What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[help Needed] Hijackthis Log

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hey I've been getting a Priceline.com pop up and it has become a nuisance. I am running an AMD X2 4800+ with 1.25 gig ram and Windows XP Professional SP2. Here is my HJ log:

Logfile of HijackThis v1.99.1
Scan saved at 10:01:36 PM, on 5/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\Windows\System32\smss.exe
D:\Windows\system32\csrss.exe
D:\Windows\system32\winlogon.exe
D:\Windows\system32\services.exe
D:\Windows\system32\lsass.exe
D:\Windows\system32\svchost.exe
D:\Windows\system32\svchost.exe
D:\Windows\System32\svchost.exe
D:\Windows\system32\svchost.exe
D:\Windows\system32\svchost.exe
D:\Windows\system32\spoolsv.exe
D:\Windows\System32\alg.exe
D:\Windows\Explorer.EXE
D:\Windows\CTHELPER.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Windows\system32\nvraidservice.exe
D:\Windows\SOUNDMAN.EXE
D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
D:\PROGRA~1\MSNMES~1\msnmsgr.exe
D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Windows\System32\svchost.exe
D:\Program Files\AIM\aim.exe
D:\Windows\system32\rundll32.exe
D:\Program Files\MSN\MSNCoreFiles\msn6.exe
D:\Windows\Explorer.EXE
D:\Program Files\Winamp\winamp.exe
D:\WINDOWS\system32\NOTEPAD2.EXE
D:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
D:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] D:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [nTrayFw] D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [setup] rundll32.exe "D:\Windows\system32\ixcaftot.dll",realset
O4 - HKCU\..\Run: [TaskSwitchXP] D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all by Free Download Manager - file://D:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download All Files by HiDownload - D:\PROGRA~1\HIDOWN~1\HDGetAll.htm
O8 - Extra context menu item: Download by Free Download Manager - file://D:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download by HiDownload - D:\PROGRA~1\HIDOWN~1\HDGet.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://D:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://D:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - D:\PROGRA~1\HIDOWN~1\hidownload.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\Windows\system32\WPDShServiceObj.dll
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - d:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Post #2
Hello,

I notice that you do not seem to be running Antivirus software and a Firewall. This is somewhat suicidal in today's digital world.
That's why I want you to install them first!!

Avira, AVG OR Active Virus Shield (uncheck the Security Toolbar during install) are good FREE antivirus.
Never install more than one antivirusscanner or firewall on your system! Several together can give problems and decrease the reliability of it seriously!
Comodo OR Kerio are FREE firewalls.

Understanding and using firewalls

Reboot your computer afterwards.
After reboot, perform a full scan with your Antivirus and let it remove anything it is finding. Then reboot once again in order to delete files that were in use previously.

Post a new HijackThislog in your next reply - then we'll start from there, because it really makes no sense otherwise that we clean this up manually if an Antivirusscan is not present which should be able to deal with most and prevent further reinfection.
Post #3
Thanks for the save miekiemoes! Loaded up the firewall and Anti-virus and removed 3 viruses. Here is my new log:

Logfile of HijackThis v1.99.1
Scan saved at 11:20:40 AM, on 5/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\Windows\System32\smss.exe
D:\Windows\system32\winlogon.exe
D:\Windows\system32\services.exe
D:\Windows\system32\lsass.exe
D:\Windows\system32\svchost.exe
D:\Windows\System32\svchost.exe
D:\Windows\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\Program Files\Comodo\Firewall\cmdagent.exe
D:\Windows\Explorer.EXE
D:\Windows\CTHELPER.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Windows\system32\nvraidservice.exe
D:\Windows\SOUNDMAN.EXE
D:\Program Files\Comodo\Firewall\CPF.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
D:\PROGRA~1\MSNMES~1\msnmsgr.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Windows\system32\wuauclt.exe
D:\Program Files\MSN\MSNCoreFiles\msn6.exe
D:\Program Files\AIM\aim.exe
D:\Windows\Explorer.EXE
D:\Windows\system32\rundll32.exe
D:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] D:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [nTrayFw] D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [setup] rundll32.exe "D:\Windows\system32\ixcaftot.dll",realset
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [TaskSwitchXP] D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all by Free Download Manager - file://D:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download All Files by HiDownload - D:\PROGRA~1\HIDOWN~1\HDGetAll.htm
O8 - Extra context menu item: Download by Free Download Manager - file://D:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download by HiDownload - D:\PROGRA~1\HIDOWN~1\HDGet.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://D:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://D:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - D:\PROGRA~1\HIDOWN~1\hidownload.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - D:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - d:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Post #4
Hi,

I see you had previously the NVIDIA firewall installed, but it seems like you removed it manually. We'll have to get rid of the leftovers in the registry as well.

But first,

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O4 - HKLM\..\Run: [setup] rundll32.exe "D:\Windows\system32\ixcaftot.dll",realset

* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Then, go to start > run and copy and paste next commands in the field:

sc delete IAM Hit enter

sc delete nSvcIp Hit enter

sc delete nSvcLog Hit enter

Above commands should remove the remaining services related with Nvidia Firewall from your registry (the Nvidia Firewall is actually known to cause a lot of problems by the way)

Then…. * Download Combofix to your desktop.
Doubleclick combofix.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
Do NOT post the ComboFix-quarantined-files.txt - unless I ask you to.
Post #5
Here ya go:

"Micah" - 2007-05-24 14:39:55 Service Pack 2
ComboFix 07-05.24.7.V - Running from: "D:\Documents and Settings\Micah\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


D:\Windows\system32\awvvv.dll
D:\Windows\system32\ixcaftot.dll
D:\WINDOWS\AppPatch\hardcat.dll
D:\Windows\system32\jhklnbpq.exe
D:\Windows\system32\vvvwa.ini
D:\Windows\system32\totfacxi.ini


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"D:\Windows\AppPatch\ntp2.ini"

Purity Folders:

D:\WINDOWS\SKS~1



((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_NM
——-\nm


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-24 ))))))))))))))))))))))))))))))))))


2007-05-24 11:17 d——– D:\DOCUME~1\Micah\APPLIC~1\Comodo
2007-05-24 11:17 d——– D:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-05-24 08:52 d——– D:\Program Files\Comodo
2007-05-23 21:48 d——– D:\Program Files\ZSoft
2007-05-23 14:05 263,220 ——— D:\WINDOWS\system32\vturp.dll
2007-05-23 12:03 d–hs—- D:\UWA7P
2007-05-23 12:02 d——– D:\DOCUME~1\Micah\APPLIC~1\WinAntiVirus Pro 2007
2007-05-23 12:01 8,704 –a—— D:\WINDOWS\system32\SpOrder.dll
2007-05-23 12:01 24,064 –a—— D:\WINDOWS\system32\msxml3a.dll
2007-05-23 12:01 d——– D:\Program Files\Common Files\WinAntiVirus Pro 2007
2007-05-23 11:50 d——– D:\WINDOWS\system32\T1QaSQ
2007-04-29 13:54 126,976 –a—— D:\WINDOWS\ctpu.exe
2007-04-29 13:54 d——– D:\Program Files\BEIKS
2007-04-29 13:53 196,608 –a—— D:\WINDOWS\ResEnu.RIM.dll
2007-04-27 12:45 d——– D:\Program Files\Guitar Pro 5
2007-04-25 13:25 d——– D:\Program Files\AC3Filter


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-24 05:12:14 1,528 —-a-w D:\Windows\system32\d3d9caps.dat
2007-05-23 18:51:16 ——– d—–w D:\DOCUME~1\Micah\APPLIC~1\Azureus
2007-05-21 19:24:32 ——– d—–w D:\Program Files\HiDownload
2007-05-06 18:34:45 ——– d—–w D:\Program Files\Common Files\Research In Motion
2007-04-19 04:41:22 ——– d—–w D:\Program Files\Steam
2007-04-14 18:43:25 ——– d—–w D:\Program Files\Lavasoft
2007-04-14 18:43:11 ——– d—–w D:\DOCUME~1\Micah\APPLIC~1\Lavasoft
2007-04-14 18:42:58 ——– d—–w D:\Program Files\Common Files\Wise Installation Wizard
2007-04-14 18:32:13 ——– d—–w D:\Program Files\Security Task Manager
2007-04-14 18:29:45 46 —-a-w D:\Windows\system32\DonationCoder_urlsnooper_InstallInfo.dat
2007-04-14 18:29:32 ——– d—–w D:\Program Files\Ultra Video To Flash Converter
2007-04-14 18:29:29 ——– d—–w D:\Program Files\Total Video Converter
2007-04-14 18:28:24 ——– d—–w D:\Program Files\OpenSource Flash Video Splitter
2007-04-14 18:27:18 ——– d—–w D:\Program Files\Absolute Video Converter
2007-04-14 18:25:53 ——– d—–w D:\Program Files\Windows Media Connect 2
2007-04-14 04:26:44 ——– d—–w D:\DOCUME~1\Micah\APPLIC~1\InstallShield
2007-04-12 19:14:35 ——– d–h–w D:\Program Files\InstallShield Installation Information
2007-04-12 18:01:48 ——– d—–w D:\Program Files\Azureus
2007-03-18 21:32:45 18,360 —-a-w D:\DOCUME~1\Micah\APPLIC~1\GDIPFONTCACHEV1.DAT
2006-04-27 17:24:24 ——– –sha-r D:\Windows\system32\Smab.dll
2005-10-24 19:13:58 ——– –sha-r D:\Windows\MOTA113.exe
2005-10-14 05:27:00 ——– –sha-r D:\Windows\x2.64.exe
2005-10-08 03:14:52 ——– –sha-r D:\Windows\system32\avisynth.dll
2005-07-14 19:31:20 ——– –sha-r D:\Windows\system32\AVSredirect.dll
2005-06-26 22:32:28 ——– –sha-r D:\Windows\system32\cygwin1.dll
2005-06-22 05:37:42 ——– –sha-r D:\Windows\system32\cygz.dll
2005-05-14 01:12:00 ——– –sha-r D:\Windows\meta4.exe
2005-02-28 20:16:22 ——– –sha-r D:\Windows\system32\x.264.exe
2004-01-25 08:00:00 ——– –sha-r D:\Windows\system32\yv12vfw.dll
2004-01-25 08:00:00 ——– –sha-r D:\Windows\system32\i420vfw.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 10:12]
{2432F099-F8E2-43C9-B765-3AF002FFC6A7}=D:\Windows\system32\opnomno.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" []
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2006-12-07 12:38]
"NVRaidService"="D:\Windows\system32\nvraidservice.exe" [2005-01-17 13:43]
"nTrayFw"="D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" []
"SoundMan"="SOUNDMAN.EXE" []
"COMODO Firewall Pro"="D:\Program Files\Comodo\Firewall\CPF.exe" [2007-05-24 08:52]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-05-24 08:53]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11]
"msnmsgr"="D:\PROGRA~1\MSNMES~1\msnmsgr.exe" [2005-10-12 17:13]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-25 19:11]
"Steam"="" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
"nlhr"=RunDll32.exe %SystemRoot%\System32\AdvPack.Dll,LaunchINFSection %SystemRoot%\inf\nlite.inf,C
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"TaskSwitchXP"=D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"=1 (0x1)
"ForceClassicControlPanel"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSharedDocuments"=1 (0x1)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoSMHelp"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSharedDocuments"=1 (0x1)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoSMHelp"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{2432F099-F8E2-43C9-B765-3AF002FFC6A7}"="D:\Windows\system32\opnomno.dll" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnomno]
opnomno.dll



~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070524-143730-306
O1 - Hosts: 66.98.148.65 auto.search.msn.com

backup-20070524-143730-398
O4 - HKLM\..\Run: [setup] rundll32.exe "D:\Windows\system32\ixcaftot.dll",realset

backup-20070524-143730-223
O1 - Hosts: 66.98.148.65 auto.search.msn.es
Contents of the 'Scheduled Tasks' folder
2007-05-21 05:42:00 D:\Windows\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-24 14:48:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-24 14:49:36 - machine was rebooted
D:\ComboFix-quarantined-files.txt … 2007-05-24 14:49

— E O F —
Post #6 last edited
Hi,

Please set your system to show all files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Please hide your hidden files and folders afterwards again, when we are done with this thread and your problems are solved, because above instructions to set your system to show all files, unhide legit files and folders as well.
And I don't want you to delete them because they may look suspicious. To hide them again, just perform the above instructions in the opposite way.

Delete next file and folders:

D:\WINDOWS\system32\vturp.dll <== file
D:\UWA7P <== folder
D:\DOCUMENTS AND SETTINGS\Micah\APPLICATION DATA\WinAntiVirus Pro 2007 <== folder
D:\Program Files\Common Files\WinAntiVirus Pro 2007 <== folder
D:\WINDOWS\system32\T1QaSQ <== folder

Open notepad and copy and paste next present in the quotebox below in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{2432F099-F8E2-43C9-B765-3AF002FFC6A7}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnomno]

[-HKEY_CLASSES_ROOT\CLSID\{2432F099-F8E2-43C9-B765-3AF002FFC6A7}]

Save this as fix.reg Choose to save as *all files and place it on your desktop.
It should look like this: [external image: Posted Image]
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.
(In case you are unsure how to create a reg file, take a look here with screenshots.)

Post a new HijackThislog in your next reply.
Post #7
Here is the new log:

Logfile of HijackThis v1.99.1
Scan saved at 3:12:21 PM, on 5/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\Windows\System32\smss.exe
D:\Windows\system32\winlogon.exe
D:\Windows\system32\services.exe
D:\Windows\system32\lsass.exe
D:\Windows\system32\svchost.exe
D:\Windows\System32\svchost.exe
D:\Windows\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\Program Files\Comodo\Firewall\cmdagent.exe
D:\Windows\Explorer.EXE
D:\Windows\CTHELPER.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Windows\system32\nvraidservice.exe
D:\Windows\SOUNDMAN.EXE
D:\Program Files\Comodo\Firewall\CPF.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
D:\PROGRA~1\MSNMES~1\msnmsgr.exe
D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\AIM\aim.exe
D:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2432F099-F8E2-43C9-B765-3AF002FFC6A7} - (no file)
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] D:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [nTrayFw] D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [TaskSwitchXP] D:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all by Free Download Manager - file://D:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download All Files by HiDownload - D:\PROGRA~1\HIDOWN~1\HDGetAll.htm
O8 - Extra context menu item: Download by Free Download Manager - file://D:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download by HiDownload - D:\PROGRA~1\HIDOWN~1\HDGet.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://D:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://D:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - D:\PROGRA~1\HIDOWN~1\hidownload.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\Windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - D:\Windows\system32\cisvc.exe (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - D:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - d:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Post #8
Hi,

Check and fix next leftover in HijackThis:

O2 - BHO: (no name) - {2432F099-F8E2-43C9-B765-3AF002FFC6A7} - (no file)

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u1.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u1".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    • Java 2 Runtime Environment, SE v1.4.2
    • J2SE Runtime Environment 5.0
    • J2SE Runtime Environment 5.0 Update 6
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
Can you also perform next command again via start > run?
You really have to copy and paste

sc delete IAM Hit enter

Also, wonder how this one got missing suddenly:

O23 - Service: Indexing Service (CiSvc) - Unknown owner - D:\Windows\system32\cisvc.exe (file missing)

Have you been deleting the cisvc.exe ? Because that's a legit file
Can you check if there are other instances of cisvc.exe still present on your system? Most probably present in the hidden dllcache. Because you have to copy it back to your C:\Windows\system32 - folder

Let me know in your next reply how things are now.
Post #9
Well I completed the Fix and Java tasks. I also entered the run command again as well. I haven't deleted a single thing manually off this computer–only the files removed by AVG (none of which were cisvc.exe). Also, there are no instances of cisvc.exe on my computer or in the dllcache. Is there a way I can download this file online if it is desperately needed? Also, do you need an updated HijackThis log?
Post #10
Hi,

I don't recommend you download it online. Or you can use your XP cd to get it and run the sfc /scannow command. Or get it from another computer with XP Service Pack 2 installed.
This is what the file is:

Description:
cisvc.exe is a process that belongs to the Microsoft Windows Operating System. It is used to monitor the memory usage in CIDAEMON.exe and prevent low memory problems

No need to post a new HijackThislog, it was already clean.

How are things now? Popups gone?
Post #11
I will definitely dig out my XP cd and grab it off that. Things are going great. No more popups. Thanks a ton for all your support!
Post #12
Glad I could help. :)

Please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.

Happy Surfing again!
Post #13
Since this issue appears resolved … this Topic is closed. If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI