November 20, 200718 yr Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 9:48:07 PM, on 11/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss[Caution] C:\WINDOWS\system32\csrss[Caution] C:\WINDOWS\system32\winlogon[Caution] C:\WINDOWS\system32\services[Caution] C:\WINDOWS\system32\lsass[Caution] C:\WINDOWS\system32\svchost[Caution] C:\WINDOWS\system32\svchost[Caution] C:\WINDOWS\System32\svchost[Caution] C:\WINDOWS\system32\svchost[Caution] C:\WINDOWS\system32\svchost[Caution] C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution] C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution] C:\WINDOWS\system32\spoolsv[Caution] C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon[Caution] C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc[Caution] C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd[Caution] C:\Program Files\Norton AntiVirus\navapsvc[Caution] C:\Program Files\Norton AntiVirus\IWP\NPFMntor[Caution] C:\WINDOWS\system32\svchost[Caution] C:\WINDOWS\system32\wdfmgr[Caution] C:\WINDOWS\System32\alg[Caution] C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution] C:\WINDOWS\SOUNDMAN[Caution] C:\Program Files\HP\HP Software Update\HPWuSchd2[Caution] C:\Program Files\Java\jre1.6.0_03\bin\jusched[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\WINDOWS\system32\regsvr32[Caution] C:\Program Files\MyWebSearch\bar\b.bin\m3IMPipe[Caution] C:\PROGRA~1\SSTEM~1\iexplore[Caution] C:\Documents and Settings\Elaina\Application Data\Microsoft\Windows\kwtjx[Caution] C:\Program Files\Viewpoint\Common\ViewpointService[Caution] C:\Program Files\Mozilla Firefox\firefox[Caution] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution] C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice[Caution] C:\WINDOWS\Explorer[Caution] C:\Documents and Settings\Elaina\Desktop\HiJackThis_v2[Caution] C:\WINDOWS\system32\wbem\wmiprvse[Caution] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.netzero.net/s/sp?r=al&cf=sp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch F2 - REG:system.ini: Shell=Explorer[Caution] C:\WINDOWS\shell[Caution] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2F02D978-0FF6-80F7-60BB-0426224AB7B3} - C:\Program Files\xwbioaou\yaxyoiob.dll O2 - BHO: (no name) - {47828D9D-3409-398F-2173-4DB67A3AF2C9} - C:\WINDOWS\system32\ark.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {E091D951-63C2-394E-BD5F-4F76661A0D94} - C:\WINDOWS\system32\aok.dll (file missing) O2 - BHO: (no name) - {E1A3D930-35F9-6C7D-DE2C-48E600F45B95} - C:\WINDOWS\system32\clu.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD[Caution] O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck[Caution] O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray[Caution] O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd[Caution] O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut[Caution] O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr[Caution] O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution] O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution] O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD[Caution] O4 - HKLM\..\Run: [Alcmtr] ALCMTR[Caution] O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution]" O4 - HKLM\..\Run: [New Value #1] c:\sysprep\test\ftest\ftest[Caution] O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG[Caution] O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2[Caution] O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution]" -atboottime O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1153704658\ee\AOLSoftware[Caution] O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay[Caution] SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [iPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend[Caution] O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched[Caution]" O4 - HKLM\..\Run: [AOLT4] D:\AOLSETUP[Caution] -ACS O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\b.bin\MWSBAR.DLL,S O4 - HKLM\..\Run: [ftduqhu] c:\windows\system32\ftduqhu[Caution] ftduqhu O4 - HKLM\..\Run: [horycy] C:\Program Files\Windows NT\horycy77798[Caution] O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer[Caution] O4 - HKLM\..\Run: [xgbefmhq] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\xgbefmhq.dll" O4 - HKLM\..\Run: [qfknclyz] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\qfknclyz.dll" O4 - HKLM\..\Run: [cxwjupuv] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cxwjupuv.dll" O4 - HKLM\..\Run: [cbwdwvun] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cbwdwvun.dll" O4 - HKLM\..\Run: [lilshgro] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lilshgro.dll" O4 - HKLM\..\Run: [cnwhmdix] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cnwhmdix.dll" O4 - HKLM\..\Run: [rozetiha] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\rozetiha.dll" O4 - HKLM\..\Run: [wxixgfob] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\wxixgfob.dll" O4 - HKLM\..\Run: [vupkfyho] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\vupkfyho.dll" O4 - HKLM\..\Run: [szovsrqh] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\szovsrqh.dll" O4 - HKLM\..\Run: [fohmvila] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fohmvila.dll" O4 - HKLM\..\Run: [firojwvw] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\firojwvw.dll" O4 - HKLM\..\Run: [junevite] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\junevite.dll" O4 - HKLM\..\Run: [nehwronu] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\nehwronu.dll" O4 - HKLM\..\Run: [rklylepe] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\rklylepe.dll" O4 - HKLM\..\Run: [hodyzkly] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\hodyzkly.dll" O4 - HKLM\..\Run: [fktotsjs] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fktotsjs.dll" O4 - HKLM\..\Run: [tidsfere] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\tidsfere.dll" O4 - HKLM\..\Run: [lszileno] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lszileno.dll" O4 - HKLM\..\Run: [olizadgr] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\olizadgr.dll" O4 - HKLM\..\Run: [chwlifyn] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\chwlifyn.dll" O4 - HKLM\..\Run: [fabkhafi] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fabkhafi.dll" O4 - HKLM\..\Run: [ehcjulov] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ehcjulov.dll" O4 - HKLM\..\Run: [azszwpep] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\azszwpep.dll" O4 - HKLM\..\Run: [opgdutop] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\opgdutop.dll" O4 - HKLM\..\Run: [tolmlcpe] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\tolmlcpe.dll" O4 - HKLM\..\Run: [ozyxabir] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ozyxabir.dll" O4 - HKLM\..\Run: [zipctklq] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\zipctklq.dll" O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD[Caution]" /autocheck O4 - HKLM\..\RunOnce: [spybotDeletingA9046] command /c del "C:\Program Files\Instant Access\Center\tray1.ico" O4 - HKLM\..\RunOnce: [spybotDeletingC8771] cmd /c del "C:\Program Files\Instant Access\Center\tray1.ico" O4 - HKLM\..\RunOnce: [spybotDeletingA7843] command /c del "C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll" O4 - HKLM\..\RunOnce: [spybotDeletingC7361] cmd /c del "C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll" O4 - HKLM\..\RunOnce: [spybotDeletingA4508] command /c del "C:\Program Files\Internet Explorer\msimg32.dll" O4 - HKLM\..\RunOnce: [spybotDeletingC4256] cmd /c del "C:\Program Files\Internet Explorer\msimg32.dll" O4 - HKLM\..\RunOnce: [spybotDeletingA9663] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk" O4 - HKLM\..\RunOnce: [spybotDeletingC9242] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk" O4 - HKLM\..\RunOnce: [spybotDeletingA3390] command /c del "C:\WINDOWS\system32\drivers\core.sys" O4 - HKLM\..\RunOnce: [spybotDeletingC9813] cmd /c del "C:\WINDOWS\system32\drivers\core.sys" O4 - HKLM\..\RunOnce: [spybotDeletingA882] command /c del "C:\Program Files\AVSystemCare\Addons\popupg.dll_old" O4 - HKLM\..\RunOnce: [spybotDeletingC5410] cmd /c del "C:\Program Files\AVSystemCare\Addons\popupg.dll_old" O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr[Caution] O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs[Caution]" /background O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\b.bin\m3IMPipe[Caution]" O4 - HKCU\..\Run: [Aud] "C:\PROGRA~1\SSTEM~1\iexplore[Caution]" -vt yazb O4 - HKCU\..\Run: [Fjbicak] C:\WINDOWS\s?stem\??rvices[Caution] O4 - HKCU\..\Run: [skbsf] "C:\Documents and Settings\Elaina\Application Data\??crosoft\n?lookup[Caution]" O4 - HKCU\..\Run: [omof] C:\PROGRA~1\COMMON~1\omof\omofm[Caution] O4 - HKCU\..\Run: [spoolsv] C:\WINDOWS\system32\spoolvs[Caution] O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution] O4 - HKCU\..\Run: [sfKg6w] C:\Documents and Settings\Elaina\Application Data\Microsoft\Windows\kwtjx[Caution] O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Elaina\Application Data\WinTouch\WinTouch[Caution] O4 - Startup: findfast[Caution] O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient[Caution] O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl[Caution] O4 - Global Startup: autorun[Caution] O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08[Caution] O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate[Caution] O8 - Extra context menu item: &Search - ?p=ZJfox000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Greg\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution] O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution] O14 - IERESET.INF: START_PAGE_URL=http://my.netzero.net/s/sp?r=al&cf=sp O16 - DPF: {04F414E9-E352-4BC3-963D-7BFE5A5F31A9} - http://scripts.dlv4.com/binari.....064_XP.cab O16 - DPF: {0878F049-D33E-45E0-A157-C36A6683CF25} - http://scripts.dlv4.com/binari.....063_XP.cab O16 - DPF: {5F4D3335-3194-4167-85AE-E7325F2695EF} - http://scripts.dlv4.com/binari....._em_XP.cab O16 - DPF: {AA59202C-5E41-48FC-AF7D-324F5FD6A9F1} - http://scripts.dlv4.com/binari....._em_XP.cab O16 - DPF: {CB5D474E-A510-40A4-B5A4-838933BCBA64} - http://scripts.dlv4.com/binari.....065_XP.cab O16 - DPF: {FA1D6D8F-C6ED-4752-8512-A33283240130} - http://es6-scripts.dlv4.com/bi.....066_XP.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice[Caution] O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon[Caution] O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc[Caution] O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution] O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution] O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution] O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1[Caution] O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc[Caution] O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor[Caution] O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12[Caution] O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan[Caution] O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution] O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution] O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc[Caution] O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService[Caution] O24 - Desktop Component 0: (no name) - C:\Program Files\MSN Gaming Zone\profsy.html -- End of file - 15358 bytes
November 20, 200718 yr First of all go to Windows update and update your Windows for the latest patches and install Internet Explorer7 because version 6 has more security holes. Then download the new 2.02 Hijackthis from here. After that download Ad-aware and Spybot and scan for spyware. Then scan for viruses (if you don't have a scanner, AVG is a good free one). Then after all of that post a new hijackthis log (with the new version). You definitely have spyware on this computer.
November 20, 200718 yr Could I just get a solution for what I posted? No. don't be lazy, you will not remove the spyware that way. For you wanting answers to an old version of a hijackthis log is one thing but for you wanting to ask for what to remove on a log that size and for the amount of spyware you have is crazy.
November 21, 200718 yr Could I just get a solution for what I posted? You asked for a solution. Keeping Windows up to date and using the latest version of HJT is part of that solution. If you don't want to follow some of the simplest advice that leads up to actually fixing things, you're gonna hate what's coming when you actually start removing stuff. You could always just ignore blades advice and keep the spyware infested machine though... :uhh:
November 21, 200718 yr Don't forget to update windows as well, and get IE7/Firefox. You need to read the whole thread before you post :P .
November 21, 200718 yr Don't forget to update windows as well, and get IE7/Firefox. You need to read the whole thread before you post :P . I did, was just backing up what you said because he only mentioned doing 1 out of 3 of the things you said. :P
Create an account or sign in to comment