Your computer is infected
-
anyone getting this red icon with a white x in it(on system tray) and when u point at it ,it says 'Your computer is infected'. Just got it this morning and I have used ewido-anti spyware to scan for infected files and I thought thats the end but it just pop up again
When I first got it my PC is really sluggish but its quite ok now(maybe a bit slower than usual) except that I cant launch any anti-spy or anti-mal/virus software unless I ran it in safe mod. How do I get rid of that dumb icon and fix the problem?
Btw my comp uses Win 2000 pro and its a P III -
Download HijackThis.
Create a folder called HJT in C drive and extract HijackThis to that folder.
Post the log here. -
Logfile of HijackThis v1.99.1
Scan saved at 8:37:57 PM, on 8/20/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\windowsdb.exe
C:\WINNT\Explorer.exe
C:\WINNT\sm56hlpr.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\NotifyPhoneBook.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\kybrdff_11a.exe
C:\winnt\system32\stonedrv.exe
C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Diablo II\Game.exe
C:\WINNT\system32\msijavaup32.exe
c:\oxaeddd.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\FTP.EXE
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\cscript.exe
C:\Program Files\Prolink Hurricane 9000C\QuickStart.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
F2 - REG:system.ini: Shell=Explorer.exe windowsdb.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,windowsdb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Related Page - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\system32\WinNB57.dll (file missing)
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\system32\WinNB57.dll (file missing)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegistryCheck] C:\WINNT\System32\regchk32.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_11a.exe
O4 - HKLM\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:\Documents%20and%20Settings\UNKNOWN\Desktop\message\message.html!File://foo.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (Ìì�ÂËÑË÷) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://banners.winanylotto.com/d/2044000/99930084.cab
O20 - Winlogon Notify: RunOnceEx - C:\WINNT\system32\astapi.dll (file missing)
O20 - Winlogon Notify: Shell Extensions - C:\WINNT\system32\ijfgnt5.dll (file missing)
O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - C:\WINNT\system32\msp.cpl
O21 - SSODL: (no name) - {E61B5E20-DE35-11CF-9C87-1579005127ED} - C:\WINNT\system32\__delete_on_reboot__msc.cpl (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Winkaue - Unknown owner - C:\WINNT\System32\Winkaue.exe (file missing)
O23 - Service: Winkdqj - Unknown owner - C:\WINNT\System32\Winkdqj.exe (file missing)
O23 - Service: Winkfa - Unknown owner - C:\WINNT\System32\Winkfa.exe (file missing)
O23 - Service: Winkiwe - Unknown owner - C:\WINNT\System32\Winkiwe.exe (file missing)
O23 - Service: Winklp - Unknown owner - C:\WINNT\System32\Winklp.exe (file missing)
O23 - Service: Winkorh - Unknown owner - C:\WINNT\System32\Winkorh.exe (file missing)
O23 - Service: Winkpm - Unknown owner - C:\WINNT\System32\Winkpm.exe (file missing)
O23 - Service: Winkpv - Unknown owner - C:\WINNT\System32\Winkpv.exe (file missing)
O23 - Service: Winkrre - Unknown owner - C:\WINNT\System32\Winkrre.exe (file missing)
O23 - Service: Winkxdw - Unknown owner - C:\WINNT\System32\Winkxdw.exe (file missing)
O23 - Service: Winkxje - Unknown owner - C:\WINNT\System32\Winkxje.exe (file missing)
O23 - Service: Winkyse - Unknown owner - C:\WINNT\System32\Winkyse.exe (file missing)
O23 - Service: Winkzek - Unknown owner - C:\WINNT\System32\Winkzek.exe (file missing)
O23 - Service: winupd - Unknown owner - C:\WINNT\winupd.exe (file missing) -
Open up task manager. (Right click task bar, Task Manager)
End these tasks:
C:\kybrdff_11a.exe
C:\winnt\system32\stonedrv.exe
c:\oxaeddd.exe
Next, open HijackThis.
Select None of the above, just start the program.
Click Scan
Once it's done, tick these entries:
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_11a.exe
O4 - HKLM\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
Click Fix checked.
_____________________________
Download smitfraudfix
Extract and save it to your desktop.
Restart your computer in Safe Mode.
1) Close any open programs and open the SmitFraudFix folder
2) Double-click on the SmitfraudFix.cmd file
3) When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen. You will now see a menu as shown in the image below. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
4) The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program. This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will should continue with step 5.
5) When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the enter key.
6) When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.
7) Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer. Post this log.
__________________________
Next, download Bruteforce Uninstaller
Unzip it to a folder of itÂ’s own (c:\BFU).
Start the Brute Force Uninstaller by doubleclicking BFU.exe
Next to the 'scriptfile to execute'-window you'll see a little icon as shown in next picture:
When you click that icon, a little window will open that says: 'Please enter the full URL to the sript you want to execute'
In the field, copy and paste next URL:
http://metallica.geekstogo.com/alcanshorty.bfu
Click Ok.
Then click execute in Brute Force Uninstaller.
If nothing happens after pressing the Execute button, this means that the script didn't download. In that case, download the script
( alcanshorty.bfu ) manually from above url ( rightclick on it and choose 'save as' and save it in your BFU-folder). Then start BFU.exe again and click the browse button next to the 'scriptfile to execute'-window
Browse to the script you downloaded and Click Ok and Execute in Brute Force Uninstaller.
Wait for the complete script execution box to popup and press OK.
Press exit to terminate the BFU program.
______________________________
Next, go to Start > Search.
Search for this file: astapi.dll
Search in all hidden and subfolders as well.
If it is not found, open HijackThis. Click None of the above, just start the program. Tick this entry:
O20 - Winlogon Notify: RunOnceEx - C:\WINNT\system32\astapi.dll (file missing)
Click Fix checked.
______________________________
Now, run your Ewido.
Update it before scanning.
Scan and remove anything found. Then post another HijackThis log again. -
ty for helping,heres the smitfraudfix log.
SmitFraudFix v2.81
Scan done at 1:01:56.95, Mon 08/21/2006
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT
Fix ran in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
C:\WINNT\system32\__delete_on_reboot__msc.cpl -> Missing File
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\uniq Deleted
C:\winstall.exe Deleted
C:\WINNT\system32\TheMatrixHasYou.exe Deleted
C:\Documents and Settings\UNKNOWN\Application Data\Install.dat Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End -
Logfile of HijackThis v1.99.1
Scan saved at 2:05:10 AM, on 8/21/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\msijavaup32.exe
C:\WINNT\sm56hlpr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINNT\VU5LTk9XTg\command.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\rundll32.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
c:\msijavaup32.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe msijavaup32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msijavaup32.exe
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\system32\WinNB57.dll (file missing)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegistryCheck] C:\WINNT\System32\regchk32.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\Run: [newname] c:\\nwnmff_11.exe
O4 - HKLM\..\Run: [defender] c:\\dfndrff_11a.exe
O4 - HKLM\..\Run: [keyboard] c:\\kybrdff_11a.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKLM\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [ntdll.dll] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
O4 - HKCU\..\RunServices: [Ms Java for Windows NT] msijavaup32.exe
O4 - HKCU\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:\Documents%20and%20Settings\UNKNOWN\Desktop\message\message.html!File://foo.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (Ìì�ÂËÑË÷) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://banners.winanylotto.com/d/2044000/99930084.cab
O20 - Winlogon Notify: Shell Extensions - C:\WINNT\system32\mkvfw32.dll
O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - C:\WINNT\system32\msp.cpl
O21 - SSODL: (no name) - {E61B5E20-DE35-11CF-9C87-1579005127ED} - C:\WINNT\system32\__delete_on_reboot__msc.cpl (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Winkaue - Unknown owner - C:\WINNT\System32\Winkaue.exe (file missing)
O23 - Service: Winkdqj - Unknown owner - C:\WINNT\System32\Winkdqj.exe (file missing)
O23 - Service: Winkfa - Unknown owner - C:\WINNT\System32\Winkfa.exe (file missing)
O23 - Service: Winkiwe - Unknown owner - C:\WINNT\System32\Winkiwe.exe (file missing)
O23 - Service: Winklp - Unknown owner - C:\WINNT\System32\Winklp.exe (file missing)
O23 - Service: Winkorh - Unknown owner - C:\WINNT\System32\Winkorh.exe (file missing)
O23 - Service: Winkpm - Unknown owner - C:\WINNT\System32\Winkpm.exe (file missing)
O23 - Service: Winkpv - Unknown owner - C:\WINNT\System32\Winkpv.exe (file missing)
O23 - Service: Winkrre - Unknown owner - C:\WINNT\System32\Winkrre.exe (file missing)
O23 - Service: Winkxdw - Unknown owner - C:\WINNT\System32\Winkxdw.exe (file missing)
O23 - Service: Winkxje - Unknown owner - C:\WINNT\System32\Winkxje.exe (file missing)
O23 - Service: Winkyse - Unknown owner - C:\WINNT\System32\Winkyse.exe (file missing)
O23 - Service: Winkzek - Unknown owner - C:\WINNT\System32\Winkzek.exe (file missing)
O23 - Service: winupd - Unknown owner - C:\WINNT\winupd.exe (file missing) -
Did you run an Ewido scan and remove anything found?
If no, run it and remove anything found.
If yes, try downloading this software.
Scan with Kaspersky online virus scanner
Click on Kaspersky Online Scanner. Do this in IE, as the virus scanner uses ActiveX.
Open HijackThis. Select None of the above, just start the program.
Click on Scan.
Tick these entries:
R3 - Default URLSearchHook is missing
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O3 - Toolbar: Related Page - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINNT\system32\WinNB57.dll (file missing)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)
O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:\Documents%20and%20Settings\UNKNOWN\Desktop\message\message.html!File://foo.exe
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (Ìì�ÂËÑË÷) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://banners.winanylotto.com/d/2044000/99930084.cab
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe
O23 - Service: Winkaue - Unknown owner - C:\WINNT\System32\Winkaue.exe (file missing)
O23 - Service: Winkdqj - Unknown owner - C:\WINNT\System32\Winkdqj.exe (file missing)
O23 - Service: Winkfa - Unknown owner - C:\WINNT\System32\Winkfa.exe (file missing)
O23 - Service: Winkiwe - Unknown owner - C:\WINNT\System32\Winkiwe.exe (file missing)
O23 - Service: Winklp - Unknown owner - C:\WINNT\System32\Winklp.exe (file missing)
O23 - Service: Winkorh - Unknown owner - C:\WINNT\System32\Winkorh.exe (file missing)
O23 - Service: Winkpm - Unknown owner - C:\WINNT\System32\Winkpm.exe (file missing)
O23 - Service: Winkpv - Unknown owner - C:\WINNT\System32\Winkpv.exe (file missing)
O23 - Service: Winkrre - Unknown owner - C:\WINNT\System32\Winkrre.exe (file missing)
O23 - Service: Winkxdw - Unknown owner - C:\WINNT\System32\Winkxdw.exe (file missing)
O23 - Service: Winkxje - Unknown owner - C:\WINNT\System32\Winkxje.exe (file missing)
O23 - Service: Winkyse - Unknown owner - C:\WINNT\System32\Winkyse.exe (file missing)
O23 - Service: Winkzek - Unknown owner - C:\WINNT\System32\Winkzek.exe (file missing)
O23 - Service: winupd - Unknown owner - C:\WINNT\winupd.exe (file missing)
Click Fix checked. -
Find these files and delete those in red:
%System%\WinDmy.dll
%System%\Winnb56.dll
%System%\WinNB57.dll
%WinDir%\Downloaded Program Files\MirarSetup.exe
%UserProfile%\Local Settings\Temp\875455-NOSB.exe
%UserProfile%\Local Settings\Temp\mit3.tmp
%UserProfile%\Local Settings\Temp\mit3.tmp.cab
By default, %System% would be C:\Winnt\System32.
%Temp% would be C:\WINNT\Temp
%Windir% would be C:\Windows or C:\Winnt
Delete them. If it is not possible, delete them in Safe Mode.
Open Registry Editor. (Start > Run, type in regedit, press OK)
Navigate to these keys and delete those in red.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ToolbarInstall\MirarSetup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\MirarSetup.exe
HKEY_LOCAL_MACHINE%\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\System32\WinDmy.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1037B06C-84B7-4240-8D80-485810A0497D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{224302B0-94E9-45C2-9E5B-BA989EE556E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54B287F9-FD90-4457-B65E-CB91560C021D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E4C7AFC-9915-4036-B7F9-8B3F1710788F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar_Dummy.NN_BarDummy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar_Dummy.NN_BarDummy.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar.NN_Bar_Helper
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar.NN_Bar_Helper.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar.NN_WebBand
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar.NN_WebBand.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4035DE1B-D54A-411E-9EE7-923295D2E86E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{753B9349-7E46-4E5C-A27F-A60A6BF1EAB5}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MirarSetup.exe[/color]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/WinDmy.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
HKEY_LOCAL_MACHINE\SOFTWARE\RelatedPageInstall -
Continued from above:
HKEY_CURRENT_USER\Software\UCmoreHKEY_LOCAL_MACHINE\SOFTWARE\UCmore HKEY_CURRENT_USER\Software\UCmore\UCmoreClient
HKEY_CLASSES_ROOT\CLSID\{267395C4-3CBA-4E6E-8FE1-EFAA33185685}
HKEY_CLASSES_ROOT\CLSID\{53CBEE82-D747-11D3-9ED0-005004189684}
HKEY_CLASSES_ROOT\IUCmore.UCmoreApp
HKEY_CLASSES_ROOT\IUCmore.UCmoreApp.1
HKEY_CLASSES_ROOT\TypeLib\{C347ECA2-EF7D-46BA-AE8E-92A10E559514}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ED8DB0FD-D8F4-4b2c-BB5B-9EF040FE104D}
Navigate to this folder and delete the one in red:
C:\Program Files\UCmor -
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}
only found these and the ones from Hijackthis,cant find the rest btw I can only open regedit in safe mode.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1037B06C-84B7-4240-8D80-485810A0497D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{224302B0-94E9-45C2-9E5B-BA989EE556E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54B287F9-FD90-4457-B65E-CB91560C021D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E4C7AFC-9915-4036-B7F9-8B3F1710788F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F8310E7D-4C4D-46A4-A068-B5BB99411CC7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar_Dummy.NN_BarDummy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NN_Bar_Dummy.NN_BarDummy.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}Did you run an Ewido scan and remove anything found?
If no, run it and remove anything found
I have scanned with ewido anti-spyware before I sleep and it found 110 infected objects, much more than before.I've got the ewido anti-mal ware as well should I use that instead?
Also I can't open Kaspersky online virus scanner in normal or safe mode,I'll try the prev software next. -
time for a reformat
-
only found these and the ones from Hijackthis,cant find the rest btw I can only open regedit in safe mode.
Try in normal mode. If still can't find, it has been fixed by either Ewido or HijackThis or smitfraudfix.I have scanned with ewido anti-spyware before I sleep and it found 110 infected objects, much more than before.I've got the ewido anti-mal ware as well should I use that instead?
Both versions of Ewido are the same.
Also I can't open Kaspersky online virus scanner in normal or safe mode,I'll try the prev software next.
If you can't do do a Kaspersky scan, try it out after using the Prevx software. -
thx a lot for telling me the Prevx software,its the best anti-mal software I ever use ,everything seems to be back to normal after it auto scans the PC right after booting.Originally posted by ndmmxiaomayi:Both versions of Ewido are the same.
If you can't do do a Kaspersky scan, try it out after using the Prevx software. -
I need the HijackThis log to see if your computer is clean.Originally posted by xfool:thx a lot for telling me the Prevx software,its the best anti-mal software I ever use ,everything seems to be back to normal after it auto scans the PC right after booting. -
Logfile of HijackThis v1.99.1
Scan saved at 10:28:15 PM, on 8/21/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\sm56hlpr.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\NotifyPhoneBook.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\FTP.EXE
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\FTP.EXE
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
F2 - REG:system.ini: Shell=Explorer.exe msjava.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msjava.exe
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users.WINNT\Application Data\Prevx\pxbho.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegistryCheck] C:\WINNT\System32\regchk32.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_11.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_11a.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_11a.exe
O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msjava.exe
O4 - HKLM\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [ntdll.dll] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [ntdll.dll] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe"
O4 - HKCU\..\Run: [ttool] C:\WINNT\scvc.exe
O4 - HKCU\..\RunServices: [Ms Java for Windows NT] msjava.exe
O4 - HKCU\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - C:\WINNT\system32\msp.cpl (file missing)
O21 - SSODL: (no name) - {E61B5E20-DE35-11CF-9C87-1579005127ED} - C:\WINNT\system32\__delete_on_reboot__msc.cpl (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing) -
Open HijackThis. Click on None of the above, just start the program.
Click on Scan. Once the scan is done, tick these entries:
O4 - HKLM\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmff_11.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_11a.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_11a.exe
O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKLM\..\RunServices: [ntdll.dll] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [stonedrv] c:\winnt\system32\stonedrv.exe
O4 - HKCU\..\Run: [ntdll.dll] c:\winnt\system32\stonedrv.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe (file missing)
Click Fix checked.
After this, reboot your computer and do another scan and post the log. -
Logfile of HijackThis v1.99.1
Scan saved at 11:16:10 PM, on 8/21/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\sm56hlpr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\FTP.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
F2 - REG:system.ini: Shell=Explorer.exe msjava.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msjava.exe
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users.WINNT\Application Data\Prevx\pxbho.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegistryCheck] C:\WINNT\System32\regchk32.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msjava.exe
O4 - HKLM\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe"
O4 - HKCU\..\Run: [ttool] C:\WINNT\scvc.exe
O4 - HKCU\..\RunServices: [Ms Java for Windows NT] msjava.exe
O4 - HKCU\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - C:\WINNT\system32\msp.cpl (file missing)
O21 - SSODL: (no name) - {E61B5E20-DE35-11CF-9C87-1579005127ED} - C:\WINNT\system32\__delete_on_reboot__msc.cpl (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
oh btw the software keep catching MSIJAVAUP32.EXE & MSJAVA.EXE malwares -
I don't know why it keeps prompting that msjava is a malware, it's Java from Microsoft. Perhaps it has been infected.
Open HijackThis. Select None of the above, just start the program.
Click Scan. Once the scan is finished, tick this:
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe"
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe (file missing)
Click Fix checked.
Restart the PC and delete the parts in red:
C:\WINNT\VU5LTk9XTg\command.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.dll
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm0000x.exe
Where x is a number.
Reboot and post another log. -
Restart the PC and delete the parts in red:
cant find those files
C:\WINNT\VU5LTk9XTg\command.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.dll
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm0000x.exe
Where x is a number.
Reboot and post another log.
Logfile of HijackThis v1.99.1
Scan saved at 7:17:13 PM, on 8/22/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\WINNT\sm56hlpr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
F2 - REG:system.ini: Shell=Explorer.exe msjava.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msjava.exe
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users.WINNT\Application Data\Prevx\pxbho.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegistryCheck] C:\WINNT\System32\regchk32.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe
O4 - HKLM\..\RunServices: [Ms Java for Windows NT] msjava.exe
O4 - HKLM\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ttool] C:\WINNT\scvc.exe
O4 - HKCU\..\RunServices: [Ms Java for Windows NT] msjava.exe
O4 - HKCU\..\RunServices: [Ms Windows Debugger] windowsdb.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LCDPlayer.lnk = C:\Program Files\SPACE INTERNATIONAL\CDSpace 5\LCDPlyer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - C:\WINNT\system32\msp.cpl (file missing)
O21 - SSODL: (no name) - {E61B5E20-DE35-11CF-9C87-1579005127ED} - C:\WINNT\system32\__delete_on_reboot__msc.cpl (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\VU5LTk9XTg\command.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing) -
Everything is cleaned already, except for the msjava thingy.
Try the Kaspersky online scan again and see if it works. -
the Kaspersky online scan link doesn't work(cannot find server)Originally posted by ndmmxiaomayi:Everything is cleaned already, except for the msjava thingy.
Try the Kaspersky online scan again and see if it works.
btw about the msjava thing ,I get this block whenever I boot upcannot find the file 'msjava.exe'(or one of its component). make sure the path and filename are correct and all required libraries are available.
-
Kaspersky website is up, no reason why you can't. Try clearing your cache and cookies.
Open Internet Explorer. Go to Tools > Internet options. Under Temporary Internet Files, click Delete cookies. After this, click Delete files. Tick the Delete all offline contents box.
Click OK. Restart Internet Explorer.
If Kaspersky still don't work, try the others and see if it works.
http://www.pandasoftware.com/products/ActiveScan.htm
http://housecall.trendmicro.com/ -
Mayi, wld you recomend the prevx1?? Can it be used with Norton antivirus?
-
Yes, it can be used with Norton.Originally posted by davidche:Mayi, wld you recomend the prevx1?? Can it be used with Norton antivirus?
Prevx1 is related Prevx, so you can use it. It has a limitation though, can be used for 30 days. -
Thx for all the help but I have decided to upgrade to a better PC with XP as the problem can't be completely remove from my old comp. Btw is it ok that I use back the HDD as secondary/slave disk on the new PC cos there are quite a few files in there?