1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

CPU [100% usage] Problems. HJT Log Included

Discussion in 'Malware and Virus Removal Archive' started by paradox, 2006/02/18.

  1. 2006/02/18
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Dear all. I'm currently trying to fix a problem with my PC as the CPU usage keeps jumping up to 100% everytime I use a program such as Spybot or just perform a search. This is causing quite a lot of freezing and crashing. I've done Chkdsk, AVG scan and a ms spyware scan but nothing's helped so far. About a minute ago AVG popped up and told me I had a clicker.fr trojan virus in my C:\\Windows\system32Sphlp32 but couldn't heal or move the file. Does anyone know how to fix this and if it might be what's causing my problem? Anyway here's the logfile that HJT came out with:

    Logfile of HijackThis v1.99.1
    Scan saved at 13:17:23, on 18/02/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\OSD.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Owner\Desktop\New Folder\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R3 - URLSearchHook: (no name) - {8A02054A-793C-6813-ECCF-52B9F3BC9EAA} - browsebar.dll (file missing)
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
    O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus
    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
    O4 - HKLM\..\Run: [dmsld.exe] C:\WINDOWS\System32\dmsld.exe
    O4 - HKLM\..\Run: [jbpmt.exe] C:\WINDOWS\System32\jbpmt.exe
    O4 - HKLM\..\RunOnce: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll ",VerifyStatus /ro
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe "
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\RunServices: [MSN Checker] msnchecker.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Enable Belkin Wireless Keyboard Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    O4 - Global Startup: Enable Belkin Wireless Mouse Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139905850765
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139905835750
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4635/mcfscan.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E6DBAE2-94CA-4DE0-AC26-FB78D9210495}: NameServer = 85.255.114.24 85.255.112.235
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7675FFF5-AFBA-4E6F-AD5D-61B0FB4CA106}: NameServer = 85.255.114.24,85.255.112.235
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

    I'm not very up on any of this stuff at all so if anyone can help me on this I'd be extremely grateful
     
    paradox,
    #1
  2. 2006/02/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi paradox,

    Please download Ewido security suite.
    1. Install Ewido security suite
    2. When installing, under "Additional Options" uncheck..
      • Install background guard
      • Install scan via context menu
    3. Launch Ewido, there should be an icon on your desktop, double-click it.
    4. The program will now open to the main screen.
    5. When you run Ewido for the first time, you may get a warning "Database could not be found! ". Click OK. We will fix this in a moment.
    6. You will need to update Ewido to the latest definition files.
      • On the left hand side of the main screen click update.
      • Then click on Start Update.
    7. The update will start and a progress bar will show the updates being installed.
      (the status bar at the bottom will display "Update successful ")
    If you are having problems with the updater, you can use this link to manually update Ewido.
    Ewido manual updates


    Once the updates are installed do the following:
    • Reboot to safe mode. Logon to your user account.
    • Open Ewido and click on scanner
    • Click on Complete System Scan and the scan will begin.
    • While the scan is in progress you will be prompted to clean files, click OK
    • When/if it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
    • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
    • Click Save report.
    • Save the report .txt file to your desktop, or any other easily accessible location.
    Now close Ewido security suite.

    Click Start>run and type msconfig then hit enter. On the startup tab, make sure ALL entries are checked. Click OK and allow your computer to restart into normal mode.

    Do a new HijackThis scan and post the log, along with the Ewido log.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2006/02/19
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Many thanks for your advice. I have done what you said and below is the logfile from the ewido scan and I'll the new Hikack this log is in the following post. I await your further instruction.

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 17:22:41, 19/02/2006
    + Report-Checksum: 60D34EF4

    + Scan result:

    [184] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning
    [208] VM_00C10000 -> Downloader.Agent.uj : Error during cleaning
    [716] VM_007B0000 -> Downloader.Agent.uj : Error during cleaning
    C:\Documents and Settings\LocalService\Cookies\owner@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.33:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.34:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.35:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.37:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
    :mozilla.38:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
    :mozilla.42:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.43:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.44:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.45:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.46:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.47:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.48:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.51:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.52:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.53:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.57:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.58:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.59:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.61:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.65:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.66:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.67:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.68:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.75:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Realcastmedia : Cleaned with backup
    :mozilla.76:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Realcastmedia : Cleaned with backup
    :mozilla.77:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Realcastmedia : Cleaned with backup
    :mozilla.80:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.81:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.82:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.83:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.84:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.85:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.108:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
    :mozilla.109:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
    :mozilla.113:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
    :mozilla.118:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
    :mozilla.120:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
    :mozilla.124:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
    :mozilla.126:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.127:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.128:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.129:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup
    :mozilla.133:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.134:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.135:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.136:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.137:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.147:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.148:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.149:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.150:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.151:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.155:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
    :mozilla.156:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
    :mozilla.157:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
    :mozilla.200:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.201:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.202:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.203:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.204:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.215:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
    :mozilla.216:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.217:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.218:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.219:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
    :mozilla.225:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
    :mozilla.226:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
    :mozilla.237:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
    :mozilla.238:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    C:\Documents and Settings\Owner\Cookies\owner@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup
    C:\Documents and Settings\Owner\Cookies\owner@sel.as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup
    C:\WINDOWS\antyvirk.exe -> Heuristic.Win32.Dialer : Cleaned with backup
    C:\WINDOWS\system32\c.bat -> Trojan.Zapchast : Cleaned with backup
    C:\WINDOWS\system32\howiper.exe -> Trojan.Small.gq : Cleaned with backup


    ::Report End
     
    paradox,
    #3
  5. 2006/02/19
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Hello again! Here is the new Hijack this logfile:

    Logfile of HijackThis v1.99.1
    Scan saved at 17:29:34, on 19/02/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\WINDOWS\soundman.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\OSD.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Documents and Settings\Owner\Desktop\New Folder\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R3 - URLSearchHook: (no name) - {8A02054A-793C-6813-ECCF-52B9F3BC9EAA} - browsebar.dll (file missing)
    F3 - REG:win.ini: load=??? ??? ??? ? ? ??????????????4???????????
    F3 - REG:win.ini: run=??? ??? ??? ? ? ??????????????4???????????
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe "
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\RunServices: [MSN Checker] msnchecker.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Enable Belkin Wireless Keyboard Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    O4 - Global Startup: Enable Belkin Wireless Mouse Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139905850765
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139905835750
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4635/mcfscan.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7675FFF5-AFBA-4E6F-AD5D-61B0FB4CA106}: NameServer = 85.255.114.24,85.255.112.235
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
     
    paradox,
    #4
  6. 2006/02/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please scan again with HJT and place a check next to the following entries, close all other windows and click 'Fix Checked'.

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R3 - URLSearchHook: (no name) - {8A02054A-793C-6813-ECCF-52B9F3BC9EAA} - browsebar.dll (file missing)
    F3 - REG:win.ini: load=??? ??? ??? ? ? ??????????????4???????????
    F3 - REG:win.ini: run=??? ??? ??? ? ? ??????????????4???????????
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\RunServices: [MSN Checker] msnchecker.exe
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\

    Close HJT.

    Do a file search (likely C:\Windows\system32) for msnchecker.exe and delete if found.

    Reboot and note if you experience and problems/messages.

    Please go HERE to run Panda's ActiveScan
    • Once you are on the Panda site click the Scan your PC button
    • A new window will open...click the Check Now button
    • Enter your Country
    • Enter your State/Province
    • Enter your e-mail address and click send
    • Select either Home User or Company
    • Click the big Scan Now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • When download is complete, click on My Computer to start the scan
    • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report along with a new HJT log.
     
    noahdfear,
    #5
  7. 2006/02/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Oh.....you also need to open the Java Plugin in the Control Panel and update. Once the latest version is installed, remove any old versions from Add/Remove programs.
     
    noahdfear,
    #6
  8. 2006/02/19
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Hi there. I have just finished following what you advised me to do. Below is the report from the panda scan and in the next post is the latest HJT logfile. Thanking you once again in advance of your consistant helpfulness.

    Incident Status Location

    Adware:adware/sbsoft Not disinfected C:\WINDOWS\rdt.ini
    Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Owner\Cookies\owner@xmts[1].txt
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.mediaplex.com/]
    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.realmedia.com/]
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.fastclick.net/]
    Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.z1.adserver.com/]
    Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.realmedia.com/]
    Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.fastclick.net/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.atdmt.com/]
    Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.advertising.com/]
    Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.tribalfusion.com/]
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.doubleclick.net/]
    Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.bluestreak.com/]
    Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.xmts.net/]
    Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.valueclick.com/]
    Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.adopt.hbmediapro.com/]
    Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.winfixer.com/]
    Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[.maxserving.com/]
    Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\efdvbmab.default\cookies.txt[]
    Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Owner\Cookies\owner@xmts[1].txt
    Virus:W32/Sdbot.ftp Disinfected C:\WINDOWS\system32\i
    Virus:W32/Sdbot.FQF.worm Disinfected C:\WINDOWS\system32\TFTP3116
     
    paradox,
    #7
  9. 2006/02/19
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    And here is the new HJT logfile

    Logfile of HijackThis v1.99.1
    Scan saved at 22:56:42, on 19/02/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\WINDOWS\soundman.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\OSD.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Owner\Desktop\New Folder\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe "
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Enable Belkin Wireless Keyboard Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    O4 - Global Startup: Enable Belkin Wireless Mouse Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139905850765
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139905835750
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4635/mcfscan.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E6DBAE2-94CA-4DE0-AC26-FB78D9210495}: NameServer = 85.255.114.24 85.255.112.235
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7675FFF5-AFBA-4E6F-AD5D-61B0FB4CA106}: NameServer = 85.255.114.24,85.255.112.235
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
     
    paradox,
    #8
  10. 2006/02/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Scan again with HJT and fix the following entries with all other Windows closed.

    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E6DBAE2-94CA-4DE0-AC26-FB78D9210495}: NameServer = 85.255.114.24 85.255.112.235
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7675FFF5-AFBA-4E6F-AD5D-61B0FB4CA106}: NameServer = 85.255.114.24,85.255.112.235


    Go to the Control Panel. - If you are using Windows XP's Category View, select the Network and Internet Connections category. If you are in Classic View, go to the next step .
    " Double-click the Network Connections icon
    " Right-click the Local Area Connection icon and select Properties.
    " Hilight Internet Protocol (TCP/IP) and click the Properties button.
    " Be sure Obtain DNS server address automatically is selected.
    " OK your way out.

    * Go to Start > Run and type in cmd
    " Click OK.
    " This will open a commad prompt.
    " Type or copy and paste the following line in the command window:

    ipconfig /flushdns (that space between g and / is needed)

    " Hit Enter
    " Exit the command window

    Open C:\Documents and Settings\Owner\Cookies, select all from Edit on the toolbar, then delete.
    Open C:\WINDOWS and delete the file rdt.ini
    Empty the recycle bin.
    Reboot.

    Post one more new HJT log. Are you still experiencing high CPU usage? Does AVG still report an infected file?
     
    noahdfear,
    #9
  11. 2006/02/20
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Thanks again. Unfortunately I can't delete the cookies. It says they're being used by another program or person and won't let me get rid of them. Not sure what else to do. Please advise. New HJT log below but like i said It won't let me delete cookies in documents and settings/owners:

    Logfile of HijackThis v1.99.1
    Scan saved at 00:01:54, on 21/02/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\WINDOWS\soundman.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\OSD.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Owner\Desktop\New Folder\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe "
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Enable Belkin Wireless Keyboard Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
    O4 - Global Startup: Enable Belkin Wireless Mouse Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139905850765
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139905835750
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4635/mcfscan.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E6DBAE2-94CA-4DE0-AC26-FB78D9210495}: NameServer = 85.255.114.24 85.255.112.235
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
     
    paradox,
    #10
  12. 2006/02/20
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Close all IE windows and open Internet Options in the Control Panel. Click Delete Cookies and click OK, then Delete Files, checking the box for offline content.

    How is your computer performing? CPU usage still high?
     
    noahdfear,
    #11
  13. 2006/02/21
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Unfortunately the CPU usage is still rising to 100% and crashing if I use Ad-aware or Spybot. I haven't tried Photoshop as of yet but it has a habit of jamming up there too. It goes back down to normal levels when I close them though. Right now for instance it's at about 4%.
     
    paradox,
    #12
  14. 2006/02/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please try disabling (end process) some of your running processes before trying to scan. MS Antispyware would be a good first candidate. Is it the programs themselves that spike the CPU usage, or is a different process peaking as well when they are used?
     
    noahdfear,
    #13
  15. 2006/02/22
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Many thanks, I'll try this when I get back from work but I'm not too sure it'll work because I think I remember trying to run the programs in safe mode when there were no background processes going on.

    However, a few hours ago (last night where I am), I discovered something else going on. If I open up IE, go to yahoo and type in Windows BBS, for example, I wouldn't get to the Windows BBS website by clicking on that link, but end up on a sponsor-based search engine style website instead, and this happens almost everytime. I only noticed it recently because I use Firefox quite a lot instead. Also, through a typo with autocomplete, I saw a housemates email address come up, who must have used my PC without my knowledge. I'm not sure if these things are connected though. I'll post back once I get home and try the programs without proccesses again. Thanks for your continuing level of assistance.
     
    paradox,
    #14
  16. 2006/03/07
    paradox

    paradox Inactive Thread Starter

    Joined:
    2006/02/16
    Messages:
    12
    Likes Received:
    0
    Hi, I've been away for a little while. Unfotunately my PC is still playing up and I can't seem to find the problem within the processes. I've tried stopping proceesses that aren't crucial but programs (especially Adaware) are still jamming and crashing due to them sending my CPU usage to 100%. I'm now close to throwing the thing out the window! If you have any further suggestions I'd be most grateful.
     
    paradox,
    #15

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...