Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

trackboy186

3 Posts

451

May 28th, 2005 05:00

HJThis Logfile

​ Logfile of HijackThis v1.99.1 ​
​Scan saved at 11:55:24 AM, on 5/27/2005 ​
​Platform: Windows XP SP2 (WinNT 5.01.2600) ​
​MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) ​
​ Running processes: ​
​C:\WINDOWS\System32\smss.exe ​
​C:\WINDOWS\system32\winlogon.exe ​
​C:\WINDOWS\system32\services.exe ​
​C:\WINDOWS\system32\lsass.exe ​
​C:\WINDOWS\system32\svchost.exe ​
​C:\WINDOWS\System32\svchost.exe ​
​C:\WINDOWS\system32\LEXBCES.EXE ​
​C:\WINDOWS\system32\spoolsv.exe ​
​C:\WINDOWS\system32\LEXPPS.EXE ​
​C:\WINDOWS\System32\svchost.exe ​
​C:\WINDOWS\system32\UAService7.exe ​
​C:\WINDOWS\System32\WLTRYSVC.EXE ​
​C:\WINDOWS\System32\bcmwltry.exe ​
​C:\WINDOWS\Explorer.exe ​
​C:\WINDOWS\BCMSMMSG.exe ​
​C:\WINDOWS\system32\hkcmd.exe ​
​C:\Program Files\Synaptics\SynTP\SynTPLpr.exe ​
​C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ​
​C:\Program Files\Dell\Media Experience\PCMService.exe ​
​C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe ​
​C:\Program Files\Common Files\Dell\EUSW\Support.exe ​
​C:\Program Files\Common Files\Real\Update_OB\realsched.exe ​
​C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe ​
​C:\WINDOWS\system32\ctfmon.exe ​
​C:\Program Files\BullGuard Software\BullGuard 5.0\bullguard.exe ​
​c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe ​
​C:\WINDOWS\system32\LVComS.exe ​
​C:\WINDOWS\System32\wbem\wmiapsrv.exe ​
​C:\Program Files\Internet Explorer\iexplore.exe ​
​C:\Program Files\Common Files\AOL\1117210611\ee\AOLHostManager.exe ​
​C:\Program Files\Common Files\AOL\1117210611\ee\AOLServiceHost.exe ​
​C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE ​
​C:\HJT\HijackThis.exe ​
​ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ​​http://websearch.drsnsrch.com/sidesearch.cgi?id​​= ​
​R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = ​​http://websearch.drsnsrch.com/sidesearch.cgi?id​​= ​
​R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ​​http://websearch.drsnsrch.com/sidesearch.cgi?id​​= ​
​R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ​​http://www.dell4me.com/myway​​ ​
​R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= ​
​R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm ​
​R3 - Default URLSearchHook is missing ​
​F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe ​
​O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll ​
​O2 - BHO: (no name) - {3082295B-1954-AEFD-B6A3-327B9FCB75C8} - C:\WINDOWS\system32\jiimfdho.dll (file missing) ​
​O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) ​
​O2 - BHO: (no name) - {9C3C831E-0732-8A9A-D965-F0E592271980} - C:\WINDOWS\system32\yreotkev.dll (file missing) ​
​O2 - BHO: (no name) - {A4BAC5A7-820C-0AD5-A5C0-2F4BFC6B185F} - C:\WINDOWS\system32\wvaplvip.dll (file missing) ​
​O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe ​
​O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe ​
​O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe ​
​O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe ​
​O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ​
​O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" ​
​O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" ​
​O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ​
​O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime ​
​O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot ​
​O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe ​
​O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe ​
​O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe ​
​O4 - HKLM\..\Run: [umulckmr] C:\WINDOWS\system32\umulckmr.exe ​
​O4 - HKLM\..\Run: [AutoLoader2wr11LTfIYLP] "C:\WINDOWS\system32\mmsibm02.exe" /HideDir /HideUninstall /PC="WB.RL" /ShowLegalNote="nonbranded" ​
​O4 - HKLM\..\Run: [imibzi] c:\windows\system32\mineolo.exe ​
​O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1117210611\ee\AOLHostManager.exe ​
​O4 - HKCU\..\Run: [J0rtRVitT] minceng.exe ​
​O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe ​
​O4 - HKCU\..\Run: [BullGuard 5.0] "C:\Program Files\BullGuard Software\BullGuard 5.0\bullguard.exe" ​
​O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup ​
​O4 - HKCU\..\RunOnce: [UninstallDellSupport2.x] msiexec /qn /x {43FCA273-9534-40DB-B7C5-D7758875616A} ​
​O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe ​
​O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe ​
​O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML ​
​O8 - Extra context menu item: &Search - ​​http://bar.mywebsearch.com/menusearch.html?p=ZSXXXXXX44US​​ ​
​O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 ​
​O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll ​
​O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll ​
​O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL ​
​O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe ​
​O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) ​
​O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - ​​http://wwws.musicmatch.com/mmz/openWebRadio.html​​ (file missing) ​
​O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe ​
​O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe ​
​O15 - Trusted Zone: *.media-motor.net ​
​O15 - Trusted Zone: *.popuppers.com ​
​O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - ​​http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409​​ ​
​O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - ​​http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab​​ ​
​O16 - DPF: {89F9AA82-9B9F-4D1C-A637-33388558FAAC} (AutoImport1_5_9.GW_Import_Control) - ​​http://www.nkcsd.k12.mo.us/nkhs/calendar/cab/ccuweb1_5_9.cab​​ ​
​O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - ​​http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab​​ ​
​O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll ​
​O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe ​
​O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE ​
​O23 - Service: cwiugjjjvgik (lrwtpgqm6) - Unknown owner - C:\WINDOWS\system32\bnyvgmlh6.exe (file missing) ​
​O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) ​
​O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe ​
​O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE ​
​ ​

zbestwun2001

3 Apprentice

 • 

8.8K Posts

May 28th, 2005 14:00

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us/easyfile/file.php?download=20050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan

trackboy186

3 Posts

May 28th, 2005 18:00

---------------------------------------------------------
 ewido security suite - Scan report
---------------------------------------------------------
 + Created on:   2:34:44 PM, 5/28/2005
 + Report-Checksum:  C56E268
 + Date of database:  5/28/2005
 + Version of scan engine: v3.0
 + Duration:    42 min
 + Scanned Files:   81914
 + Speed:    32.06 Files/Second
 + Infected files:   24
 + Removed files:   24
 + Files put in quarantine:  24
 + Files that could not be opened: 0
 + Files that could not be cleaned: 0
 + Binder:  Yes
 + Crypter:  Yes
 + Archives:  Yes
 + Scanned items:
 C:\
 + Scan result:
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@adknowledge[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@cgi-bin[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@cohvault.ign[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@counter9.s@xtracker[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@data.coremetrics[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@ehg-knightridder.hitbox[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@ehg-nvidia.hitbox[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@ehg-warnerbrothers.hitbox[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@geocities[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@gostats[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@hitbox[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@perf.overture[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@realmedia[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@search.msn[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@servedby.netshelter[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@s@xtracker[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@stat.onestat[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@statse.webtrendslive[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@tradedoubler[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Documents and Settings\Brent Simpson\Cookies\brent simpson@xiti[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
 C:\Program Files\BullGuard Software\BullGuard 5.0\Quarantine\umulckmr.exe -> Spyware.Agent.cy -> Cleaned with backup
 C:\Program Files\MSN Messenger\riched20.dll -> Spyware.Wesbar -> Cleaned with backup
 C:\WINDOWS\SYSTEM32\CnPl.dll -> Spyware.Apropos.b -> Cleaned with backup
 C:\WINDOWS\tdtb.exe -> Trojan.Imiserv.c -> Cleaned with backup

::Report End
 
 
 
Logfile of HijackThis v1.99.1
Scan saved at 2:36:23 PM, on 5/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3082295B-1954-AEFD-B6A3-327B9FCB75C8} - C:\WINDOWS\system32\jiimfdho.dll (file missing)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {9C3C831E-0732-8A9A-D965-F0E592271980} - C:\WINDOWS\system32\yreotkev.dll (file missing)
O2 - BHO: (no name) - {A4BAC5A7-820C-0AD5-A5C0-2F4BFC6B185F} - C:\WINDOWS\system32\wvaplvip.dll (file missing)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [AutoLoader2wr11LTfIYLP] "C:\WINDOWS\system32\mmsibm02.exe" /HideDir /HideUninstall /PC="WB.RL" /ShowLegalNote="nonbranded"
O4 - HKLM\..\Run: [imibzi] c:\windows\system32\mineolo.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1117210611\ee\AOLHostManager.exe
O4 - HKCU\..\Run: [J0rtRVitT] minceng.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BullGuard 5.0] "C:\Program Files\BullGuard Software\BullGuard 5.0\bullguard.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSXXXXXX44US
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {89F9AA82-9B9F-4D1C-A637-33388558FAAC} (AutoImport1_5_9.GW_Import_Control) - http://www.nkcsd.k12.mo.us/nkhs/calendar/cab/ccuweb1_5_9.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: cwiugjjjvgik (lrwtpgqm6) - Unknown owner - C:\WINDOWS\system32\bnyvgmlh6.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
 

zbestwun2001

3 Apprentice

 • 

8.8K Posts

May 28th, 2005 19:00

Good work but I still see Nail.exe in the log.

Did you delete it when you did the other stuff?

We will continue and see if it disappears?

Let's continue on with the fix...



a
Run HiJackThis and click " Scan", then check(tick) the following, if present:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

R3 - Default URLSearchHook is missing

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O2 - BHO: (no name) - {3082295B-1954-AEFD-B6A3-327B9FCB75C8} - C:\WINDOWS\system32\jiimfdho.dll (file missing)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {9C3C831E-0732-8A9A-D965-F0E592271980} - C:\WINDOWS\system32\yreotkev.dll (file missing)
O2 - BHO: (no name) - {A4BAC5A7-820C-0AD5-A5C0-2F4BFC6B185F} - C:\WINDOWS\system32\wvaplvip.dll (file missing)

O4 - HKLM\..\Run: [AutoLoader2wr11LTfIYLP] "C:\WINDOWS\system32\mmsibm02.exe" /HideDir /HideUninstall /PC="WB.RL" /ShowLegalNote="nonbranded"
O4 - HKLM\..\Run: [imibzi] c:\windows\system32\mineolo.exe
O4 - HKCU\..\Run: [J0rtRVitT] minceng.exe

O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com

O23 - Service: cwiugjjjvgik (lrwtpgqm6) - Unknown owner - C:\WINDOWS\system32\bnyvgmlh6.exe (file missing)


Now, with all windows closed except HiJackThis, click " Fix checked".


Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

files...

C:\WINDOWS\Nail.exe
C:\WINDOWS\system32\mmsibm02.exe
c:\windows\system32\mineolo.exe

Search for...

minceng.exe

...using " Start | Search...".

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".


Post back a new log, and let me know how everything goes.
Steve

zbestwun2001

3 Apprentice

 • 

8.8K Posts

May 28th, 2005 22:00

We're definately makeing good progress,

Let's continue on with the fix...

-

Be sure to look this solution over before you begin. There are a some item(s) i'm not familar with. If you recognze any, then just omit them from this fix.



Go to Add/Remove programs and remove(uninstall) the following, if present:

MyWebSearch

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.


Run HiJackThis and click " Scan", then check(tick) the following, if present:


O2 - BHO: (no name) - {3082295B-1954-AEFD-B6A3-327B9FCB75C8} - (no file)
O2 - BHO: (no name) - {9C3C831E-0732-8A9A-D965-F0E592271980} - (no file)
O2 - BHO: (no name) - {A4BAC5A7-820C-0AD5-A5C0-2F4BFC6B185F} - (no file)

O4 - HKCU\..\Run: [J0rtRVitT] minceng.exe

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSXXXXXX44US


Now, with all windows closed except HiJackThis, click " Fix checked".


Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

Search for...

minceng.exe

...using " Start | Search...".

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".


Post back a new log, and let me know how everything goes.
Steve

trackboy186

3 Posts

May 28th, 2005 22:00

Logfile of HijackThis v1.99.1
Scan saved at 6:32:30 PM, on 5/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BullGuard Software\BullGuard 5.0\bullguard.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Common Files\AOL\1117210611\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1117210611\ee\AOLServiceHost.exe
C:\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3082295B-1954-AEFD-B6A3-327B9FCB75C8} - (no file)
O2 - BHO: (no name) - {9C3C831E-0732-8A9A-D965-F0E592271980} - (no file)
O2 - BHO: (no name) - {A4BAC5A7-820C-0AD5-A5C0-2F4BFC6B185F} - (no file)
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1117210611\ee\AOLHostManager.exe
O4 - HKCU\..\Run: [J0rtRVitT] minceng.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BullGuard 5.0] "C:\Program Files\BullGuard Software\BullGuard 5.0\bullguard.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSXXXXXX44US
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {89F9AA82-9B9F-4D1C-A637-33388558FAAC} (AutoImport1_5_9.GW_Import_Control) - http://www.nkcsd.k12.mo.us/nkhs/calendar/cab/ccuweb1_5_9.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: cwiugjjjvgik (lrwtpgqm6) - Unknown owner - C:\WINDOWS\system32\bnyvgmlh6.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

 

View More

View All

No Events found!

Top