This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

What the Hell is this Virus? HELP!

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Believe me, I've seen many trojans, viruses and etc. But this one is a first for me. I can't access my task manager through ctrl-alt-dlt. Even after applying disable to correct the setting, it still doesn't working. It's not even allowing Spybot to fix problems. I'm at my wits end. Please help!!


Logfile of HijackThis v1.99.1
Scan saved at 8:56:49 PM, on 1/28/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\rxjddnvj.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS2\system32\userinit.exe,C:\WINDOWS2\system32\rxjddnvj.exe,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS2\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [mzunexsp] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\mzunexsp.dll"
O4 - HKLM\..\Run: [drmsrv32] C:\DOCUME~1\Chisom\LOCALS~1\Temp\stmhost .exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA3262] command /c del "C:\WINDOWS2\7search.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5660] cmd /c del "C:\WINDOWS2\7search.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1212] command /c del "C:\WINDOWS2\hcwprn.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4241] cmd /c del "C:\WINDOWS2\hcwprn.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3317] command /c del "C:\WINDOWS2\wbeCheck.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4444] cmd /c del "C:\WINDOWS2\wbeCheck.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9451] command /c del "C:\WINDOWS2\kvnab.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5689] cmd /c del "C:\WINDOWS2\kvnab.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9116] command /c del "C:\WINDOWS2\wbeInst$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5704] cmd /c del "C:\WINDOWS2\wbeInst$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2725] command /c del "C:\WINDOWS2\kvnab$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC788] cmd /c del "C:\WINDOWS2\kvnab$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3701] command /c del "C:\WINDOWS2\settn.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4356] cmd /c del "C:\WINDOWS2\settn.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9149] command /c del "C:\WINDOWS2\pbsysie.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9129] cmd /c del "C:\WINDOWS2\pbsysie.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3310] command /c del "C:\WINDOWS2\kvnab.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7916] cmd /c del "C:\WINDOWS2\kvnab.dll_tobedeleted"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Aols] "C:\DOCUME~1\Chisom\APPLIC~1\YMBOLS~1\lsass.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule12] "C:\Program Files\QdrModule\QdrModule12.exe"
O4 - HKCU\..\Run: [Tsh] "C:\Program Files\?dobe\l?ass.exe"
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://aolsvc.aol.com/onlinegames/free-tri…sh.1.0.0.47.cab
O21 - SSODL: Spybot - Search & Destroy_is1 - {77FF30CC-211B-057C-B3F4-8DEE5880FD1F} - c:\program files\spybot - search & destroy\uaynde32.dll
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe" -r (file missing)
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe" -r (file missing)
O23 - Service: Security Service (IIKD) - Unknown owner - C:\WINDOWS2\System32\svcd\svchost.exe

Thanks for any assistance you can give me. I truly appreciate it!!

Chisom
Your post has been Moved, Closed or Edited for one of the following reasons:

1.) You posted multiple topics and only one is required

2.) You are spamming links to other places without approval

3.) You have posted your hijackthis log to the wrong forum:
( http://forums.whatthetech.com/HijackThis_L…emoval_f27.html ) <— correct forum for HijackThis Logs

4.) Abusive language or other problems in your text

5.) Your log is too old (20 days or more) and no replies from you after a volunteer tried to help you

If you came here for help, and you have not posted a Hijackthis log to the proper forum, then you may do so now, if you came here to spam or abuse, you will be dealt with harsher on your next offense

This is a family oriented forum to help those that need help.

==============================

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI