I followed your instructions in your "Before Posting A HijackThis Log "Self Help", For Windows 2000 and XP Versions" topic but was unable to use the Ewido software as it does not support 64-bit version of Windows. So I am unable to post the contents of AVG Anti-Spyware scan as asked. When I run SpyBot it says it cannot clean a Torpid spyware/virus and asks if it may try at the next reboot. I allowed SpyBot to run at the next reboot but it was still unable to clean the Torpid spyware/virus. Also web browser widows just keep opening on there own even when I do not currently have a browser open. Here is the contents of the HijackThis log. Any help you can give would be greatly appreciated.
Logfile of HijackThis v1.99.1
Scan saved at 7:02:46 AM, on 5/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\retadpu1000272.exe
C:\WINDOWS\smanager.7.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000272.exe 61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [WindowsHive] C:\WINDOWS\system32\rpcc.exe
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\uycgwvwt.dll",realset
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: pccmsi.lnk = C:\Documents and Settings\John\Desktop\TrendMicroPCCsmall\setup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Event Log EventlogSENS (EventlogSENS) - Unknown owner - C:\WINDOWS\system32\ansin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Hello and welcome to the forum
I don't see any protection at all
Click the
HERE and Save, Install, Update and run a full scan.
Empty Recycle Bin
Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment
Logfile of HijackThis v1.99.1
Scan saved at 10:11:21 AM, on 5/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\retadpu1000272.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\DOCUME~1\John\MYDOCU~1\CROSOF~1.NET\notepad.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\John\Application Data\?racle\?hkdsk.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Hijackthis\HijackThis.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000272.exe
61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [WindowsHive] C:\WINDOWS\system32\rpcc.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\uycgwvwt.dll",realset
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Irea] "C:\DOCUME~1\John\MYDOCU~1\CROSOF~1.NET\notepad.exe" -vt yazb
O4 - HKCU\..\Run: [Fqztc] "C:\Documents and Settings\John\Application Data\?racle\?hkdsk.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: pccmsi.lnk = C:\Documents and Settings\John\Desktop\TrendMicroPCCsmall\setup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Event Log EventlogSENS (EventlogSENS) - Unknown owner - C:\WINDOWS\system32\ansin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program
Files\Analog Devices\SoundMAX\SMAgent.exe
Please turn word wrap off in notepad.Tools menu , and then click Folder Options . View tab. Clear "Hide file extensions for known file types." select "Show hidden files and folders." Clear "Hide protected operating system files." HijackThis.exe , Right Click on the file and Select Rename . Rename Hijackthis.exe to Spyware.exe.
Logfile of HijackThis v1.99.1
Scan saved at 10:23:53 AM, on 5/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\retadpu1000272.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\DOCUME~1\John\MYDOCU~1\CROSOF~1.NET\notepad.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\John\Application Data\?racle\?hkdsk.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\Spyware.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {14C48A31-37F5-3806-F240-1CE33EEFAD93} - C:\WINDOWS\system32\wuj.dll
O2 - BHO: (no name) - {15FAC292-47E3-43DC-B097-C479F9D32DC3} - C:\WINDOWS\system32\rqrpqpp.dll
O2 - BHO: (no name) - {1B595391-E504-4486-972C-3F8856ECDCF7} - C:\WINDOWS\system32\ssqrp.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\msuhqmms.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000272.exe 61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [WindowsHive] C:\WINDOWS\system32\rpcc.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\uycgwvwt.dll",realset
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Irea] "C:\DOCUME~1\John\MYDOCU~1\CROSOF~1.NET\notepad.exe" -vt yazb
O4 - HKCU\..\Run: [Fqztc] "C:\Documents and Settings\John\Application Data\?racle\?hkdsk.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: pccmsi.lnk = C:\Documents and Settings\John\Desktop\TrendMicroPCCsmall\setup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: rqrpqpp - C:\WINDOWS\SYSTEM32\rqrpqpp.dll
O20 - Winlogon Notify: ssqrp - C:\WINDOWS\system32\ssqrp.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Event Log EventlogSENS (EventlogSENS) - Unknown owner - C:\WINDOWS\system32\ansin.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
you should be aware that you may have been infected by a
backdoor trojan . This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use. Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account. Consider what other private information could possibly have been taken from your computer and take appropriate steps This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.
* Download
VirtumundoBegone , place it on your desktop.
Doubleclick VirtumundoBeGone.exe to start the tool.
Follow the instructions on the screen.
Don't worry if you'll get a Blue screen with an error in it - this is normal.
After reboot,
* Start HijackThis, close all open windows leaving only HijackThis running. Place a
check against each of the following if still present (some entries won't be present anymore):
* Click on
Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!
Delete these files if listed:
C:\WINDOWS\system32\
wuj.dll
C:\WINDOWS\system32\
rqrpqpp.dll
C:\WINDOWS\system32\
ssqrp.dll
C:\WINDOWS\system32\
msuhqmms.dll
C:\WINDOWS\
retadpu1000272.exe
C:\WINDOWS\system32\
rpcc.exe
C:\WINDOWS\system32\
uycgwvwt.dll
C:\WINDOWS\SYSTEM32\
rqrpqpp.dll
C:\WINDOWS\system32\
ssqrp.dll
Empty Recycle Bin
Reboot
Post the contents of the log
VBG.TXT which present on your desktop together with a new
HijackThis log in your next reply.
Logfile of HijackThis v1.99.1
Scan saved at 11:00:12 AM, on 5/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\Spyware.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\msuhqmms.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: pccmsi.lnk = C:\Documents and Settings\John\Desktop\TrendMicroPCCsmall\setup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Event Log EventlogSENS (EventlogSENS) - Unknown owner - C:\WINDOWS\system32\ansin.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
[05/05/2007, 10:50:59] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\John\Desktop\VirtumundoBeGone.exe" )
[05/05/2007, 10:51:02] - Detected System Information:
[05/05/2007, 10:51:02] - Windows Version: 5.1.2600, Service Pack 2
[05/05/2007, 10:51:02] - Current Username: John (Admin)
[05/05/2007, 10:51:02] - Windows is in NORMAL mode.
[05/05/2007, 10:51:02] - Searching for Browser Helper Objects:
[05/05/2007, 10:51:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:02] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:02] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:02] - BHO 3: {15FAC292-47E3-43DC-B097-C479F9D32DC3} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\rqrpqpp
[05/05/2007, 10:51:02] - Found: HKLM\…\Winlogon\Notify\rqrpqpp - This is probably Virtumundo.
[05/05/2007, 10:51:02] - Assigning {15FAC292-47E3-43DC-B097-C479F9D32DC3} MSEvents Object
[05/05/2007, 10:51:02] - BHO list has been changed! Starting over…
[05/05/2007, 10:51:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:02] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:02] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:02] - BHO 3: {15FAC292-47E3-43DC-B097-C479F9D32DC3} (MSEvents Object)
[05/05/2007, 10:51:02] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:02] - BHO 4: {1B595391-E504-4486-972C-3F8856ECDCF7} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\ssqrp
[05/05/2007, 10:51:02] - Found: HKLM\…\Winlogon\Notify\ssqrp - This is probably Virtumundo.
[05/05/2007, 10:51:02] - Assigning {1B595391-E504-4486-972C-3F8856ECDCF7} MSEvents Object
[05/05/2007, 10:51:02] - BHO list has been changed! Starting over…
[05/05/2007, 10:51:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:03] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:03] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:03] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:03] - BHO 3: {15FAC292-47E3-43DC-B097-C479F9D32DC3} (MSEvents Object)
[05/05/2007, 10:51:03] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:03] - BHO 4: {1B595391-E504-4486-972C-3F8856ECDCF7} (MSEvents Object)
[05/05/2007, 10:51:03] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:03] - BHO 5: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 10:51:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:03] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 10:51:03] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 10:51:03] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 10:51:03] - BHO 7: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 10:51:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:03] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 10:51:03] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 10:51:03] - Finished Searching Browser Helper Objects
[05/05/2007, 10:51:03] - *** Detected MSEvents Object
[05/05/2007, 10:51:03] - Trying to remove MSEvents Object…
[05/05/2007, 10:51:04] - Terminating Process: IEXPLORE.EXE
[05/05/2007, 10:51:04] - Terminating Process: RUNDLL32.EXE
[05/05/2007, 10:51:04] - Disabling Automatic Shell Restart
[05/05/2007, 10:51:04] - Terminating Process: EXPLORER.EXE
[05/05/2007, 10:51:04] - Suspending the NT Session Manager System Service
[05/05/2007, 10:51:04] - Terminating Windows NT Logon/Logoff Manager
[05/05/2007, 10:51:11] - Re-enabling Automatic Shell Restart
[05/05/2007, 10:51:11] - File to disable: C:\WINDOWS\system32\rqrpqpp.dll
[05/05/2007, 10:51:11] - Renaming C:\WINDOWS\system32\rqrpqpp.dll -> C:\WINDOWS\system32\rqrpqpp.dll.vir
[05/05/2007, 10:51:11] - File successfully renamed!
[05/05/2007, 10:51:11] - Removing HKLM\…\Browser Helper Objects\{15FAC292-47E3-43DC-B097-C479F9D32DC3}
[05/05/2007, 10:51:11] - Removing HKCR\CLSID\{15FAC292-47E3-43DC-B097-C479F9D32DC3}
[05/05/2007, 10:51:11] - Adding Kill Bit for ActiveX for GUID: {15FAC292-47E3-43DC-B097-C479F9D32DC3}
[05/05/2007, 10:51:11] - Deleting ATLEvents/MSEvents Registry entries
[05/05/2007, 10:51:11] - Removing HKLM\…\Winlogon\Notify\rqrpqpp
[05/05/2007, 10:51:11] - Searching for Browser Helper Objects:
[05/05/2007, 10:51:11] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:11] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:11] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:11] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:11] - BHO 3: {1B595391-E504-4486-972C-3F8856ECDCF7} (MSEvents Object)
[05/05/2007, 10:51:11] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:11] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 10:51:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:11] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 10:51:11] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 10:51:11] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 10:51:11] - BHO 6: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 10:51:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:11] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 10:51:11] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 10:51:11] - Finished Searching Browser Helper Objects
[05/05/2007, 10:51:11] - *** Detected MSEvents Object
[05/05/2007, 10:51:11] - Trying to remove MSEvents Object…
[05/05/2007, 10:51:12] - Terminating Process: IEXPLORE.EXE
[05/05/2007, 10:51:12] - Terminating Process: RUNDLL32.EXE
[05/05/2007, 10:51:12] - Disabling Automatic Shell Restart
[05/05/2007, 10:51:12] - Terminating Process: EXPLORER.EXE
[05/05/2007, 10:51:12] - Suspending the NT Session Manager System Service
[05/05/2007, 10:51:12] - Terminating Windows NT Logon/Logoff Manager
[05/05/2007, 10:51:12] - Re-enabling Automatic Shell Restart
[05/05/2007, 10:51:12] - File to disable: C:\WINDOWS\system32\ssqrp.dll
[05/05/2007, 10:51:12] - Renaming C:\WINDOWS\system32\ssqrp.dll -> C:\WINDOWS\system32\ssqrp.dll.vir
[05/05/2007, 10:51:12] - File successfully renamed!
[05/05/2007, 10:51:12] - Removing HKLM\…\Browser Helper Objects\{1B595391-E504-4486-972C-3F8856ECDCF7}
[05/05/2007, 10:51:12] - Removing HKCR\CLSID\{1B595391-E504-4486-972C-3F8856ECDCF7}
[05/05/2007, 10:51:12] - Adding Kill Bit for ActiveX for GUID: {1B595391-E504-4486-972C-3F8856ECDCF7}
[05/05/2007, 10:51:12] - Deleting ATLEvents/MSEvents Registry entries
[05/05/2007, 10:51:12] - Removing HKLM\…\Winlogon\Notify\ssqrp
[05/05/2007, 10:51:12] - Searching for Browser Helper Objects:
[05/05/2007, 10:51:12] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:12] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:12] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:12] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:12] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 10:51:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:12] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 10:51:12] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 10:51:12] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 10:51:12] - BHO 5: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 10:51:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:12] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 10:51:12] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 10:51:12] - Finished Searching Browser Helper Objects
[05/05/2007, 10:51:12] - Finishing up…
[05/05/2007, 10:51:12] - A restart is needed.
[05/05/2007, 10:51:19] - Attempting to Restart via STOP error (Blue Screen!)
Doubleclick VirtumundoBeGone.exe to start the tool.check against each of the following if still present (some entries won't be present anymore):Fix Checked when finished and exit HijackThis.msuhqmms.dll VBG.TXT which present on your desktop together with a new HijackThis log in your next reply.
[05/05/2007, 10:50:59] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\John\Desktop\VirtumundoBeGone.exe" )
[05/05/2007, 10:51:02] - Detected System Information:
[05/05/2007, 10:51:02] - Windows Version: 5.1.2600, Service Pack 2
[05/05/2007, 10:51:02] - Current Username: John (Admin)
[05/05/2007, 10:51:02] - Windows is in NORMAL mode.
[05/05/2007, 10:51:02] - Searching for Browser Helper Objects:
[05/05/2007, 10:51:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:02] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:02] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:02] - BHO 3: {15FAC292-47E3-43DC-B097-C479F9D32DC3} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\rqrpqpp
[05/05/2007, 10:51:02] - Found: HKLM\…\Winlogon\Notify\rqrpqpp - This is probably Virtumundo.
[05/05/2007, 10:51:02] - Assigning {15FAC292-47E3-43DC-B097-C479F9D32DC3} MSEvents Object
[05/05/2007, 10:51:02] - BHO list has been changed! Starting over…
[05/05/2007, 10:51:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:02] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:02] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:02] - BHO 3: {15FAC292-47E3-43DC-B097-C479F9D32DC3} (MSEvents Object)
[05/05/2007, 10:51:02] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:02] - BHO 4: {1B595391-E504-4486-972C-3F8856ECDCF7} ()
[05/05/2007, 10:51:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:02] - Checking for HKLM\…\Winlogon\Notify\ssqrp
[05/05/2007, 10:51:02] - Found: HKLM\…\Winlogon\Notify\ssqrp - This is probably Virtumundo.
[05/05/2007, 10:51:02] - Assigning {1B595391-E504-4486-972C-3F8856ECDCF7} MSEvents Object
[05/05/2007, 10:51:02] - BHO list has been changed! Starting over…
[05/05/2007, 10:51:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:03] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:03] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:03] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:03] - BHO 3: {15FAC292-47E3-43DC-B097-C479F9D32DC3} (MSEvents Object)
[05/05/2007, 10:51:03] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:03] - BHO 4: {1B595391-E504-4486-972C-3F8856ECDCF7} (MSEvents Object)
[05/05/2007, 10:51:03] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:03] - BHO 5: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 10:51:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:03] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 10:51:03] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 10:51:03] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 10:51:03] - BHO 7: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 10:51:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:03] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 10:51:03] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 10:51:03] - Finished Searching Browser Helper Objects
[05/05/2007, 10:51:03] - *** Detected MSEvents Object
[05/05/2007, 10:51:03] - Trying to remove MSEvents Object…
[05/05/2007, 10:51:04] - Terminating Process: IEXPLORE.EXE
[05/05/2007, 10:51:04] - Terminating Process: RUNDLL32.EXE
[05/05/2007, 10:51:04] - Disabling Automatic Shell Restart
[05/05/2007, 10:51:04] - Terminating Process: EXPLORER.EXE
[05/05/2007, 10:51:04] - Suspending the NT Session Manager System Service
[05/05/2007, 10:51:04] - Terminating Windows NT Logon/Logoff Manager
[05/05/2007, 10:51:11] - Re-enabling Automatic Shell Restart
[05/05/2007, 10:51:11] - File to disable: C:\WINDOWS\system32\rqrpqpp.dll
[05/05/2007, 10:51:11] - Renaming C:\WINDOWS\system32\rqrpqpp.dll -> C:\WINDOWS\system32\rqrpqpp.dll.vir
[05/05/2007, 10:51:11] - File successfully renamed!
[05/05/2007, 10:51:11] - Removing HKLM\…\Browser Helper Objects\{15FAC292-47E3-43DC-B097-C479F9D32DC3}
[05/05/2007, 10:51:11] - Removing HKCR\CLSID\{15FAC292-47E3-43DC-B097-C479F9D32DC3}
[05/05/2007, 10:51:11] - Adding Kill Bit for ActiveX for GUID: {15FAC292-47E3-43DC-B097-C479F9D32DC3}
[05/05/2007, 10:51:11] - Deleting ATLEvents/MSEvents Registry entries
[05/05/2007, 10:51:11] - Removing HKLM\…\Winlogon\Notify\rqrpqpp
[05/05/2007, 10:51:11] - Searching for Browser Helper Objects:
[05/05/2007, 10:51:11] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:11] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:11] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:11] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:11] - BHO 3: {1B595391-E504-4486-972C-3F8856ECDCF7} (MSEvents Object)
[05/05/2007, 10:51:11] - ALERT: Found MSEvents Object!
[05/05/2007, 10:51:11] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 10:51:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:11] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 10:51:11] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 10:51:11] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 10:51:11] - BHO 6: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 10:51:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:11] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 10:51:11] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 10:51:11] - Finished Searching Browser Helper Objects
[05/05/2007, 10:51:11] - *** Detected MSEvents Object
[05/05/2007, 10:51:11] - Trying to remove MSEvents Object…
[05/05/2007, 10:51:12] - Terminating Process: IEXPLORE.EXE
[05/05/2007, 10:51:12] - Terminating Process: RUNDLL32.EXE
[05/05/2007, 10:51:12] - Disabling Automatic Shell Restart
[05/05/2007, 10:51:12] - Terminating Process: EXPLORER.EXE
[05/05/2007, 10:51:12] - Suspending the NT Session Manager System Service
[05/05/2007, 10:51:12] - Terminating Windows NT Logon/Logoff Manager
[05/05/2007, 10:51:12] - Re-enabling Automatic Shell Restart
[05/05/2007, 10:51:12] - File to disable: C:\WINDOWS\system32\ssqrp.dll
[05/05/2007, 10:51:12] - Renaming C:\WINDOWS\system32\ssqrp.dll -> C:\WINDOWS\system32\ssqrp.dll.vir
[05/05/2007, 10:51:12] - File successfully renamed!
[05/05/2007, 10:51:12] - Removing HKLM\…\Browser Helper Objects\{1B595391-E504-4486-972C-3F8856ECDCF7}
[05/05/2007, 10:51:12] - Removing HKCR\CLSID\{1B595391-E504-4486-972C-3F8856ECDCF7}
[05/05/2007, 10:51:12] - Adding Kill Bit for ActiveX for GUID: {1B595391-E504-4486-972C-3F8856ECDCF7}
[05/05/2007, 10:51:12] - Deleting ATLEvents/MSEvents Registry entries
[05/05/2007, 10:51:12] - Removing HKLM\…\Winlogon\Notify\ssqrp
[05/05/2007, 10:51:12] - Searching for Browser Helper Objects:
[05/05/2007, 10:51:12] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 10:51:12] - BHO 2: {14C48A31-37F5-3806-F240-1CE33EEFAD93} ()
[05/05/2007, 10:51:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:12] - Checking for HKLM\…\Winlogon\Notify\wuj
[05/05/2007, 10:51:12] - Key not found: HKLM\…\Winlogon\Notify\wuj, continuing.
[05/05/2007, 10:51:12] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 10:51:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:12] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 10:51:12] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 10:51:12] - BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 10:51:12] - BHO 5: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 10:51:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 10:51:12] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 10:51:12] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 10:51:12] - Finished Searching Browser Helper Objects
[05/05/2007, 10:51:12] - Finishing up…
[05/05/2007, 10:51:12] - A restart is needed.
[05/05/2007, 10:51:19] - Attempting to Restart via STOP error (Blue Screen!)
[05/05/2007, 11:07:58] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\John\Desktop\VirtumundoBeGone.exe" )
[05/05/2007, 11:08:00] - Detected System Information:
[05/05/2007, 11:08:00] - Windows Version: 5.1.2600, Service Pack 2
[05/05/2007, 11:08:00] - Current Username: John (Admin)
[05/05/2007, 11:08:00] - Windows is in NORMAL mode.
[05/05/2007, 11:08:00] - Searching for Browser Helper Objects:
[05/05/2007, 11:08:00] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[05/05/2007, 11:08:00] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/05/2007, 11:08:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 11:08:00] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/05/2007, 11:08:00] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/05/2007, 11:08:00] - BHO 3: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[05/05/2007, 11:08:00] - BHO 4: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/05/2007, 11:08:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/05/2007, 11:08:00] - Checking for HKLM\…\Winlogon\Notify\msuhqmms
[05/05/2007, 11:08:00] - Key not found: HKLM\…\Winlogon\Notify\msuhqmms, continuing.
[05/05/2007, 11:08:00] - Finished Searching Browser Helper Objects
[05/05/2007, 11:08:00] - Finishing up…
[05/05/2007, 11:08:00] - Nothing found! Exiting…
Logfile of HijackThis v1.99.1
Scan saved at 11:12:06 AM, on 5/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Hijackthis\Spyware.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: pccmsi.lnk = C:\Documents and Settings\John\Desktop\TrendMicroPCCsmall\setup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Event Log EventlogSENS (EventlogSENS) - Unknown owner - C:\WINDOWS\system32\ansin.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Click Start > Run > and type in:Event Log EventlogSENS (EventlogSENS) Check in the box on the left side on these: ALL windows and browsers except HijackThis and click "Fix checked" ansin.exe copy/paste " a new HijackThis log file into this thread.
the computer seems to be running fine.
Logfile of HijackThis v1.99.1
Scan saved at 11:23:41 AM, on 5/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Hijackthis\Spyware.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: pccmsi.lnk = C:\Documents and Settings\John\Desktop\TrendMicroPCCsmall\setup.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
You can remove any programs I had you install. Use Add/Remove Programs to remove if listed there otherwise just delete them and empty recycle bin.
Log looks good
You need to create a new
Clean restore point.
Note : This will remove all previous Restore Points
Turn
off System Restore:
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer, turn it back
on.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.
Double-click My Computer.
Click the
Tools menu , and then click
Folder Options .
Click the
View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder,
Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.
If you dont have any programs like these, I would recommend that you get them.
Spywareblaster ,
Spywareguard .
Also get a
FREE FIREWALL and
FREE ANTI VIRUS if you need one.
Only run one Anti-Virus and Firewall program.
It is critical to have both a firewall and anti virus to protect your system.
Keep your system up to date and run
Adaware &
Spybot , once a week works, and hopefully you will be ok from here on. Both are available below.
Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware
Safe Surfing.
I would also suggest you read
this :
So how did I get infected in the first place?
by Tony Klein
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Coyote's Installed programs for prevention:
http://forums.tomcoyote.org/index.php?showtopic=31418
The help you receive here is free. If you wish to show your appreciation, then you may donate
Visit the CoyoteStore
http://TomCoyote.org/coyotestore.php
