tugboat
Topic Starter
Would you believe it? I opened an email from irs.gov and my IE browser got whacked by sw that diverts it to a search engine I don't want. It only gets worse. Here's my log. I will go to hijackthis and see if it helps. If you know of this virus of whatever it's called and how to remove it, please let me know. Thanks, TSHijackthis log
Logfile of HijackThis v1.99.1
Scan saved at 10:05:41 PM, on 6/24/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\LEXBCES.EXE
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\LEXPPS.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\WINNT\system32\bgsvcgen.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\cisvc.exe
D:\WINNT\System32\svchost.exe
c:\jetsuite\jsdaemon.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\WINNT\System32\cidaemon.exe
D:\WINNT\system32\NOTEPAD.EXE
D:\WINNT\system32\wuauclt.exe
D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
D:\WINNT\tppaldr.exe
D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
D:\PROGRA~1\VISION~1\ONETOU~2.EXE
D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Picasa2\PicasaMediaDetector.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\Program Files\iPod\bin\iPodService.exe
C:\jetsuite\JETSTAT.EXE
D:\Program Files\Common Files\efax\dllcmd32.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
D:\Program Files\Handspring\HOTSYNC.EXE
c:\jetsuite\JSFMAN.EXE
D:\Program Files\Plus!\Microsoft Internet\Iexplore.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Plus!\Microsoft Internet\Iexplore.exe
F:\Program Files\OFFICE11\OUTLOOK.EXE
C:\unzipped\hijackthis[1]\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigmtn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] D:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [projselector] "D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [OneTouch Monitor] D:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OM_Monitor] D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [OM_Monitor] D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: hotsync manager.lnk = D:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: HP LaserJet 3150 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Live Menu.lnk = D:\Program Files\Common Files\efax\dllcmd32.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: QuickBooks Update Agent.lnk.disabled
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - D:\WINNT\System32\shdocvw.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O13 - WWW. Prefix: http://
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F4A1DC8A-3D7A-4C28-A5B6-C624B814A702} (Control Panel FileManager Uploader) - https://cp.aplus.net/tools/fileman/FileMan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D17829C-5949-429C-B4CF-4F6D7D68067A}: NameServer = 85.255.115.26,85.255.112.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{9489E73D-6711-4D40-902C-B7E22D041DBE}: NameServer = 85.255.115.26,85.255.112.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2068969-7272-4D34-A74B-FA7E25DB37B1}: NameServer = 85.255.115.26,85.255.112.110
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.90 85.255.112.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D17829C-5949-429C-B4CF-4F6D7D68067A}: NameServer = 85.255.113.90,85.255.112.5
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.26 85.255.112.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D17829C-5949-429C-B4CF-4F6D7D68067A}: NameServer = 85.255.115.26,85.255.112.110
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.26 85.255.112.110
O17 - HKLM\System\CS3\Services\Tcpip\..\{0D17829C-5949-429C-B4CF-4F6D7D68067A}: NameServer = 85.255.115.26,85.255.112.110
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.26 85.255.112.110
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - D:\WINNT\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: jsdaemon - JetFax, Inc. - c:\jetsuite\jsdaemon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINNT\system32\LEXBCES.EXE
Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please
Reg Entries that were deleted
…
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…
PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»» Searching by size/names…
»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects.
Directory of D:\WINNT\system32
»»»»» Misc files.
»»»»» Checking for older varients covered by the Rem3 tool.
If you still need help, I am working on your log and will have some suggestions momentarily.
Thank you for your patience. Things are very busy here and it is often hard to help everyone swiftly.
Looks like it did its job.
I still need a new HJT log though…
but there's a stubborn one. 
The last 2 017s.