Chisom
Topic Starter
Believe me, I've seen many trojans, viruses and etc. But this one is a first for me. I can't access my task manager through ctrl-alt-dlt. Even after applying disable to correct the setting, it still doesn't working. It's not even allowing Spybot to fix problems. I'm at my wits end. Please help!!
Logfile of HijackThis v1.99.1
Scan saved at 8:56:49 PM, on 1/28/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\rxjddnvj.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS2\system32\userinit.exe,C:\WINDOWS2\system32\rxjddnvj.exe,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS2\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [mzunexsp] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\mzunexsp.dll"
O4 - HKLM\..\Run: [drmsrv32] C:\DOCUME~1\Chisom\LOCALS~1\Temp\stmhost .exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA3262] command /c del "C:\WINDOWS2\7search.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5660] cmd /c del "C:\WINDOWS2\7search.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1212] command /c del "C:\WINDOWS2\hcwprn.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4241] cmd /c del "C:\WINDOWS2\hcwprn.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3317] command /c del "C:\WINDOWS2\wbeCheck.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4444] cmd /c del "C:\WINDOWS2\wbeCheck.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9451] command /c del "C:\WINDOWS2\kvnab.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5689] cmd /c del "C:\WINDOWS2\kvnab.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9116] command /c del "C:\WINDOWS2\wbeInst$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5704] cmd /c del "C:\WINDOWS2\wbeInst$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2725] command /c del "C:\WINDOWS2\kvnab$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC788] cmd /c del "C:\WINDOWS2\kvnab$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3701] command /c del "C:\WINDOWS2\settn.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4356] cmd /c del "C:\WINDOWS2\settn.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9149] command /c del "C:\WINDOWS2\pbsysie.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9129] cmd /c del "C:\WINDOWS2\pbsysie.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3310] command /c del "C:\WINDOWS2\kvnab.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7916] cmd /c del "C:\WINDOWS2\kvnab.dll_tobedeleted"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Aols] "C:\DOCUME~1\Chisom\APPLIC~1\YMBOLS~1\lsass.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule12] "C:\Program Files\QdrModule\QdrModule12.exe"
O4 - HKCU\..\Run: [Tsh] "C:\Program Files\?dobe\l?ass.exe"
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://aolsvc.aol.com/onlinegames/free-tri…sh.1.0.0.47.cab
O21 - SSODL: Spybot - Search & Destroy_is1 - {77FF30CC-211B-057C-B3F4-8DEE5880FD1F} - c:\program files\spybot - search & destroy\uaynde32.dll
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe" -r (file missing)
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe" -r (file missing)
O23 - Service: Security Service (IIKD) - Unknown owner - C:\WINDOWS2\System32\svcd\svchost.exe
Thanks for any assistance you can give me. I truly appreciate it!!
Chisom
Logfile of HijackThis v1.99.1
Scan saved at 8:56:49 PM, on 1/28/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\rxjddnvj.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS2\system32\userinit.exe,C:\WINDOWS2\system32\rxjddnvj.exe,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS2\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [mzunexsp] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\mzunexsp.dll"
O4 - HKLM\..\Run: [drmsrv32] C:\DOCUME~1\Chisom\LOCALS~1\Temp\stmhost .exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA3262] command /c del "C:\WINDOWS2\7search.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5660] cmd /c del "C:\WINDOWS2\7search.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1212] command /c del "C:\WINDOWS2\hcwprn.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4241] cmd /c del "C:\WINDOWS2\hcwprn.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3317] command /c del "C:\WINDOWS2\wbeCheck.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4444] cmd /c del "C:\WINDOWS2\wbeCheck.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9451] command /c del "C:\WINDOWS2\kvnab.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5689] cmd /c del "C:\WINDOWS2\kvnab.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9116] command /c del "C:\WINDOWS2\wbeInst$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5704] cmd /c del "C:\WINDOWS2\wbeInst$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2725] command /c del "C:\WINDOWS2\kvnab$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC788] cmd /c del "C:\WINDOWS2\kvnab$.exe_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3701] command /c del "C:\WINDOWS2\settn.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4356] cmd /c del "C:\WINDOWS2\settn.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9149] command /c del "C:\WINDOWS2\pbsysie.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9129] cmd /c del "C:\WINDOWS2\pbsysie.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3310] command /c del "C:\WINDOWS2\kvnab.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7916] cmd /c del "C:\WINDOWS2\kvnab.dll_tobedeleted"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Aols] "C:\DOCUME~1\Chisom\APPLIC~1\YMBOLS~1\lsass.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule12] "C:\Program Files\QdrModule\QdrModule12.exe"
O4 - HKCU\..\Run: [Tsh] "C:\Program Files\?dobe\l?ass.exe"
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS2\web\related.htm
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://aolsvc.aol.com/onlinegames/free-tri…sh.1.0.0.47.cab
O21 - SSODL: Spybot - Search & Destroy_is1 - {77FF30CC-211B-057C-B3F4-8DEE5880FD1F} - c:\program files\spybot - search & destroy\uaynde32.dll
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe" -r (file missing)
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp .exe" -r (file missing)
O23 - Service: Security Service (IIKD) - Unknown owner - C:\WINDOWS2\System32\svcd\svchost.exe
Thanks for any assistance you can give me. I truly appreciate it!!
Chisom