How to get rid of malware/trojan?
-
Originally posted by ndmmxiaomayi:
I don't think I need the HijackThis log as of now.
Submit the file below in [b]bold to VirusTotal or Jotti
Copy and paste the results back of this file after scanning.
C:\WINDOWS\fvpxh1.dll
Visit F-Secure Blacklight website.
Click on I Accept.
You will be brought to another page. Click on Download Blacklight Beta graphical user interface version link.
Save it to somewhere convenient and double click to run it.
When it's done, click Exit. Don't fix anything. Copy and paste the F-Secure log (named fsbl-long string of numbers.txt)
In your next reply, please post
1. C:\WINDOWS\fvpxh1.dll scan results
2. F-Secure Blacklight log[/b]Originally posted by ndmmxiaomayi:
I submitted it to VirusTotal below shows e details after i submitted...
I don't think I need the HijackThis log as of now.
Submit the file below in [b]bold to VirusTotal or Jotti
Copy and paste the results back of this file after scanning.
C:\WINDOWS\fvpxh1.dll
Visit F-Secure Blacklight website.
Click on I Accept.
You will be brought to another page. Click on Download Blacklight Beta graphical user interface version link.
Save it to somewhere convenient and double click to run it.
When it's done, click Exit. Don't fix anything. Copy and paste the F-Secure log (named fsbl-long string of numbers.txt)
In your next reply, please post
1. C:\WINDOWS\fvpxh1.dll scan results
2. F-Secure Blacklight log[/b]
"STATUS: QUEUEDYour file "fvpxh1.dll_" is queued in position: 333. Estimated start time is between 64 and 92 minutes."
---------------------------------------------------------------------
Jotti: “The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file”
----------------------------------------------------------------------
F-Secure:
Scan Target: Hidden processes
Hidden files and folders
Status: Scan Complete
No hidden items found -
Logfile from HiJackThis...is this correct?
Logfile of HijackThis v1.99.1
Scan saved at 12:47:28 AM, on 2/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\user\Desktop\blbeta.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {5AB17D46-C4F2-49D2-5405-D6C9F916FF7E} - C:\WINDOWS\fvpxh1.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -
Jotti: “The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file”
Try turning off ZoneAlarm temporarily and upload it again. VirusTotal is currently overloaded, so try Jotti.Logfile from HiJackThis...is this correct?
Yup. -
I shutdown zonealarm and submitted to jotti...but still e message was:Originally posted by ndmmxiaomayi:Try turning off ZoneAlarm temporarily and upload it again. VirusTotal is currently overloaded, so try Jotti.
Jotti: “The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file” -
F-Secure is clean. Did your AVG antivirus detect this file as a virus?Originally posted by Xiao Jun:I shutdown zonealarm and submitted to jotti...but still e message was:
Jotti: “The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file” -
I had that problem
go download some free anti-spyware programs and clear it..but it cannot be totally cleared
-
Yes...AVG detected this file as a virusOriginally posted by ndmmxiaomayi:F-Secure is clean. Did your AVG antivirus detect this file as a virus?
-
My brother's pc is very laggy nowadays with this Trojan horse...Originally posted by crofty:I had that problem
go download some free anti-spyware programs and clear it..but it cannot be totally cleared
How did you manage to get rid of this? -
As Trojan.Lop?Originally posted by Xiao Jun:Yes...AVG detected this file as a virus
If yes, try this:
Download Gromozon removal tool from Prevx and save it to somewhere convenient. Don't run it directly via a browser.
Double click to run it and follow the prompt given. If required to restart, restart the PC.
If Gromozon removal tool reports that Gromozon infection is found, DO NOT CONTINUE THE STEPS BELOW. Please post back the Gromozon log.
If nothing is found, restart your PC. Open HijackThis and put a tick against these entries:
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {5AB17D46-C4F2-49D2-5405-D6C9F916FF7E} - C:\WINDOWS\fvpxh1.dll (file missing)
Restart your computer in Safe Mode:- [*]When you see BIOS screen, start pressing F8.
[*]A boot menu will appear shortly.
[*]Using the up down arrows, select Safe Mode and press the Enter key.
[*]Windows will now load.
[*]Log in to your usual account.
Show hidden files and folders- [*]Open My Computer.
[*]Go to Tools > Folder Options.
[*]Select the View tab.
[*]Scroll down to Hidden files and folders.
[*]Select Show hidden files and folders.
[*]Click OK.
[*]Close My Computer.
Navigate to C:\Windows and delete this file: fvpxh1.dll
Restart your PC in Normal Mode.
Please download ATF Cleaner by Atribune.
Note: This program is for XP and Windows 2000 only.- [*]Double-click ATF-Cleaner.exe to run the program.
[*]Under Main choose: Select All.
[*]Click the Empty Selected button.
If you use Firefox browser- [*]Click Firefox at the top and choose: Select All.
[*]Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser- [*]Click Opera at the top and choose: Select All.
[*]Click the Empty Selected button.
[*]NOTE: If you would like to keep your saved passwords, please click No at the prompt.- [*]Please download Sysclean Package by Trend Micro and save it to your desktop.
[*]Download the latest Virus Pattern Files by Trend Micro and save it to your destkop. It is named lptXXX, where XXX are numbers.
Note: Do not download the Virus Pattern Files if you don't intend to do a scan. Only download it when you want to do a scan, as they are being updated daily.
[*]Create a new folder on your desktop.
[*]Right click on your desktop.
[*]Click on New > Folder.
[*]Type in Trend Micro as the name of the folder.
[*]Select sysclean.com by clicking once. Press Ctrl + X simultaneously.
[*]Open the Trend Micro folder you created earlier. Press Ctrl + V to paste sysclean.com into the folder.
[*]Right click and select Extract All.
[*]Click on Browse. Navigate to the Trend Micro folder and click OK.
[*]Click Next, then Finish.
[*]Close all opened windows except the Trend Micro folder.
[*]Double click on sysclean.com to run it.
[*]Check (tick) Automatically Clean Infected Files box.
[*]Once the scanning is done, click Exit.
[*]A sysclean.log is created in the Trend Micro folder.
[*]Copy and paste that log in your next reply.- [*]Please download AVG Anti-Spyware and save it to your desktop.
[*]Double click on avgas-setup-7.5.0.50.exe to install AVG Anti-Spyware. Install it in the default location.
[*]Once installed, start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
[*]In the main screen, you should see Your Computer's Security.
[*]Next to Resident Shield, click on Change state. It should now be Inactive.
[*]Next to Automatic Updates, click on Change state. It should now be Inactive.
[*]Next to Last Update, click on Update now. If your firewall prompts you, tell your firewall to allow it. Should you be unable to update it, download the updates from here. Save it to your desktop. Double click to run the installation and the updates will be installed. Make sure AVG Anti-Spyware is closed during the installation.
[*]Right-click the AVG Anti-Spyware icon near the clock and uncheck (untick) Start with Windows. Confirm by clicking Yes.
[*]Now click on the Scanner button at the top.
[*]Select the Settings tab.
[*]Under How to act?, click on Recommended actions and select Quarantine.
[*]Under How to scan?, check (tick) all the boxes.
[*]Under Possibly unwanted software:, check (tick) all the boxes.
[*]Under Reports:, select Automatically generate report after every scan and uncheck (untick) the Only if threats were found box.
[*]Under What to scan?, select Scan every file.
[*]Start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
[*]Click on the Scanner button at the top.
[*]Select the Scan tab.
[*]Click on Complete System Scan to start the scan.
[*]When the scan has finished, follow the instructions below.
IMPORTANT: Don't click on the Save Scan Report button before you did hit the Apply all Actions button.
[*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
[*]At the bottom of the window click on the Apply all Actions button. (3)
[*]When done, click the Save Scan Report button. (4)
[*]Click the Save Report as button.
[*]Save the report to your Desktop.
[*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Please post back a new HijackThis log, AVG Anti-Spyware log and Trend Micro Sysclean log. -
Logfile of HijackThis v1.99.1
Scan saved at 9:51:49 PM, on 2/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrojanHunter 4.6\THGuard.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HijackThis 1.99.1\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gxforever.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F3 - REG:win.ini: load=C:\WINDOWS\system32\olnnotbswm\winlogon.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\olnnotbswm\winlogon.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 spywareinfo.com
O1 - Hosts: 1.1.1.1 www.spywareinfo.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] "C:\Program Files\ltmoh\Ltmoh.exe"
O4 - HKLM\..\Run: [LoadFUJ02E3] "C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe"
O4 - HKLM\..\Run: [IndicatorUtility] "C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe"
O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] "C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe"
O4 - HKLM\..\Run: [LoadBtnHnd] "C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DispSwitchLauncher] "C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe"
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: winlogon.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pc-ap.fujitsu.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000282 (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
Is there anything harmful? -
missqi, you do have something harmful there.
Follow this post to reset Microsoft Hosts File settings.
Then post back a new HijackThis log. -
Logfile of HijackThis v1.99.1
Scan saved at 10:09:19 PM, on 2/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrojanHunter 4.6\THGuard.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HijackThis 1.99.1\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gxforever.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F3 - REG:win.ini: load=C:\WINDOWS\system32\olnnotbswm\winlogon.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\olnnotbswm\winlogon.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] "C:\Program Files\ltmoh\Ltmoh.exe"
O4 - HKLM\..\Run: [LoadFUJ02E3] "C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe"
O4 - HKLM\..\Run: [IndicatorUtility] "C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe"
O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] "C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe"
O4 - HKLM\..\Run: [LoadBtnHnd] "C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DispSwitchLauncher] "C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe"
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: winlogon.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pc-ap.fujitsu.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000282 (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -
Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.
You are strongly advised to do the following:- [*]Disconnect the computer from the Internet and from any networked computers until it is cleaned.
[*]Back up all your important data except programs. The programs can be reinstalled back from the orignal disc or from the Net.
[*]Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
[*]From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.
To help you understand more, please take some time to read the follwing articles:
What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
When should do a reformat and reinstallation of my OS
Where to backup your files
How to backup your files in Windows XP
Restoring your backups
The backdoor trojan that you have: SDBot.
_____________________________________________________________
If you don't wish to reformat, please follow the instructions below:
Download SDFix.exe and save it to your Desktop.
Double click on SDFix to extract it. When completed, Notepad will open, telling you where it's been extracted to.
Close Notepad and restart in Safe Mode.- [*]When you see BIOS screen, start pressing F8.
[*]A boot menu will appear shortly.
[*]Using the up down arrows, select Safe Mode and press the Enter key.
[*]Windows will now load.
[*]Log in to your usual account.- [*]Open the extracted SDFix folder and double click RunThis.bat to start the script.
[*]Type Y to begin the cleanup process.
[*]It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
[*]Press any Key and it will restart the PC.
[*]When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
[*]Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
[*]Finally paste the contents of the Report.txt back on the forum with a new HijackThis log. -
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Name:
Client IP-IPX
Path:
"C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000282
Client IP-IPX Deleted
Restoring Windows Registry Entries
Restoring Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Below files will be copied to Backups folder then removed:
C:\Documents and Settings\qibi\Start Menu\Programs\Startup\winlogon.lnk - Deleted
C:\WINDOWS\regedit.com - Deleted
C:\WINDOWS\system32\netstat.com - Deleted
C:\WINDOWS\system32\svchosts.exe - Deleted
C:\WINDOWS\system32\taskkill.com - Deleted
ADS Check:
C:\WINDOWS\system32
No streams found.
Final Check:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\\Documents and Settings\\qibi\\My Documents\\music,qi\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\qibi\\My Documents\\music,qi\\LimeWire\\LimeWire.exe:*
isabled:LimeWire"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*isabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\eDonkey2000\\edonkey2000.exe"="C:\\Program Files\\eDonkey2000\\edonkey2000.exe:*:Enabled:edonkey2000"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
Remaining Files:
---------------
Backups Folder: - C:\SDFix\backups\backups.zip
Checking For Files with Hidden Attributes :
C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe
C:\WINDOWS\system32\olnnotbswm\winlogon.exe
C:\WINDOWS\system32\rqstv.tmp
Finished -
HijackThis log?
-
hijack this cannot open.
open le auto close...
and is renamed as dumb le. -
Download Itty Bitty Process Manager.
Save it and extract it.
Click on the diskette button at the top right hand corner to save it.
Copy and paste this log here. -
link doesnt workOriginally posted by ndmmxiaomayi:Download Itty Bitty Process Manager.
Save it and extract it.
Click on the diskette button at the top right hand corner to save it.
Copy and paste this log here. -
-
autoclose!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Originally posted by ndmmxiaomayi:
-
Process list saved on 11:31:49 PM, on 2/13/2007
Platform: WinNT 5.01.2600 SP2
[pid] [full path to filename] [file version] [company name]
528 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
1152 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
1196 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
1208 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
1380 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1628 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1704 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe 9.0.2.10 Intel Corporation
1756 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe 9.0.2.10 Intel Corporation
608 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation
716 C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
780 C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe 1.0.0.4
812 C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe 1.0.0.1
844 C:\WINDOWS\system32\o2flash.exe
1056 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe 9.0.2.10 Intel Corporation
1068 C:\Program Files\CyberLink\Shared Files\RichVideo.exe 1.0.0.1321
1264 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1656 C:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
1556 C:\WINDOWS\system32\igfxpers.exe 3.0.0.4333 Intel Corporation
200 C:\WINDOWS\RTHDCPL.EXE 2.0.1.2 Realtek Semiconductor Corp.
1600 C:\WINDOWS\AGRSMMSG.exe 2.1.57.0 Agere Systems
2068 C:\Program Files\ltmoh\Ltmoh.exe 1.7.6.0 Agere Systems
2080 C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe 1.1.0.0 FUJITSU LIMITED
2092 C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe 2.6.0.0 FUJITSU LIMITED
2132 C:\Program Files\Messenger\msmsgs.exe 4.7.0.3001 Microsoft Corporation
2140 C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe 4.4.0.0 FUJITSU LIMITED
2152 C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe 2.5.0.1 FUJITSU LIMITED
2164 C:\WINDOWS\System32\DLA\DLACTRLW.EXE 5.10.15.0 Sonic Solutions
2224 C:\Program Files\Fingerprint Sensor\ATSwpNav.exe 6.4.12.0 AuthenTec, Inc.
2336 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe 9.0.2.10 Intel Corporation
2388 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe 9.0.2.10 Intel Corporation
2408 C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe 32.0.0.0 FUJITSU LIMITED
2460 C:\Program Files\Apoint2K\Apoint.exe 5.3.10.174 Alps Electric Co., Ltd.
2468 C:\WINDOWS\system32\rundll32.exe 5.1.2600.2180 Microsoft Corporation
2484 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe 5.0.30.7 Sun Microsystems, Inc.
2508 C:\Program Files\Common Files\Real\Update_OB\realsched.exe 0.1.0.3510 RealNetworks, Inc.
2580 C:\WINDOWS\system32\LVCOMSX.EXE 8.4.7.1036 Logitech Inc.
2668 C:\Program Files\Logitech\Video\LogiTray.exe 8.4.7.1034 Logitech Inc.
2748 C:\WINDOWS\system32\igfxext.exe 3.0.0.4333 Intel Corporation
2856 C:\WINDOWS\system32\igfxsrvc.exe 3.0.0.4333 Intel Corporation
2876 C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe 9.0.2.10 Intel
3024 C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe 4.0.3.1 Maxtor Corporation
3240 C:\Program Files\Apoint2K\HidFind.exe 1.1.0.20 Alps Electric Co., Ltd.
3236 C:\Program Files\iTunes\iTunesHelper.exe 7.0.2.16 Apple Computer, Inc.
3252 C:\Program Files\Apoint2K\Apntex.exe 5.0.1.15 Alps Electric Co., Ltd.
3300 C:\Program Files\TrojanHunter 4.6\THGuard.exe 4.5.0.277 Mischel Internet Security
3472 C:\Program Files\iPod\bin\iPodService.exe 7.0.2.16 Apple Computer, Inc.
3936 C:\Program Files\MSN Messenger\msnmsgr.exe 7.5.324.0 Microsoft Corporation
1472 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe 1.2.1128.5462 Google Inc.
2264 C:\Program Files\Logitech\Video\FxSvr2.exe 8.4.7.1034 Logitech Inc.
208 C:\WINDOWS\system32\olnnotbswm\snew.exe
3368 C:\Program Files\Mozilla Firefox\firefox.exe 1.8.20061.20418 Mozilla Corporation
2832 C:\Program Files\Common Files\{0C3A8FA7-06C5-1033-0118-060620200001}\Update.exe
3336 C:\Documents and Settings\qibi\My Documents\ibprocman\IBProcMan.exe 1.4.0.0 Soeperman Enterprises Ltd. -
Haha, I still got ways.Originally posted by missqi:autoclose!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 
Download Process Explorer
Again, save and extract it.
Double click on procexp to run it.
Then click on File > Save As
Note where you save it. Copy and paste the log here. -
Is Itty Bitty Process Manager still open?
If yes, do this:
Click on C:\WINDOWS\system32\olnnotbswm\snew.exe
Then click the Kill Process button
Repeat for this: C:\Program Files\Common Files\{0C3A8FA7-06C5-1033-0118-060620200001}\Update.exe
Then see if you can open HijackThis again.
I also need you to upload these two files to VirusTotal or Jotti for a scan.
Post back the scan results of these 2 files as well as HijackThis (if you managed to get it running) -
Process PID CPU Description Company Name
System Idle Process 0 66.18
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4 2.94
smss.exe 528 Windows NT Session Manager Microsoft Corporation
csrss.exe 1128 4.41
winlogon.exe 1152 Windows NT Logon Application Microsoft Corporation
services.exe 1196 2.94 Services and Controller app Microsoft Corporation
svchost.exe 1380 Generic Host Process for Win32 Services Microsoft Corporation
msmsgs.exe 2132 Windows Messenger Microsoft Corporation
igfxext.exe 2748 igfxext Module Intel Corporation
igfxsrvc.exe 2856 igfxsrvc Module Intel Corporation
1XConfig.exe 2876 8021XConfig Module Intel
FxSvr2.exe 2264 QuickCam Framework Server Logitech Inc.
svchost.exe 1436
svchost.exe 1628 Generic Host Process for Win32 Services Microsoft Corporation
EvtEng.exe 1704 EvtEng Module Intel Corporation
S24EvMon.exe 1756 Event Monitor - Supports driver extensions to NIC Driver for wireless adapters. Intel Corporation
svchost.exe 1832
svchost.exe 188
spoolsv.exe 608 Spooler SubSystem App Microsoft Corporation
BTNtService.exe 716
svchost.exe 728
MaxBackServiceInt.exe 780 MaxBackServiceInt Module
SyncServices.exe 812 SyncServices
o2flash.exe 844
RegSrvc.exe 1056 RegSrvc Module Intel Corporation
RichVideo.exe 1068 RichVideo Module
svchost.exe 1264 Generic Host Process for Win32 Services Microsoft Corporation
wdfmgr.exe 1412
iPodService.exe 3472 iPodService Module Apple Computer, Inc.
lsass.exe 1208 LSA Shell (Export Version) Microsoft Corporation
explorer.exe 1656 1.47 Windows Explorer Microsoft Corporation
igfxpers.exe 1556 persistence Module Intel Corporation
RTHDCPL.EXE 200 Realtek HD Audio Control Panel Realtek Semiconductor Corp.
AGRSMMSG.exe 1600 SoftModem Messaging Applet Agere Systems
ltmoh.exe 2068 LtMoh MFC Application Agere Systems
FUJ02E3.exe 2080 FUJ02E3 Utility FUJITSU LIMITED
IndicatorUty.exe 2092 Fujitsu Hotkey Utility FUJITSU LIMITED
QuickTouch.exe 2140 LifeBook Application Panel / Core FUJITSU LIMITED
BtnHnd.exe 2152 Button handler FUJITSU LIMITED
DLACTRLW.EXE 2164 Drive Letter Access Component Sonic Solutions
ATSwpNav.exe 2224 ATSwpNav Application AuthenTec, Inc.
ZCfgSvc.exe 2336 ZeroCfgSvc MFC Application Intel Corporation
iFrmewrk.exe 2388 Intel Framework MFC Application Intel Corporation
DispSwitchLauncher.exe 2408 Fujitsu Display Manager Launcher FUJITSU LIMITED
Apoint.exe 2460 Alps Pointing-device Driver Alps Electric Co., Ltd.
Hidfind.exe 3240 Alps Pointing-device Driver Alps Electric Co., Ltd.
rundll32.exe 2468 Run a DLL as an App Microsoft Corporation
jusched.exe 2484 Java(TM) 2 Platform Standard Edition binary Sun Microsystems, Inc.
realsched.exe 2508 RealNetworks Scheduler RealNetworks, Inc.
LVCOMSX.EXE 2580 LVCom Server Logitech Inc.
LogiTray.exe 2668 ImageStudio Tray Application Logitech Inc.
OneTouch.exe 3024 Maxtor OneTouch Detection Maxtor Corporation
iTunesHelper.exe 3236 iTunesHelper Module Apple Computer, Inc.
THGuard.exe 3300 4.41 TrojanHunter Guard Mischel Internet Security
msnmsgr.exe 3936 MSN Messenger Microsoft Corporation
GoogleToolbarNotifier.exe 1472 GoogleToolbarNotifier Google Inc.
procexp.exe 2792 14.71 Sysinternals Process Explorer Sysinternals
ApntEx.exe 3252 Alps Pointing-device Driver for Windows NT/2000/XP Alps Electric Co., Ltd.
snew.exe 208
firefox.exe 3368 2.94 Firefox Mozilla Corporation
Update.exe 2832
I had to attempt save it many times b4 it auto closed... -
auto close too...Originally posted by ndmmxiaomayi:Is Itty Bitty Process Manager still open?
If yes, do this:
Click on C:\WINDOWS\system32\olnnotbswm\snew.exe
Then click the Kill Process button
Repeat for this: C:\Program Files\Common Files\{0C3A8FA7-06C5-1033-0118-060620200001}\Update.exe
Then see if you can open HijackThis again.
I also need you to upload these two files to VirusTotal or Jotti for a scan.
Post back the scan results of these 2 files as well as HijackThis (if you managed to get it running)
v pekcek....