSexyPlumpers.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\juggmaster.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\karadavis[1].com - Tina.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Ladynanaja.com - The Bigger, The Better.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\laylaextreme.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Lottabooty.com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mandy Blake and Charlee herfirstfatgirl[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mandy Blake and Dharma herfirstfatgirl[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mandy Blake and Kami Kobe and Krysta herfirstfatgirl[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mandy Blake and Michelle herfirstfatgirl[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw.com - Amazing Pear.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw.com - Cum Shower With Rika.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw[1].com - Diamond Beach.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw[1].com - Diamond's Swim Suit.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw[1].com - Diamond..A Boys Best Friend.avi.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw[1].com - New Models Audition 2.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw[1].com - New Models Audition.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercedesbbw[1].com - X-Rated Vacation.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\PhatJuicyAss[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Queen Adrena[1].com - Clip 1 of 9.avi.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Queen Adrena[1].com - Clip 2 of 9.avi.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Queen Adrena[1].com - Clip 3 of 9.avi.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Queen Adrena[1].com - Clip 4 of 9.avi.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\SaritasWorld[2].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\SoftandCurvy[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\SomelikeitFat[1].com.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\SwissBigBoobs[1].com - Part 1.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\SwissBigBoobs[1].com - Part 2.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\ThickCandy[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\TJB[1].com.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\www[1].clubbutts.com.torrent C:\download\darkcavern.com\links2\images\Thumbs.db C:\download\members.darkcavern.com\Thumbs.db C:\download\members.darkcavern.com\aug12\Thumbs.db C:\download\members.darkcavern.com\aug19\Thumbs.db C:\download\members.darkcavern.com\hubby\Thumbs.db C:\download\members.darkcavern.com\newhair\Thumbs.db C:\download\members.darkcavern.com\oct07\Thumbs.db C:\download\members.darkcavern.com\oct14\Thumbs.db C:\download\members.darkcavern.com\sep02\Thumbs.db C:\download\members.darkcavern.com\sep09\Thumbs.db C:\download\members.darkcavern.com\sep16\Thumbs.db C:\download\members.darkcavern.com\sep23\Thumbs.db C:\download\members.darkcavern.com\sep30\Thumbs.db C:\download\members.darkcavern.com\slutgrafs\Thumbs.db C:\download\www.mybigblack.com\cock\img\Thumbs.db C:\Program Files\BitLord\Downloads\www.chocolatemodels.com\cmonlinemag\february2007\Thumbs.db C:\Program Files\BitLord\Downloads\www.chocolatemodels.com\cmonlinemag\january2007\Thumbs.db C:\Documents and Settings\HP_Owner\Application Data\uTorrent\bbwkate[1].rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\bbw[1].buffie.siterip.23-11-05.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\bbw[1].deeva.siterip.23-11-05.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Brutal Dildos (Homemade).rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\cindyandjoe.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Jenny Seemore.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\London.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\My WWW[1].rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Oda Collection 4[1].rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Rico's Phats Vol 3[1].rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\SomelikeitFat[1].com.rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\thikchic[1].rar.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\violet2[1].rar.torrent C:\WINDOWS\SMINST\HPCD.sys C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp C:\Documents and Settings\HP_Owner\Application Data\uTorrent\2BBBWs.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\3MoniqueClips[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\bbheat sixpack - devonmichaels.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\bbheat sixpack - franchesca.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\BigFatChics[1].com.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\chrissi.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Desiree.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Devin.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\eren[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\HardbodiedBeauty-GetsAsspounding.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Kharma.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Lana.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\LastOfLatina.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Maria.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Melanie.zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Mercy[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Missy[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\miwa[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\redfoxygirl[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Surreal[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\Tristal[1].zip.torrent C:\Documents and Settings\HP_Owner\Application Data\uTorrent\xFD[1].zip.torrent Finished

uninstall list Absolute Poker Ad-Aware SE Personal Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 9 ActiveX Adobe Reader 6.0.1 Adobe Shockwave Player Agere Systems PCI Soft Modem AppCore Authentium AntiVirus SDK - 2 AV BSPlayer ccCommon DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player Download Accelerator Plus (DAP) DVDFab Decrypter 3.0.9.6 DVDXCopy Platinum 4.0.3 eMule ffdshow [rev 944] [2007-02-20] GPL MPEG-1/2 DirectShow Decoder Filter Help and Support Additions Hide IP Platinum 3.4 High Definition Audio Driver Package - KB835221 HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) HP Deskjet Preloaded Printer Drivers HP Document Viewer 5.3 HP Extended Capabilities 5.3 HP Image Zone 5.3 HP Imaging Device Functions 5.3 HP Organize HP Photo & Imaging 3.5 - HP Devices HP PSC & OfficeJet 5.3.B HP Software Update HP Solution Center & Imaging Support Tools 5.3 Image Grabber II IncrediMail JunkFilter Plus IncrediMail Xe IntelliMover Data Transfer Demo Internet Worm Protection InterVideo DVDCopy5 InterVideo WinDVD Creator 3 IsoBuster 1.9.1 iTunes J2SE Runtime Environment 5.0 Update 11 Java 2 Runtime Environment, SE v1.4.2_03 KBD LimeWire PRO 4.12.11 LiveUpdate 3.2 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) MetaProducts MetaProducts Offline Explorer Enterprise Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB886903) Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Plus! Dancer LE Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Windows XP Video Decoder Checkup Utility Microsoft Works 7.0 MSN MSXML 4.0 SP2 (KB927978) Musicmatch® Jukebox muvee autoProducer 3.5 magicMoments - HPD Nero Suite Norton AntiVirus Norton AntiVirus (Symantec Corporation) Norton AntiVirus Help Norton AntiVirus Parent MSI Norton AntiVirus SYMLT MSI Norton Protection Center PC-Doctor for Windows Photosmart 320,370,7400,8100,8400 Series PokerFatCat PS2 Python 2.2 combined Win32 extensions Python 2.2.1 QuickTime RealPlayer S3 S3Display S3 S3Gamma2 S3 S3Info2 S3 S3Overlay Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) SnagIt 8 Sonic RecordNow! SPBBC 32bit Spybot - Search & Destroy 1.4 Symantec SymNet Tropical Poker Client 0.9.5.81 UltimateDefrag Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920342) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB929338) Update for Windows XP (KB931836) Updates from HP VIA Rhine-Family Fast-Ethernet Adapter VIA/S3G Display Driver Winamp (remove only) Windows Defender Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Messenger Windows Live Sign-in Assistant Windows Live Toolbar Windows Live Toolbar Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Xvid 1.1.2 final uninstall Yahoo! Photos Easy Upload Tool Yahoo! Photos Print-at-Home Tool Yahoo! Toolbar Yahoo! Widget Engine

thanks for looking at this did everything you suggested

Hi napyhd,

First, I have some questions for you:

This line in your HijackThis log:
O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D} (DGTx.uc1) - http://66.98.144.30/DGTx.CAB
refers to a downloaded program file or ActiveX control. I can't find any information about the program file, or the IP address from which it was downloaded. Do you know what this is and did you knowingly install it?

In your uninstall list you have programs called AV and PS2 - do you know what these programs are and did you knowingly install them?

A number of startup programs have changed since the previous HijackThis log, have you used MSConfig or another program to enable/disable some? If so, please tell me which program you used, I need to examine all entries to check for malware.

I can see that you have some P2P programs installed on your computer. P2P is one of the biggest sources of malware we see because unfortunately the networks are full of infected files and this is probably the source of your infections. I strongly advise you to remove eMule and Limewire via Add/Remove Programs, and not use P2P software for security reasons, but of course the choice is yours.

Now we need to make hidden/system files and folders visible as you will need to delete some bad ones:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Show hidden files and folders
UNCHECK the Hide protected operating system files (recommended) option
Click Yes to confirm and press OK

Now, please open the Bitlord Pro (UseNext) folder on your desktop and navigate to this subfolder:
Bitlord Pro (UseNext) incl acount-maker 100% working. Download with ur whole bandwitch. Enjoy
Then delete the file named svchost.exe (if present)
I suspect this whole folder to be a trojan application, and if you know that it's no use to you then please delete it.

Now navigate to and delete the following file (if present):
C:\WINDOWS\svchost.exe
Note: Please take care not to delete the legitimate program with the same filename located in the C:\WINDOWS\system32 directory!

Then click Start-> Search
Choose All files and folders, and type plscd.exe in the filename box and under Look in: select Local Hard Drives
Then choose More advanced options, and ensure Search system folders, Search hidden files and folders and Search subfolders are all checked
Delete all occurrences of this file (if found)

Next, go to Start > Run and type Notepad
Copy/paste the following quote box into a new notepad (not wordpad) document. Make sure that wordwrap is unchecked.

regedit /a /e %systemdrive%\regkey.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig"
notepad %systemdrive%\regkey.txt
del /q %systemdrive%\regkey.txt

Go to the menu at the top of the Notepad File and Save as
Save it to your Desktop as "mslook.bat" (you MUST include the quotes)
Locate mslook.bat on your Desktop and double-click it. When notepad opens, copy/paste the content in your reply. When you close Notepad the CMD window will close automatically and the text file will be deleted.

Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Press OK and Yes to confirm

Then, download, install, and update AVG Anti-Spyware 7.5
Download the installer from this page:
http://www.ewido.net/en/download/

• Save the installer to desktop
• Double click the installer, select your language, and then select OK
• Click NEXT->Do or don't read the "User License Agreement"
  Select I Agree->NEXT->INSTALL
• AVG will now install and afterwards click FINISH
• Click the Update tab at the top. Under Manual Update click Start update.
• After the update finishes the status bar at the bottom will display Update successful
• Close AVG Anti-Spyware. Do not run a scan yet.

Reboot your computer into Safe Mode
To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads.
Select Safe Mode at the top, on the screen that appears.
Sign in with your normal user account

Once in safe mode:

• Then run AVG Anti-Spyware 7.5 and click on the Scanner tab at the top
• Click the Settings tab and then change the recommended action to Quarantine and ensure that Automatically generate report after every scan is selected and Un-check Only if Threats are found
• Click back to the Scan tab and then click on Complete System Scan.
• This scan can take quite a while to run, so be prepared.
• AVG Anti-Spyware 7.5 will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action.
• Click the Apply all actions button. AVG Anti-Spyware 7.5 will display All actions have been applied on the right hand side.
• Click on Save Report, then Save Report As. This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Now reboot your computer normally

Once complete, please post the answers to the above questions, the output from mslook.bat, the AVG log and a new HijackThis log. Also let me know if you have any difficulties with the instructions

ok no clue what this is O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D} (DGTx.uc1) - http://66.98.144.30/DGTx.CAB
uninstalled PS2
used spybot thats it
uninstalled eMule and Limewire
not found C:\WINDOWS\svchost.exe, plscd.exe
did mslook but says cannot find C:/regkey.txt ask if i want to create new one said yes but nothing is in notepad
cleared temp files did avg stuff in safemode rebooted and here are the reports will do seperatly.
thanks again found 13 files 2 backdoors Feutel.av and Trojan.Agent.abg

VG Anti-Spyware - Scan Report ——————————————————— + Created at: 7:01:02 PM 4/6/2007 + Scan result: C:\Documents and Settings\HP_Owner\Cookies\[removed][1].txt -> TrackingCookie.Clickhype : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\hp_owner@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\hp_owner@fortunecity[1].txt -> TrackingCookie.Fortunecity : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\[removed][1].txt -> TrackingCookie.Live : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\hp_owner@revsci[2].txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\hp_owner@toplist[1].txt -> TrackingCookie.Toplist : Cleaned. C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\[removed][1].txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\HP_Owner\Cookies\hp_owner@yadro[1].txt -> TrackingCookie.Yadro : Cleaned. C:\Documents and Settings\HP_Owner\lsass.exe -> Trojan.Agent.abg : Cleaned. C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP3\A0000163.exe -> Trojan.Agent.abg : Cleaned. C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP3\A0000164.exe -> Trojan.Agent.abg : Cleaned. C:\Program Files\Elaborate Bytes\CloneDVD2\Patch.exe -> Trojan.Feutel.av : Cleaned. ::Report end

Hi napyhd,

Great info, just one thing that wasn't answered - the program called AV - are you familiar with it and did you knowingly install it?
Also, uTorrent is just as dangerous as the other P2P applications so please carefully consider whether you need this program.

Let's continue:

I need to see what's been disabled with Spybot S&D, we can do this by producing a report:

• Open Spybot S&D and ensure Advanced Mode is selected (Mode->Advanced Mode)
• Choose the System Startup tab
• Press the Export button and save the report to your desktop
• Post a copy of the report with your next response

Next please open Start->Control Panel->Add/Remove Programs and remove these programs:
Absolute Poker
BSPlayer
If you don't want the program called AV then you can uninstall it here.

Some safe alternatives to Absolute Poker and Party Poker are:
PokerStars.net / PokerStars.com
PokerRoom.com

You have DAP installed on your system, it is not technically malware but the free version is ad supported and not recommended.
A safe, ad-free alternative is wxDownloadfast
I recommend you remove DAP, if you wish to do so, open Add/Remove Programs and remove Download Accelerator Plus (DAP)

We will temporarily disable Windows Defender as it may interfere with the cleaning we will be doing:

Temporarily disable Windows Defender:

• Right-click on the Windows Defender icon in the system tray [it's the one with the red and yellow bulls-eye]
• Click on Security Agents Status
• Click on Disable real-time protection.
• Next right-click on the Windows Defender icon in the system tray again to open the program
• Click on the Options menu and choose Settings
• In the left pane column click on Real Time Protection
• Under Startup Options, uncheck Enable Security Agents on startup (recommended)
• Under Real-time spyware threat protection, uncheck Enable real-time spyware threat protection (recommended)
• Click the Save button and close Microsoft AntiSpyware
• Finally, right-click on the Windows Defender icon in the system tray and select Shutdown Windows Defender

Now please open HijackThis, select Do a system scan only and place a check-mark next to the following lines (if present):
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\HP_Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\HP_Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D} (DGTx.uc1) - http://66.98.144.30/DGTx.CAB

If you removed DAP then also check these lines:
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm

This program appears to be cracked and not installed correctly, you should also check these lines:
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Documents and Settings\HP_Owner\Desktop\MetaProducts.Offline.Explorer.Enterprise.v4.4.2458.Incl.Keymaker-ZWT\crack\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Documents and Settings\HP_Owner\Desktop\MetaProducts.Offline.Explorer.Enterprise.v4.4.2458.Incl.Keymaker-ZWT\crack\Add_AllO.htm

Then close all open windows apart from HijackThis, press Fix checked and close HijackThis.

You should delete this folder on your desktop because it appears to be a cracked copy:
MetaProducts.Offline.Explorer.Enterprise.v4.4.2458.Incl.Keymaker-ZWT

A safe and free alternative website downloader is HTTrack Website Copier

You have had some very dangerous infections on your machine, so we'll do a couple further scans to see if there's anything left:

Please download F-Secure Blacklight (blbeta.exe):
https://europe.f-secure.com/blacklight/try.shtml

• Click I ACCEPT and download the graphical user interface version to your Desktop
• Double click the file to run it, choose I accept the agreement then press Scan
• It will create the "fsbl-xxxxxxx.log" on your desktop.
• The log will have a list of all items found.
• Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
• Exit Blacklight and post the contents of the log in your next reply.

Please do an online scan with Kaspersky:

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT and then Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• The program will start to scan your system.
• Once the scan is complete, click on the Save as Text button and save the file to your desktop

Once complete, please post the Spybot startup report, the Blacklight log, the Kaspersky log and a new HijackThis log.

Hi napyhd, How are you getting on? If the instructions are unclear or something isn't working, please let me know before proceeding.

sry bout that just finished kaspersy online wouldt work so i used their free trial here r all the posts, also i have no clue hat AV is cant find it only thing close is AVG antivirus. also thanks for all your help kas found 2 trojans

04/16/07 09:03:08 [Info]: BlackLight Engine 1.0.61 initialized 04/16/07 09:03:08 [Info]: OS: 5.1 build 2600 (Service Pack 2) 04/16/07 09:03:08 [Note]: 7019 4 04/16/07 09:03:08 [Note]: 7005 0 04/16/07 09:03:15 [Note]: 7006 0 04/16/07 09:03:15 [Note]: 7011 1616 04/16/07 09:03:16 [Note]: 7026 0 04/16/07 09:03:16 [Note]: 7026 0 04/16/07 09:03:20 [Note]: FSRAW library version 1.7.1021 04/16/07 09:29:30 [Note]: 7007 0 this is all that came up