Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 




Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > HijackThis Log Help
Spyware Help Needed Spyware Help Needed
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read

HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help.

Reply
 
Thread Tools
Old 04-11-2005, 10:35 AM   #1 (permalink)
Registered User
 
Join Date: Mar 2005
Posts: 10
OS: xp pro


Spyware Help Needed
I ran the HJT and the HJT Analyzer and here are the results. I have lots of popups so any help would be great.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 4/1/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 12:25:39 PM, on 4/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\WINDOWS\system32\Flc.exe
C:\WINDOWS\system32\ntddetect.exe
C:\Program Files\Media Pass\MediaPassK.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 127.0.0.3 greg-tut.com
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [mzaryf] C:\WINDOWS\mzaryf.exe
O4 - HKLM\..\Run: [Qus] C:\WINDOWS\system32\Flc.exe
O4 - HKLM\..\Run: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKLM\..\Run: [loader32] C:\WINDOWS\loader32.exe
O4 - HKLM\..\Run: [Pte] C:\WINDOWS\system32\Cqp.exe
O4 - HKLM\..\Run: [Ljj] C:\WINDOWS\Itm.exe
O4 - HKLM\..\Run: [Pdl] C:\WINDOWS\Lqj.exe
O4 - HKLM\..\Run: [Ehj] C:\WINDOWS\Ltt.exe
O4 - HKLM\..\Run: [Ctv] C:\WINDOWS\system32\Naj.exe
O4 - HKLM\..\Run: [Dpt] C:\WINDOWS\His.exe
O4 - HKLM\..\Run: [Gql] C:\WINDOWS\Lhp.exe
O4 - HKLM\..\Run: [Ovb] C:\WINDOWS\Tlc.exe
O4 - HKLM\..\Run: [Gih] C:\WINDOWS\Suv.exe
O4 - HKLM\..\Run: [Pfg] C:\WINDOWS\Nlg.exe
O4 - HKLM\..\Run: [Snb] C:\WINDOWS\system32\Svn.exe
O4 - HKLM\..\Run: [Pkd] C:\WINDOWS\Cda.exe
O4 - HKLM\..\Run: [Vap] C:\WINDOWS\system32\Ulm.exe
O4 - HKLM\..\Run: [Lsi] C:\WINDOWS\system32\Svs.exe
O4 - HKLM\..\Run: [Cir] C:\WINDOWS\Ivv.exe
O4 - HKLM\..\Run: [Euj] C:\WINDOWS\Tgm.exe
O4 - HKLM\..\Run: [Fmg] C:\WINDOWS\Btv.exe
O4 - HKLM\..\Run: [Gpu] C:\WINDOWS\system32\Boc.exe
O4 - HKLM\..\Run: [Toq] C:\WINDOWS\Pgp.exe
O4 - HKLM\..\Run: [Nsi] C:\WINDOWS\Fpm.exe
O4 - HKLM\..\Run: [Dpd] C:\WINDOWS\system32\Ttq.exe
O4 - HKLM\..\Run: [Cct] C:\WINDOWS\system32\Kjv.exe
O4 - HKLM\..\Run: [Oev] C:\WINDOWS\Esb.exe
O4 - HKLM\..\Run: [Vmh] C:\WINDOWS\system32\Baq.exe
O4 - HKLM\..\Run: [Ijs] C:\WINDOWS\system32\Gdb.exe
O4 - HKLM\..\Run: [Qbj] C:\WINDOWS\system32\Lbk.exe
O4 - HKLM\..\Run: [Eam] C:\WINDOWS\system32\Enm.exe
O4 - HKLM\..\Run: [Res] C:\WINDOWS\Toq.exe
O4 - HKLM\..\Run: [Jkg] C:\WINDOWS\system32\Hml.exe
O4 - HKLM\..\Run: [Fdj] C:\WINDOWS\Coo.exe
O4 - HKLM\..\Run: [Gfe] C:\WINDOWS\Nrc.exe
O4 - HKLM\..\Run: [Vgl] C:\WINDOWS\system32\Sqt.exe
O4 - HKLM\..\Run: [Thd] C:\WINDOWS\system32\Oaa.exe
O4 - HKLM\..\Run: [Cgb] C:\WINDOWS\system32\Flq.exe
O4 - HKLM\..\Run: [Vdd] C:\WINDOWS\Hbb.exe
O4 - HKLM\..\Run: [Qpc] C:\WINDOWS\Gvq.exe
O4 - HKLM\..\Run: [Ogd] C:\WINDOWS\system32\Djq.exe
O4 - HKLM\..\Run: [Teh] C:\WINDOWS\Vpd.exe
O4 - HKLM\..\Run: [Nhr] C:\WINDOWS\Elp.exe
O4 - HKLM\..\Run: [Bfp] C:\WINDOWS\system32\Olf.exe
O4 - HKLM\..\Run: [Mfl] C:\WINDOWS\system32\Ucd.exe
O4 - HKLM\..\Run: [Vhp] C:\WINDOWS\Bcn.exe
O4 - HKLM\..\Run: [Sas] C:\WINDOWS\system32\Gua.exe
O4 - HKLM\..\Run: [Paq] C:\WINDOWS\system32\Gns.exe
O4 - HKLM\..\Run: [Kef] C:\WINDOWS\Btb.exe
O4 - HKLM\..\Run: [Vvf] C:\WINDOWS\system32\Prp.exe
O4 - HKLM\..\Run: [Eeu] C:\WINDOWS\Bdh.exe
O4 - HKLM\..\Run: [Knr] C:\WINDOWS\Maf.exe
O4 - HKLM\..\Run: [Sgr] C:\WINDOWS\system32\Frj.exe
O4 - HKLM\..\Run: [Oio] C:\WINDOWS\system32\Jjc.exe
O4 - HKLM\..\Run: [Sbv] C:\WINDOWS\Vjh.exe
O4 - HKLM\..\Run: [Eeg] C:\WINDOWS\system32\Rfa.exe
O4 - HKLM\..\Run: [Tgb] C:\WINDOWS\Dbd.exe
O4 - HKLM\..\Run: [Gvn] C:\WINDOWS\Qjn.exe
O4 - HKLM\..\Run: [Fid] C:\WINDOWS\system32\Rar.exe
O4 - HKLM\..\Run: [Lfv] C:\WINDOWS\Mrs.exe
O4 - HKLM\..\Run: [Tog] C:\WINDOWS\Ajv.exe
O4 - HKLM\..\Run: [Asu] C:\WINDOWS\Nro.exe
O4 - HKLM\..\Run: [Fin] C:\WINDOWS\Coj.exe
O4 - HKLM\..\Run: [Frp] C:\WINDOWS\Jef.exe
O4 - HKLM\..\Run: [Str] C:\WINDOWS\Opv.exe
O4 - HKLM\..\Run: [Omo] C:\WINDOWS\Nth.exe
O4 - HKLM\..\Run: [Qld] C:\WINDOWS\Vqs.exe
O4 - HKLM\..\Run: [Loq] C:\WINDOWS\system32\Jjv.exe
O4 - HKLM\..\Run: [Ttb] C:\WINDOWS\system32\Uma.exe
O4 - HKLM\..\Run: [Pap] C:\WINDOWS\Gff.exe
O4 - HKLM\..\Run: [Nfs] C:\WINDOWS\Lji.exe
O4 - HKLM\..\Run: [Utd] C:\WINDOWS\Pan.exe
O4 - HKLM\..\Run: [Coa] C:\WINDOWS\Sho.exe
O4 - HKLM\..\Run: [Gso] C:\WINDOWS\Ocj.exe
O4 - HKLM\..\Run: [Hee] C:\WINDOWS\Hgn.exe
O4 - HKLM\..\Run: [Afl] C:\WINDOWS\Imf.exe
O4 - HKLM\..\Run: [Vub] C:\WINDOWS\system32\Ubc.exe
O4 - HKLM\..\Run: [Bsr] C:\WINDOWS\Gfs.exe
O4 - HKLM\..\Run: [Eim] C:\WINDOWS\system32\Rhd.exe
O4 - HKLM\..\Run: [Bgb] C:\WINDOWS\Duk.exe
O4 - HKLM\..\Run: [Fpg] C:\WINDOWS\system32\Dru.exe
O4 - HKLM\..\Run: [Mom] C:\WINDOWS\system32\Nra.exe
O4 - HKLM\..\Run: [Kij] C:\WINDOWS\system32\Vnt.exe
O4 - HKLM\..\Run: [Ask] C:\WINDOWS\Ndt.exe
O4 - HKLM\..\Run: [Nee] C:\WINDOWS\Rar.exe
O4 - HKLM\..\Run: [Vlp] C:\WINDOWS\Dmc.exe
O4 - HKLM\..\Run: [Dpu] C:\WINDOWS\system32\Pga.exe
O4 - HKLM\..\Run: [Pcq] C:\WINDOWS\Vld.exe
O4 - HKLM\..\Run: [Aio] C:\WINDOWS\Ice.exe
O4 - HKLM\..\Run: [Drg] C:\WINDOWS\Osb.exe
O4 - HKLM\..\Run: [Uav] C:\WINDOWS\Ioh.exe
O4 - HKLM\..\Run: [Htp] C:\WINDOWS\system32\Ngr.exe
O4 - HKLM\..\Run: [Gcm] C:\WINDOWS\Qqp.exe
O4 - HKLM\..\Run: [Rhm] C:\WINDOWS\Nkf.exe
O4 - HKLM\..\Run: [Cov] C:\WINDOWS\system32\Jdl.exe
O4 - HKLM\..\Run: [Qvf] C:\WINDOWS\Rpr.exe
O4 - HKLM\..\Run: [Ojh] C:\WINDOWS\system32\Kuj.exe
O4 - HKLM\..\Run: [Hrc] C:\WINDOWS\Nso.exe
O4 - HKLM\..\Run: [Hpt] C:\WINDOWS\system32\Qok.exe
O4 - HKLM\..\Run: [Ukt] C:\WINDOWS\system32\Vab.exe
O4 - HKLM\..\Run: [Vjl] C:\WINDOWS\system32\Esp.exe
O4 - HKLM\..\Run: [Idj] C:\WINDOWS\Rqk.exe
O4 - HKLM\..\Run: [Cqr] C:\WINDOWS\system32\Ndc.exe
O4 - HKLM\..\Run: [Lvh] C:\WINDOWS\Omk.exe
O4 - HKLM\..\Run: [Hap] C:\WINDOWS\Fkd.exe
O4 - HKLM\..\Run: [Lfd] C:\WINDOWS\Jfk.exe
O4 - HKLM\..\Run: [Veq] C:\WINDOWS\system32\Inb.exe
O4 - HKLM\..\Run: [Hge] C:\WINDOWS\system32\Ulp.exe
O4 - HKLM\..\Run: [Grf] C:\WINDOWS\system32\Deu.exe
O4 - HKLM\..\Run: [Njj] C:\WINDOWS\system32\Ltt.exe
O4 - HKLM\..\Run: [Duq] C:\WINDOWS\Lqs.exe
O4 - HKLM\..\Run: [Ntc] C:\WINDOWS\system32\Cmd.exe
O4 - HKLM\..\Run: [Ejv] C:\WINDOWS\system32\Dcm.exe
O4 - HKLM\..\Run: [Poj] C:\WINDOWS\system32\Ecf.exe
O4 - HKLM\..\Run: [Arg] C:\WINDOWS\Eoh.exe
O4 - HKLM\..\Run: [Umr] C:\WINDOWS\Kgj.exe
O4 - HKLM\..\Run: [Ikq] C:\WINDOWS\system32\Kqn.exe
O4 - HKLM\..\Run: [Eke] C:\WINDOWS\Eno.exe
O4 - HKLM\..\Run: [Ovh] C:\WINDOWS\system32\Bpc.exe
O4 - HKLM\..\Run: [Lsv] C:\WINDOWS\system32\Cnl.exe
O4 - HKLM\..\Run: [Nju] C:\WINDOWS\system32\Tra.exe
O4 - HKLM\..\Run: [Ktr] C:\WINDOWS\Rav.exe
O4 - HKLM\..\Run: [Hmv] C:\WINDOWS\system32\Gnv.exe
O4 - HKLM\..\Run: [Pod] C:\WINDOWS\system32\Oiq.exe
O4 - HKLM\..\Run: [Jkj] C:\WINDOWS\Tti.exe
O4 - HKLM\..\Run: [Onu] C:\WINDOWS\system32\Tvj.exe
O4 - HKLM\..\Run: [Pfi] C:\WINDOWS\system32\Fil.exe
O4 - HKLM\..\Run: [Soe] C:\WINDOWS\Blv.exe
O4 - HKLM\..\Run: [Ifk] C:\WINDOWS\Odg.exe
O4 - HKLM\..\Run: [Ueo] C:\WINDOWS\system32\Tlc.exe
O4 - HKLM\..\Run: [Qvn] C:\WINDOWS\system32\Sme.exe
O4 - HKLM\..\Run: [Guh] C:\WINDOWS\Nje.exe
O4 - HKLM\..\Run: [Scr] C:\WINDOWS\Sfa.exe
O4 - HKLM\..\Run: [Lbj] C:\WINDOWS\Bam.exe
O4 - HKLM\..\Run: [Sio] C:\WINDOWS\Jon.exe
O4 - HKLM\..\Run: [Ngt] C:\WINDOWS\Rmj.exe
O4 - HKLM\..\Run: [Ddi] C:\WINDOWS\system32\Pub.exe
O4 - HKLM\..\Run: [Dol] C:\WINDOWS\system32\Juj.exe
O4 - HKLM\..\Run: [Jrh] C:\WINDOWS\system32\Cvs.exe
O4 - HKLM\..\Run: [Dkq] C:\WINDOWS\system32\Eeh.exe
O4 - HKLM\..\Run: [Pir] C:\WINDOWS\system32\Bum.exe
O4 - HKLM\..\Run: [Gce] C:\WINDOWS\system32\Sfb.exe
O4 - HKLM\..\Run: [Ahq] C:\WINDOWS\system32\Lfb.exe
O4 - HKLM\..\Run: [Uvg] C:\WINDOWS\system32\Hgl.exe
O4 - HKLM\..\Run: [Khv] C:\WINDOWS\system32\Obo.exe
O4 - HKLM\..\Run: [Cma] C:\WINDOWS\Uah.exe
O4 - HKLM\..\Run: [Hfr] C:\WINDOWS\Pup.exe
O4 - HKLM\..\Run: [Nba] C:\WINDOWS\system32\Rbq.exe
O4 - HKLM\..\Run: [Tmv] C:\WINDOWS\system32\Btk.exe
O4 - HKLM\..\Run: [Nib] C:\WINDOWS\system32\Fbh.exe
O4 - HKLM\..\Run: [Hdt] C:\WINDOWS\Ckh.exe
O4 - HKLM\..\Run: [Oic] C:\WINDOWS\system32\Ope.exe
O4 - HKLM\..\Run: [Jkt] C:\WINDOWS\system32\Tge.exe
O4 - HKLM\..\Run: [Hvv] C:\WINDOWS\system32\Vnt.exe
O4 - HKLM\..\Run: [Iru] C:\WINDOWS\system32\Dtg.exe
O4 - HKLM\..\Run: [Mir] C:\WINDOWS\system32\Aed.exe
O4 - HKLM\..\Run: [Ubt] C:\WINDOWS\Pcv.exe
O4 - HKLM\..\Run: [Dkl] C:\WINDOWS\system32\Mfk.exe
O4 - HKLM\..\Run: [Rgt] C:\WINDOWS\system32\Srt.exe
O4 - HKLM\..\Run: [Qem] C:\WINDOWS\Pfc.exe
O4 - HKLM\..\Run: [Nmf] C:\WINDOWS\system32\Ggn.exe
O4 - HKLM\..\Run: [Gkf] C:\WINDOWS\system32\Eqo.exe
O4 - HKLM\..\Run: [Lbg] C:\WINDOWS\Bdc.exe
O4 - HKLM\..\Run: [Tql] C:\WINDOWS\system32\Mtb.exe
O4 - HKLM\..\Run: [Hpp] C:\WINDOWS\Sfe.exe
O4 - HKLM\..\Run: [Gho] C:\WINDOWS\system32\Baj.exe
O4 - HKLM\..\Run: [Lte] C:\WINDOWS\Kgg.exe
O4 - HKLM\..\Run: [Eoc] C:\WINDOWS\Aqk.exe
O4 - HKLM\..\Run: [Ves] C:\WINDOWS\Qpb.exe
O4 - HKLM\..\Run: [Hvo] C:\WINDOWS\Atp.exe
O4 - HKLM\..\Run: [Goo] C:\WINDOWS\Gcn.exe
O4 - HKLM\..\Run: [Enf] C:\WINDOWS\system32\Gfl.exe
O4 - HKLM\..\Run: [Iih] C:\WINDOWS\Grg.exe
O4 - HKLM\..\Run: [Shp] C:\WINDOWS\Dcr.exe
O4 - HKLM\..\Run: [Epm] C:\WINDOWS\system32\Ucu.exe
O4 - HKLM\..\Run: [Pem] C:\WINDOWS\Kcs.exe
O4 - HKLM\..\Run: [Dqt] C:\WINDOWS\Gme.exe
O4 - HKLM\..\Run: [Ugm] C:\WINDOWS\system32\Rcc.exe
O4 - HKLM\..\Run: [Uch] C:\WINDOWS\Lqo.exe
O4 - HKLM\..\Run: [Sha] C:\WINDOWS\Bvi.exe
O4 - HKLM\..\Run: [Ert] C:\WINDOWS\Dci.exe
O4 - HKLM\..\Run: [Prj] C:\WINDOWS\system32\Han.exe
O4 - HKLM\..\Run: [Hqd] C:\WINDOWS\Kgr.exe
O4 - HKLM\..\Run: [Atm] C:\WINDOWS\Qkg.exe
O4 - HKLM\..\Run: [Vgc] C:\WINDOWS\Clf.exe
O4 - HKLM\..\Run: [Pel] C:\WINDOWS\Jet.exe
O4 - HKLM\..\Run: [Hna] C:\WINDOWS\Fbq.exe
O4 - HKLM\..\Run: [Hcb] C:\WINDOWS\system32\Epa.exe
O4 - HKLM\..\Run: [Mhl] C:\WINDOWS\Abi.exe
O4 - HKLM\..\Run: [Srp] C:\WINDOWS\system32\Crg.exe
O4 - HKLM\..\Run: [Aoc] C:\WINDOWS\Iej.exe
O4 - HKLM\..\Run: [Joc] C:\WINDOWS\system32\Euq.exe
O4 - HKLM\..\Run: [Uig] C:\WINDOWS\Afn.exe
O4 - HKLM\..\Run: [Nnm] C:\WINDOWS\system32\Uag.exe
O4 - HKLM\..\Run: [Mcp] C:\WINDOWS\Fqc.exe
O4 - HKLM\..\Run: [Pmq] C:\WINDOWS\system32\Csk.exe
O4 - HKLM\..\Run: [Mtt] C:\WINDOWS\Igh.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Bkq] C:\WINDOWS\system32\Kmh.exe
O4 - HKLM\..\RunServices: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [Qus] C:\WINDOWS\system32\Flc.exe
O4 - HKCU\..\Run: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKCU\..\Run: [Pte] C:\WINDOWS\system32\Cqp.exe
O4 - HKCU\..\Run: [Ljj] C:\WINDOWS\Itm.exe
O4 - HKCU\..\Run: [Pdl] C:\WINDOWS\Lqj.exe
O4 - HKCU\..\Run: [Ehj] C:\WINDOWS\Ltt.exe
O4 - HKCU\..\Run: [Ctv] C:\WINDOWS\system32\Naj.exe
O4 - HKCU\..\Run: [Dpt] C:\WINDOWS\His.exe
O4 - HKCU\..\Run: [Gql] C:\WINDOWS\Lhp.exe
O4 - HKCU\..\Run: [Ovb] C:\WINDOWS\Tlc.exe
O4 - HKCU\..\Run: [Gih] C:\WINDOWS\Suv.exe
O4 - HKCU\..\Run: [Pfg] C:\WINDOWS\Nlg.exe
O4 - HKCU\..\Run: [Snb] C:\WINDOWS\system32\Svn.exe
O4 - HKCU\..\Run: [Pkd] C:\WINDOWS\Cda.exe
O4 - HKCU\..\Run: [Vap] C:\WINDOWS\system32\Ulm.exe
O4 - HKCU\..\Run: [Lsi] C:\WINDOWS\system32\Svs.exe
O4 - HKCU\..\Run: [Cir] C:\WINDOWS\Ivv.exe
O4 - HKCU\..\Run: [Euj] C:\WINDOWS\Tgm.exe
O4 - HKCU\..\Run: [Fmg] C:\WINDOWS\Btv.exe
O4 - HKCU\..\Run: [Gpu] C:\WINDOWS\system32\Boc.exe
O4 - HKCU\..\Run: [Toq] C:\WINDOWS\Pgp.exe
O4 - HKCU\..\Run: [Nsi] C:\WINDOWS\Fpm.exe
O4 - HKCU\..\Run: [Dpd] C:\WINDOWS\system32\Ttq.exe
O4 - HKCU\..\Run: [Cct] C:\WINDOWS\system32\Kjv.exe
O4 - HKCU\..\Run: [Oev] C:\WINDOWS\Esb.exe
O4 - HKCU\..\Run: [Vmh] C:\WINDOWS\system32\Baq.exe
O4 - HKCU\..\Run: [Ijs] C:\WINDOWS\system32\Gdb.exe
O4 - HKCU\..\Run: [Qbj] C:\WINDOWS\system32\Lbk.exe
O4 - HKCU\..\Run: [Eam] C:\WINDOWS\system32\Enm.exe
O4 - HKCU\..\Run: [Res] C:\WINDOWS\Toq.exe
O4 - HKCU\..\Run: [Jkg] C:\WINDOWS\system32\Hml.exe
O4 - HKCU\..\Run: [Fdj] C:\WINDOWS\Coo.exe
O4 - HKCU\..\Run: [Gfe] C:\WINDOWS\Nrc.exe
O4 - HKCU\..\Run: [Vgl] C:\WINDOWS\system32\Sqt.exe
O4 - HKCU\..\Run: [Thd] C:\WINDOWS\system32\Oaa.exe
O4 - HKCU\..\Run: [Cgb] C:\WINDOWS\system32\Flq.exe
O4 - HKCU\..\Run: [Vdd] C:\WINDOWS\Hbb.exe
O4 - HKCU\..\Run: [Qpc] C:\WINDOWS\Gvq.exe
O4 - HKCU\..\Run: [Ogd] C:\WINDOWS\system32\Djq.exe
O4 - HKCU\..\Run: [Teh] C:\WINDOWS\Vpd.exe
O4 - HKCU\..\Run: [Nhr] C:\WINDOWS\Elp.exe
O4 - HKCU\..\Run: [Bfp] C:\WINDOWS\system32\Olf.exe
O4 - HKCU\..\Run: [Mfl] C:\WINDOWS\system32\Ucd.exe
O4 - HKCU\..\Run: [Vhp] C:\WINDOWS\Bcn.exe
O4 - HKCU\..\Run: [Sas] C:\WINDOWS\system32\Gua.exe
O4 - HKCU\..\Run: [Paq] C:\WINDOWS\system32\Gns.exe
O4 - HKCU\..\Run: [Kef] C:\WINDOWS\Btb.exe
O4 - HKCU\..\Run: [Vvf] C:\WINDOWS\system32\Prp.exe
O4 - HKCU\..\Run: [Eeu] C:\WINDOWS\Bdh.exe
O4 - HKCU\..\Run: [Knr] C:\WINDOWS\Maf.exe
O4 - HKCU\..\Run: [Sgr] C:\WINDOWS\system32\Frj.exe
O4 - HKCU\..\Run: [Oio] C:\WINDOWS\system32\Jjc.exe
O4 - HKCU\..\Run: [Sbv] C:\WINDOWS\Vjh.exe
O4 - HKCU\..\Run: [Eeg] C:\WINDOWS\system32\Rfa.exe
O4 - HKCU\..\Run: [Tgb] C:\WINDOWS\Dbd.exe
O4 - HKCU\..\Run: [Gvn] C:\WINDOWS\Qjn.exe
O4 - HKCU\..\Run: [Fid] C:\WINDOWS\system32\Rar.exe
O4 - HKCU\..\Run: [Lfv] C:\WINDOWS\Mrs.exe
O4 - HKCU\..\Run: [Tog] C:\WINDOWS\Ajv.exe
O4 - HKCU\..\Run: [Asu] C:\WINDOWS\Nro.exe
O4 - HKCU\..\Run: [Fin] C:\WINDOWS\Coj.exe
O4 - HKCU\..\Run: [Frp] C:\WINDOWS\Jef.exe
O4 - HKCU\..\Run: [Str] C:\WINDOWS\Opv.exe
O4 - HKCU\..\Run: [Omo] C:\WINDOWS\Nth.exe
O4 - HKCU\..\Run: [Qld] C:\WINDOWS\Vqs.exe
O4 - HKCU\..\Run: [Loq] C:\WINDOWS\system32\Jjv.exe
O4 - HKCU\..\Run: [Ttb] C:\WINDOWS\system32\Uma.exe
O4 - HKCU\..\Run: [Pap] C:\WINDOWS\Gff.exe
O4 - HKCU\..\Run: [Nfs] C:\WINDOWS\Lji.exe
O4 - HKCU\..\Run: [Utd] C:\WINDOWS\Pan.exe
O4 - HKCU\..\Run: [Coa] C:\WINDOWS\Sho.exe
O4 - HKCU\..\Run: [Gso] C:\WINDOWS\Ocj.exe
O4 - HKCU\..\Run: [Hee] C:\WINDOWS\Hgn.exe
O4 - HKCU\..\Run: [Afl] C:\WINDOWS\Imf.exe
O4 - HKCU\..\Run: [Vub] C:\WINDOWS\system32\Ubc.exe
O4 - HKCU\..\Run: [Bsr] C:\WINDOWS\Gfs.exe
O4 - HKCU\..\Run: [Eim] C:\WINDOWS\system32\Rhd.exe
O4 - HKCU\..\Run: [Bgb] C:\WINDOWS\Duk.exe
O4 - HKCU\..\Run: [Fpg] C:\WINDOWS\system32\Dru.exe
O4 - HKCU\..\Run: [Mom] C:\WINDOWS\system32\Nra.exe
O4 - HKCU\..\Run: [Kij] C:\WINDOWS\system32\Vnt.exe
O4 - HKCU\..\Run: [Ask] C:\WINDOWS\Ndt.exe
O4 - HKCU\..\Run: [Nee] C:\WINDOWS\Rar.exe
O4 - HKCU\..\Run: [Vlp] C:\WINDOWS\Dmc.exe
O4 - HKCU\..\Run: [Dpu] C:\WINDOWS\system32\Pga.exe
O4 - HKCU\..\Run: [Pcq] C:\WINDOWS\Vld.exe
O4 - HKCU\..\Run: [Aio] C:\WINDOWS\Ice.exe
O4 - HKCU\..\Run: [Drg] C:\WINDOWS\Osb.exe
O4 - HKCU\..\Run: [Uav] C:\WINDOWS\Ioh.exe
O4 - HKCU\..\Run: [Htp] C:\WINDOWS\system32\Ngr.exe
O4 - HKCU\..\Run: [Gcm] C:\WINDOWS\Qqp.exe
O4 - HKCU\..\Run: [Rhm] C:\WINDOWS\Nkf.exe
O4 - HKCU\..\Run: [Cov] C:\WINDOWS\system32\Jdl.exe
O4 - HKCU\..\Run: [Qvf] C:\WINDOWS\Rpr.exe
O4 - HKCU\..\Run: [Ojh] C:\WINDOWS\system32\Kuj.exe
O4 - HKCU\..\Run: [Hrc] C:\WINDOWS\Nso.exe
O4 - HKCU\..\Run: [Hpt] C:\WINDOWS\system32\Qok.exe
O4 - HKCU\..\Run: [Ukt] C:\WINDOWS\system32\Vab.exe
O4 - HKCU\..\Run: [Vjl] C:\WINDOWS\system32\Esp.exe
O4 - HKCU\..\Run: [Idj] C:\WINDOWS\Rqk.exe
O4 - HKCU\..\Run: [Cqr] C:\WINDOWS\system32\Ndc.exe
O4 - HKCU\..\Run: [Lvh] C:\WINDOWS\Omk.exe
O4 - HKCU\..\Run: [Hap] C:\WINDOWS\Fkd.exe
O4 - HKCU\..\Run: [Lfd] C:\WINDOWS\Jfk.exe
O4 - HKCU\..\Run: [Veq] C:\WINDOWS\system32\Inb.exe
O4 - HKCU\..\Run: [Hge] C:\WINDOWS\system32\Ulp.exe
O4 - HKCU\..\Run: [Grf] C:\WINDOWS\system32\Deu.exe
O4 - HKCU\..\Run: [Njj] C:\WINDOWS\system32\Ltt.exe
O4 - HKCU\..\Run: [Duq] C:\WINDOWS\Lqs.exe
O4 - HKCU\..\Run: [Ntc] C:\WINDOWS\system32\Cmd.exe
O4 - HKCU\..\Run: [Ejv] C:\WINDOWS\system32\Dcm.exe
O4 - HKCU\..\Run: [Poj] C:\WINDOWS\system32\Ecf.exe
O4 - HKCU\..\Run: [Arg] C:\WINDOWS\Eoh.exe
O4 - HKCU\..\Run: [Umr] C:\WINDOWS\Kgj.exe
O4 - HKCU\..\Run: [Ikq] C:\WINDOWS\system32\Kqn.exe
O4 - HKCU\..\Run: [Eke] C:\WINDOWS\Eno.exe
O4 - HKCU\..\Run: [Ovh] C:\WINDOWS\system32\Bpc.exe
O4 - HKCU\..\Run: [Lsv] C:\WINDOWS\system32\Cnl.exe
O4 - HKCU\..\Run: [Nju] C:\WINDOWS\system32\Tra.exe
O4 - HKCU\..\Run: [Ktr] C:\WINDOWS\Rav.exe
O4 - HKCU\..\Run: [Hmv] C:\WINDOWS\system32\Gnv.exe
O4 - HKCU\..\Run: [Pod] C:\WINDOWS\system32\Oiq.exe
O4 - HKCU\..\Run: [Jkj] C:\WINDOWS\Tti.exe
O4 - HKCU\..\Run: [Onu] C:\WINDOWS\system32\Tvj.exe
O4 - HKCU\..\Run: [Pfi] C:\WINDOWS\system32\Fil.exe
O4 - HKCU\..\Run: [Soe] C:\WINDOWS\Blv.exe
O4 - HKCU\..\Run: [Ifk] C:\WINDOWS\Odg.exe
O4 - HKCU\..\Run: [Ueo] C:\WINDOWS\system32\Tlc.exe
O4 - HKCU\..\Run: [Qvn] C:\WINDOWS\system32\Sme.exe
O4 - HKCU\..\Run: [Guh] C:\WINDOWS\Nje.exe
O4 - HKCU\..\Run: [Scr] C:\WINDOWS\Sfa.exe
O4 - HKCU\..\Run: [Lbj] C:\WINDOWS\Bam.exe
O4 - HKCU\..\Run: [Sio] C:\WINDOWS\Jon.exe
O4 - HKCU\..\Run: [Ngt] C:\WINDOWS\Rmj.exe
O4 - HKCU\..\Run: [Ddi] C:\WINDOWS\system32\Pub.exe
O4 - HKCU\..\Run: [Dol] C:\WINDOWS\system32\Juj.exe
O4 - HKCU\..\Run: [Jrh] C:\WINDOWS\system32\Cvs.exe
O4 - HKCU\..\Run: [Dkq] C:\WINDOWS\system32\Eeh.exe
O4 - HKCU\..\Run: [Pir] C:\WINDOWS\system32\Bum.exe
O4 - HKCU\..\Run: [Gce] C:\WINDOWS\system32\Sfb.exe
O4 - HKCU\..\Run: [Ahq] C:\WINDOWS\system32\Lfb.exe
O4 - HKCU\..\Run: [Uvg] C:\WINDOWS\system32\Hgl.exe
O4 - HKCU\..\Run: [Khv] C:\WINDOWS\system32\Obo.exe
O4 - HKCU\..\Run: [Cma] C:\WINDOWS\Uah.exe
O4 - HKCU\..\Run: [Hfr] C:\WINDOWS\Pup.exe
O4 - HKCU\..\Run: [Nba] C:\WINDOWS\system32\Rbq.exe
O4 - HKCU\..\Run: [Tmv] C:\WINDOWS\system32\Btk.exe
O4 - HKCU\..\Run: [Nib] C:\WINDOWS\system32\Fbh.exe
O4 - HKCU\..\Run: [Hdt] C:\WINDOWS\Ckh.exe
O4 - HKCU\..\Run: [Oic] C:\WINDOWS\system32\Ope.exe
O4 - HKCU\..\Run: [Jkt] C:\WINDOWS\system32\Tge.exe
O4 - HKCU\..\Run: [Hvv] C:\WINDOWS\system32\Vnt.exe
O4 - HKCU\..\Run: [Iru] C:\WINDOWS\system32\Dtg.exe
O4 - HKCU\..\Run: [Mir] C:\WINDOWS\system32\Aed.exe
O4 - HKCU\..\Run: [Ubt] C:\WINDOWS\Pcv.exe
O4 - HKCU\..\Run: [Dkl] C:\WINDOWS\system32\Mfk.exe
O4 - HKCU\..\Run: [Rgt] C:\WINDOWS\system32\Srt.exe
O4 - HKCU\..\Run: [Qem] C:\WINDOWS\Pfc.exe
O4 - HKCU\..\Run: [Nmf] C:\WINDOWS\system32\Ggn.exe
O4 - HKCU\..\Run: [Gkf] C:\WINDOWS\system32\Eqo.exe
O4 - HKCU\..\Run: [Lbg] C:\WINDOWS\Bdc.exe
O4 - HKCU\..\Run: [Tql] C:\WINDOWS\system32\Mtb.exe
O4 - HKCU\..\Run: [Hpp] C:\WINDOWS\Sfe.exe
O4 - HKCU\..\Run: [Gho] C:\WINDOWS\system32\Baj.exe
O4 - HKCU\..\Run: [Lte] C:\WINDOWS\Kgg.exe
O4 - HKCU\..\Run: [Eoc] C:\WINDOWS\Aqk.exe
O4 - HKCU\..\Run: [Ves] C:\WINDOWS\Qpb.exe
O4 - HKCU\..\Run: [Hvo] C:\WINDOWS\Atp.exe
O4 - HKCU\..\Run: [Goo] C:\WINDOWS\Gcn.exe
O4 - HKCU\..\Run: [Enf] C:\WINDOWS\system32\Gfl.exe
O4 - HKCU\..\Run: [Iih] C:\WINDOWS\Grg.exe
O4 - HKCU\..\Run: [Shp] C:\WINDOWS\Dcr.exe
O4 - HKCU\..\Run: [Epm] C:\WINDOWS\system32\Ucu.exe
O4 - HKCU\..\Run: [Pem] C:\WINDOWS\Kcs.exe
O4 - HKCU\..\Run: [Dqt] C:\WINDOWS\Gme.exe
O4 - HKCU\..\Run: [Ugm] C:\WINDOWS\system32\Rcc.exe
O4 - HKCU\..\Run: [Uch] C:\WINDOWS\Lqo.exe
O4 - HKCU\..\Run: [Sha] C:\WINDOWS\Bvi.exe
O4 - HKCU\..\Run: [Ert] C:\WINDOWS\Dci.exe
O4 - HKCU\..\Run: [Prj] C:\WINDOWS\system32\Han.exe
O4 - HKCU\..\Run: [Hqd] C:\WINDOWS\Kgr.exe
O4 - HKCU\..\Run: [Atm] C:\WINDOWS\Qkg.exe
O4 - HKCU\..\Run: [Vgc] C:\WINDOWS\Clf.exe
O4 - HKCU\..\Run: [Pel] C:\WINDOWS\Jet.exe
O4 - HKCU\..\Run: [Hna] C:\WINDOWS\Fbq.exe
O4 - HKCU\..\Run: [Hcb] C:\WINDOWS\system32\Epa.exe
O4 - HKCU\..\Run: [Mhl] C:\WINDOWS\Abi.exe
O4 - HKCU\..\Run: [Srp] C:\WINDOWS\system32\Crg.exe
O4 - HKCU\..\Run: [Aoc] C:\WINDOWS\Iej.exe
O4 - HKCU\..\Run: [Joc] C:\WINDOWS\system32\Euq.exe
O4 - HKCU\..\Run: [Uig] C:\WINDOWS\Afn.exe
O4 - HKCU\..\Run: [Nnm] C:\WINDOWS\system32\Uag.exe
O4 - HKCU\..\Run: [Mcp] C:\WINDOWS\Fqc.exe
O4 - HKCU\..\Run: [Pmq] C:\WINDOWS\system32\Csk.exe
O4 - HKCU\..\Run: [Mtt] C:\WINDOWS\Igh.exe
O4 - HKCU\..\Run: [Bkq] C:\WINDOWS\system32\Kmh.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1109833910141
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe


End of KRC HijackThis Analyzer Log.
bpurcy76 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 04-11-2005, 10:06 PM   #2 (permalink)
Analyst, Security Team
 
kworley517's Avatar
 
Join Date: Feb 2005
Location: South Florida
Posts: 538
OS: XP Pro


Wow.... Here we go...
Hello Bpurcy76 and welcome to TSF...

In order to assist you better, we recommend that you Subscribe to this thread to be notified of fixes as soon as they are posted by our Team. You can do this simply by clicking the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread".

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro http://uk.trendmicro-europe.com/ente...all_launch.php. Just follow the instructions on the site to run the online scan. If any viruses/trojans are detected, try to delete or clean them in that site. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Please download Ad-aware SE and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Also go here to get the plug-in for fixing VX2 variants. To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner. Then click Run Tool and OK to start it. If it's clean, it will say Status System Clean. Otherwise, you will have to click on the Clean button to remove the VX2 infection. Also make sure to customize the settings in Ad-aware for better scan results. Run the scan and fix everything that it finds.

Download and install Spybot S&D http://security.kolla.de/. Run Spybot and click on the 'Search for Updates' button. Install any updates that are available.

Now click Mode menu and choose 'Advanced Mode'. Next click on Immunize to your left. Click the Immunize button (green cross) on top to Immunize your computer - you should do this each time there is an update. Now go to Tools->Resident and make sure that TeaTimer is checked. What this will do is monitor any system/registry changes and will ask you for permission to change any of these settings.

Now click on the 'Spybot-S&D' option on the top left to go back to the main screen. Next click on the 'Check for Problems' button. Let it run the scan. If it finds something, check all those in RED and hit the 'Fix Selected Problems' button. Exit Spybot. If you keep getting the DSO Exploit entries, even after you updated Windows and fixed them, then download the Spybot DSO Exploit Fix http://majorgeeks.com/download4392.html and install it over the current Spybot installation.

Download CWShredder and run it. Click on 'I Agree' button if you agree with it. Click on 'Fix' (it will automatically fix anything it finds for you) and OK. If it asks if you want to delete a certain random file, choose No and post that filename here. Let it finish the scan and then hit Next and Exit.

Download Hoster http://www.greyknight17.com/spy/Hoster.exe and run it. Choose the 'Restore Original Hosts' button and press OK.

Right click on this link http://www.greyknight17.com/spy/DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link don't work) and install it. Do not run it yet...

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):

C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\WINDOWS\system32\Flc.exe
C:\WINDOWS\system32\ntddetect.exe
C:\Program Files\Media Pass\MediaPassK.exe

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

Media Pass
WinTools

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [mzaryf] C:\WINDOWS\mzaryf.exe
O4 - HKLM\..\Run: [Qus] C:\WINDOWS\system32\Flc.exe
O4 - HKLM\..\Run: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKLM\..\Run: [loader32] C:\WINDOWS\loader32.exe
O4 - HKLM\..\Run: [Pte] C:\WINDOWS\system32\Cqp.exe
O4 - HKLM\..\Run: [Ljj] C:\WINDOWS\Itm.exe
O4 - HKLM\..\Run: [Pdl] C:\WINDOWS\Lqj.exe
O4 - HKLM\..\Run: [Ehj] C:\WINDOWS\Ltt.exe
O4 - HKLM\..\Run: [Ctv] C:\WINDOWS\system32\Naj.exe
O4 - HKLM\..\Run: [Dpt] C:\WINDOWS\His.exe
O4 - HKLM\..\Run: [Gql] C:\WINDOWS\Lhp.exe
O4 - HKLM\..\Run: [Ovb] C:\WINDOWS\Tlc.exe
O4 - HKLM\..\Run: [Gih] C:\WINDOWS\Suv.exe
O4 - HKLM\..\Run: [Pfg] C:\WINDOWS\Nlg.exe
O4 - HKLM\..\Run: [Snb] C:\WINDOWS\system32\Svn.exe
O4 - HKLM\..\Run: [Pkd] C:\WINDOWS\Cda.exe
O4 - HKLM\..\Run: [Vap] C:\WINDOWS\system32\Ulm.exe
O4 - HKLM\..\Run: [Lsi] C:\WINDOWS\system32\Svs.exe
O4 - HKLM\..\Run: [Cir] C:\WINDOWS\Ivv.exe
O4 - HKLM\..\Run: [Euj] C:\WINDOWS\Tgm.exe
O4 - HKLM\..\Run: [Fmg] C:\WINDOWS\Btv.exe
O4 - HKLM\..\Run: [Gpu] C:\WINDOWS\system32\Boc.exe
O4 - HKLM\..\Run: [Toq] C:\WINDOWS\Pgp.exe
O4 - HKLM\..\Run: [Nsi] C:\WINDOWS\Fpm.exe
O4 - HKLM\..\Run: [Dpd] C:\WINDOWS\system32\Ttq.exe
O4 - HKLM\..\Run: [Cct] C:\WINDOWS\system32\Kjv.exe
O4 - HKLM\..\Run: [Oev] C:\WINDOWS\Esb.exe
O4 - HKLM\..\Run: [Vmh] C:\WINDOWS\system32\Baq.exe
O4 - HKLM\..\Run: [Ijs] C:\WINDOWS\system32\Gdb.exe
O4 - HKLM\..\Run: [Qbj] C:\WINDOWS\system32\Lbk.exe
O4 - HKLM\..\Run: [Eam] C:\WINDOWS\system32\Enm.exe
O4 - HKLM\..\Run: [Res] C:\WINDOWS\Toq.exe
O4 - HKLM\..\Run: [Jkg] C:\WINDOWS\system32\Hml.exe
O4 - HKLM\..\Run: [Fdj] C:\WINDOWS\Coo.exe
O4 - HKLM\..\Run: [Gfe] C:\WINDOWS\Nrc.exe
O4 - HKLM\..\Run: [Vgl] C:\WINDOWS\system32\Sqt.exe
O4 - HKLM\..\Run: [Thd] C:\WINDOWS\system32\Oaa.exe
O4 - HKLM\..\Run: [Cgb] C:\WINDOWS\system32\Flq.exe
O4 - HKLM\..\Run: [Vdd] C:\WINDOWS\Hbb.exe
O4 - HKLM\..\Run: [Qpc] C:\WINDOWS\Gvq.exe
O4 - HKLM\..\Run: [Ogd] C:\WINDOWS\system32\Djq.exe
O4 - HKLM\..\Run: [Teh] C:\WINDOWS\Vpd.exe
O4 - HKLM\..\Run: [Nhr] C:\WINDOWS\Elp.exe
O4 - HKLM\..\Run: [Bfp] C:\WINDOWS\system32\Olf.exe
O4 - HKLM\..\Run: [Mfl] C:\WINDOWS\system32\Ucd.exe
O4 - HKLM\..\Run: [Vhp] C:\WINDOWS\Bcn.exe
O4 - HKLM\..\Run: [Sas] C:\WINDOWS\system32\Gua.exe
O4 - HKLM\..\Run: [Paq] C:\WINDOWS\system32\Gns.exe
O4 - HKLM\..\Run: [Kef] C:\WINDOWS\Btb.exe
O4 - HKLM\..\Run: [Vvf] C:\WINDOWS\system32\Prp.exe
O4 - HKLM\..\Run: [Eeu] C:\WINDOWS\Bdh.exe
O4 - HKLM\..\Run: [Knr] C:\WINDOWS\Maf.exe
O4 - HKLM\..\Run: [Sgr] C:\WINDOWS\system32\Frj.exe
O4 - HKLM\..\Run: [Oio] C:\WINDOWS\system32\Jjc.exe
O4 - HKLM\..\Run: [Sbv] C:\WINDOWS\Vjh.exe
O4 - HKLM\..\Run: [Eeg] C:\WINDOWS\system32\Rfa.exe
O4 - HKLM\..\Run: [Tgb] C:\WINDOWS\Dbd.exe
O4 - HKLM\..\Run: [Gvn] C:\WINDOWS\Qjn.exe
O4 - HKLM\..\Run: [Fid] C:\WINDOWS\system32\Rar.exe
O4 - HKLM\..\Run: [Lfv] C:\WINDOWS\Mrs.exe
O4 - HKLM\..\Run: [Tog] C:\WINDOWS\Ajv.exe
O4 - HKLM\..\Run: [Asu] C:\WINDOWS\Nro.exe
O4 - HKLM\..\Run: [Fin] C:\WINDOWS\Coj.exe
O4 - HKLM\..\Run: [Frp] C:\WINDOWS\Jef.exe
O4 - HKLM\..\Run: [Str] C:\WINDOWS\Opv.exe
O4 - HKLM\..\Run: [Omo] C:\WINDOWS\Nth.exe
O4 - HKLM\..\Run: [Qld] C:\WINDOWS\Vqs.exe
O4 - HKLM\..\Run: [Loq] C:\WINDOWS\system32\Jjv.exe
O4 - HKLM\..\Run: [Ttb] C:\WINDOWS\system32\Uma.exe
O4 - HKLM\..\Run: [Pap] C:\WINDOWS\Gff.exe
O4 - HKLM\..\Run: [Nfs] C:\WINDOWS\Lji.exe
O4 - HKLM\..\Run: [Utd] C:\WINDOWS\Pan.exe
O4 - HKLM\..\Run: [Coa] C:\WINDOWS\Sho.exe
O4 - HKLM\..\Run: [Gso] C:\WINDOWS\Ocj.exe
O4 - HKLM\..\Run: [Hee] C:\WINDOWS\Hgn.exe
O4 - HKLM\..\Run: [Afl] C:\WINDOWS\Imf.exe
O4 - HKLM\..\Run: [Vub] C:\WINDOWS\system32\Ubc.exe
O4 - HKLM\..\Run: [Bsr] C:\WINDOWS\Gfs.exe
O4 - HKLM\..\Run: [Eim] C:\WINDOWS\system32\Rhd.exe
O4 - HKLM\..\Run: [Bgb] C:\WINDOWS\Duk.exe
O4 - HKLM\..\Run: [Fpg] C:\WINDOWS\system32\Dru.exe
O4 - HKLM\..\Run: [Mom] C:\WINDOWS\system32\Nra.exe
O4 - HKLM\..\Run: [Kij] C:\WINDOWS\system32\Vnt.exe
O4 - HKLM\..\Run: [Ask] C:\WINDOWS\Ndt.exe
O4 - HKLM\..\Run: [Nee] C:\WINDOWS\Rar.exe
O4 - HKLM\..\Run: [Vlp] C:\WINDOWS\Dmc.exe
O4 - HKLM\..\Run: [Dpu] C:\WINDOWS\system32\Pga.exe
O4 - HKLM\..\Run: [Pcq] C:\WINDOWS\Vld.exe
O4 - HKLM\..\Run: [Aio] C:\WINDOWS\Ice.exe
O4 - HKLM\..\Run: [Drg] C:\WINDOWS\Osb.exe
O4 - HKLM\..\Run: [Uav] C:\WINDOWS\Ioh.exe
O4 - HKLM\..\Run: [Htp] C:\WINDOWS\system32\Ngr.exe
O4 - HKLM\..\Run: [Gcm] C:\WINDOWS\Qqp.exe
O4 - HKLM\..\Run: [Rhm] C:\WINDOWS\Nkf.exe
O4 - HKLM\..\Run: [Cov] C:\WINDOWS\system32\Jdl.exe
O4 - HKLM\..\Run: [Qvf] C:\WINDOWS\Rpr.exe
O4 - HKLM\..\Run: [Ojh] C:\WINDOWS\system32\Kuj.exe
O4 - HKLM\..\Run: [Hrc] C:\WINDOWS\Nso.exe
O4 - HKLM\..\Run: [Hpt] C:\WINDOWS\system32\Qok.exe
O4 - HKLM\..\Run: [Ukt] C:\WINDOWS\system32\Vab.exe
O4 - HKLM\..\Run: [Vjl] C:\WINDOWS\system32\Esp.exe
O4 - HKLM\..\Run: [Idj] C:\WINDOWS\Rqk.exe
O4 - HKLM\..\Run: [Cqr] C:\WINDOWS\system32\Ndc.exe
O4 - HKLM\..\Run: [Lvh] C:\WINDOWS\Omk.exe
O4 - HKLM\..\Run: [Hap] C:\WINDOWS\Fkd.exe
O4 - HKLM\..\Run: [Lfd] C:\WINDOWS\Jfk.exe
O4 - HKLM\..\Run: [Veq] C:\WINDOWS\system32\Inb.exe
O4 - HKLM\..\Run: [Hge] C:\WINDOWS\system32\Ulp.exe
O4 - HKLM\..\Run: [Grf] C:\WINDOWS\system32\Deu.exe
O4 - HKLM\..\Run: [Njj] C:\WINDOWS\system32\Ltt.exe
O4 - HKLM\..\Run: [Duq] C:\WINDOWS\Lqs.exe
O4 - HKLM\..\Run: [Ntc] C:\WINDOWS\system32\Cmd.exe -=> Delete this file only by following the instructions below!!!
O4 - HKLM\..\Run: [Ejv] C:\WINDOWS\system32\Dcm.exe
O4 - HKLM\..\Run: [Poj] C:\WINDOWS\system32\Ecf.exe
O4 - HKLM\..\Run: [Arg] C:\WINDOWS\Eoh.exe
O4 - HKLM\..\Run: [Umr] C:\WINDOWS\Kgj.exe
O4 - HKLM\..\Run: [Ikq] C:\WINDOWS\system32\Kqn.exe
O4 - HKLM\..\Run: [Eke] C:\WINDOWS\Eno.exe
O4 - HKLM\..\Run: [Ovh] C:\WINDOWS\system32\Bpc.exe
O4 - HKLM\..\Run: [Lsv] C:\WINDOWS\system32\Cnl.exe
O4 - HKLM\..\Run: [Nju] C:\WINDOWS\system32\Tra.exe
O4 - HKLM\..\Run: [Ktr] C:\WINDOWS\Rav.exe
O4 - HKLM\..\Run: [Hmv] C:\WINDOWS\system32\Gnv.exe
O4 - HKLM\..\Run: [Pod] C:\WINDOWS\system32\Oiq.exe
O4 - HKLM\..\Run: [Jkj] C:\WINDOWS\Tti.exe
O4 - HKLM\..\Run: [Onu] C:\WINDOWS\system32\Tvj.exe
O4 - HKLM\..\Run: [Pfi] C:\WINDOWS\system32\Fil.exe
O4 - HKLM\..\Run: [Soe] C:\WINDOWS\Blv.exe
O4 - HKLM\..\Run: [Ifk] C:\WINDOWS\Odg.exe
O4 - HKLM\..\Run: [Ueo] C:\WINDOWS\system32\Tlc.exe
O4 - HKLM\..\Run: [Qvn] C:\WINDOWS\system32\Sme.exe
O4 - HKLM\..\Run: [Guh] C:\WINDOWS\Nje.exe
O4 - HKLM\..\Run: [Scr] C:\WINDOWS\Sfa.exe
O4 - HKLM\..\Run: [Lbj] C:\WINDOWS\Bam.exe
O4 - HKLM\..\Run: [Sio] C:\WINDOWS\Jon.exe
O4 - HKLM\..\Run: [Ngt] C:\WINDOWS\Rmj.exe
O4 - HKLM\..\Run: [Ddi] C:\WINDOWS\system32\Pub.exe
O4 - HKLM\..\Run: [Dol] C:\WINDOWS\system32\Juj.exe
O4 - HKLM\..\Run: [Jrh] C:\WINDOWS\system32\Cvs.exe
O4 - HKLM\..\Run: [Dkq] C:\WINDOWS\system32\Eeh.exe
O4 - HKLM\..\Run: [Pir] C:\WINDOWS\system32\Bum.exe
O4 - HKLM\..\Run: [Gce] C:\WINDOWS\system32\Sfb.exe
O4 - HKLM\..\Run: [Ahq] C:\WINDOWS\system32\Lfb.exe
O4 - HKLM\..\Run: [Uvg] C:\WINDOWS\system32\Hgl.exe
O4 - HKLM\..\Run: [Khv] C:\WINDOWS\system32\Obo.exe
O4 - HKLM\..\Run: [Cma] C:\WINDOWS\Uah.exe
O4 - HKLM\..\Run: [Hfr] C:\WINDOWS\Pup.exe
O4 - HKLM\..\Run: [Nba] C:\WINDOWS\system32\Rbq.exe
O4 - HKLM\..\Run: [Tmv] C:\WINDOWS\system32\Btk.exe
O4 - HKLM\..\Run: [Nib] C:\WINDOWS\system32\Fbh.exe
O4 - HKLM\..\Run: [Hdt] C:\WINDOWS\Ckh.exe
O4 - HKLM\..\Run: [Oic] C:\WINDOWS\system32\Ope.exe
O4 - HKLM\..\Run: [Jkt] C:\WINDOWS\system32\Tge.exe
O4 - HKLM\..\Run: [Hvv] C:\WINDOWS\system32\Vnt.exe
O4 - HKLM\..\Run: [Iru] C:\WINDOWS\system32\Dtg.exe
O4 - HKLM\..\Run: [Mir] C:\WINDOWS\system32\Aed.exe
O4 - HKLM\..\Run: [Ubt] C:\WINDOWS\Pcv.exe
O4 - HKLM\..\Run: [Dkl] C:\WINDOWS\system32\Mfk.exe
O4 - HKLM\..\Run: [Rgt] C:\WINDOWS\system32\Srt.exe
O4 - HKLM\..\Run: [Qem] C:\WINDOWS\Pfc.exe
O4 - HKLM\..\Run: [Nmf] C:\WINDOWS\system32\Ggn.exe
O4 - HKLM\..\Run: [Gkf] C:\WINDOWS\system32\Eqo.exe
O4 - HKLM\..\Run: [Lbg] C:\WINDOWS\Bdc.exe
O4 - HKLM\..\Run: [Tql] C:\WINDOWS\system32\Mtb.exe
O4 - HKLM\..\Run: [Hpp] C:\WINDOWS\Sfe.exe
O4 - HKLM\..\Run: [Gho] C:\WINDOWS\system32\Baj.exe
O4 - HKLM\..\Run: [Lte] C:\WINDOWS\Kgg.exe
O4 - HKLM\..\Run: [Eoc] C:\WINDOWS\Aqk.exe
O4 - HKLM\..\Run: [Ves] C:\WINDOWS\Qpb.exe
O4 - HKLM\..\Run: [Hvo] C:\WINDOWS\Atp.exe
O4 - HKLM\..\Run: [Goo] C:\WINDOWS\Gcn.exe
O4 - HKLM\..\Run: [Enf] C:\WINDOWS\system32\Gfl.exe
O4 - HKLM\..\Run: [Iih] C:\WINDOWS\Grg.exe
O4 - HKLM\..\Run: [Shp] C:\WINDOWS\Dcr.exe
O4 - HKLM\..\Run: [Epm] C:\WINDOWS\system32\Ucu.exe
O4 - HKLM\..\Run: [Pem] C:\WINDOWS\Kcs.exe
O4 - HKLM\..\Run: [Dqt] C:\WINDOWS\Gme.exe
O4 - HKLM\..\Run: [Ugm] C:\WINDOWS\system32\Rcc.exe
O4 - HKLM\..\Run: [Uch] C:\WINDOWS\Lqo.exe
O4 - HKLM\..\Run: [Sha] C:\WINDOWS\Bvi.exe
O4 - HKLM\..\Run: [Ert] C:\WINDOWS\Dci.exe
O4 - HKLM\..\Run: [Prj] C:\WINDOWS\system32\Han.exe
O4 - HKLM\..\Run: [Hqd] C:\WINDOWS\Kgr.exe
O4 - HKLM\..\Run: [Atm] C:\WINDOWS\Qkg.exe
O4 - HKLM\..\Run: [Vgc] C:\WINDOWS\Clf.exe
O4 - HKLM\..\Run: [Pel] C:\WINDOWS\Jet.exe
O4 - HKLM\..\Run: [Hna] C:\WINDOWS\Fbq.exe
O4 - HKLM\..\Run: [Hcb] C:\WINDOWS\system32\Epa.exe
O4 - HKLM\..\Run: [Mhl] C:\WINDOWS\Abi.exe
O4 - HKLM\..\Run: [Srp] C:\WINDOWS\system32\Crg.exe
O4 - HKLM\..\Run: [Aoc] C:\WINDOWS\Iej.exe
O4 - HKLM\..\Run: [Joc] C:\WINDOWS\system32\Euq.exe
O4 - HKLM\..\Run: [Uig] C:\WINDOWS\Afn.exe
O4 - HKLM\..\Run: [Nnm] C:\WINDOWS\system32\Uag.exe
O4 - HKLM\..\Run: [Mcp] C:\WINDOWS\Fqc.exe
O4 - HKLM\..\Run: [Pmq] C:\WINDOWS\system32\Csk.exe
O4 - HKLM\..\Run: [Mtt] C:\WINDOWS\Igh.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Bkq] C:\WINDOWS\system32\Kmh.exe
O4 - HKLM\..\RunServices: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [Qus] C:\WINDOWS\system32\Flc.exe
O4 - HKCU\..\Run: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKCU\..\Run: [Pte] C:\WINDOWS\system32\Cqp.exe
O4 - HKCU\..\Run: [Ljj] C:\WINDOWS\Itm.exe
O4 - HKCU\..\Run: [Pdl] C:\WINDOWS\Lqj.exe
O4 - HKCU\..\Run: [Ehj] C:\WINDOWS\Ltt.exe
O4 - HKCU\..\Run: [Ctv] C:\WINDOWS\system32\Naj.exe
O4 - HKCU\..\Run: [Dpt] C:\WINDOWS\His.exe
O4 - HKCU\..\Run: [Gql] C:\WINDOWS\Lhp.exe
O4 - HKCU\..\Run: [Ovb] C:\WINDOWS\Tlc.exe
O4 - HKCU\..\Run: [Gih] C:\WINDOWS\Suv.exe
O4 - HKCU\..\Run: [Pfg] C:\WINDOWS\Nlg.exe
O4 - HKCU\..\Run: [Snb] C:\WINDOWS\system32\Svn.exe
O4 - HKCU\..\Run: [Pkd] C:\WINDOWS\Cda.exe
O4 - HKCU\..\Run: [Vap] C:\WINDOWS\system32\Ulm.exe
O4 - HKCU\..\Run: [Lsi] C:\WINDOWS\system32\Svs.exe
O4 - HKCU\..\Run: [Cir] C:\WINDOWS\Ivv.exe
O4 - HKCU\..\Run: [Euj] C:\WINDOWS\Tgm.exe
O4 - HKCU\..\Run: [Fmg] C:\WINDOWS\Btv.exe
O4 - HKCU\..\Run: [Gpu] C:\WINDOWS\system32\Boc.exe
O4 - HKCU\..\Run: [Toq] C:\WINDOWS\Pgp.exe
O4 - HKCU\..\Run: [Nsi] C:\WINDOWS\Fpm.exe
O4 - HKCU\..\Run: [Dpd] C:\WINDOWS\system32\Ttq.exe
O4 - HKCU\..\Run: [Cct] C:\WINDOWS\system32\Kjv.exe
O4 - HKCU\..\Run: [Oev] C:\WINDOWS\Esb.exe
O4 - HKCU\..\Run: [Vmh] C:\WINDOWS\system32\Baq.exe
O4 - HKCU\..\Run: [Ijs] C:\WINDOWS\system32\Gdb.exe
O4 - HKCU\..\Run: [Qbj] C:\WINDOWS\system32\Lbk.exe
O4 - HKCU\..\Run: [Eam] C:\WINDOWS\system32\Enm.exe
O4 - HKCU\..\Run: [Res] C:\WINDOWS\Toq.exe
O4 - HKCU\..\Run: [Jkg] C:\WINDOWS\system32\Hml.exe
O4 - HKCU\..\Run: [Fdj] C:\WINDOWS\Coo.exe
O4 - HKCU\..\Run: [Gfe] C:\WINDOWS\Nrc.exe
O4 - HKCU\..\Run: [Vgl] C:\WINDOWS\system32\Sqt.exe
O4 - HKCU\..\Run: [Thd] C:\WINDOWS\system32\Oaa.exe
O4 - HKCU\..\Run: [Cgb] C:\WINDOWS\system32\Flq.exe
O4 - HKCU\..\Run: [Vdd] C:\WINDOWS\Hbb.exe
O4 - HKCU\..\Run: [Qpc] C:\WINDOWS\Gvq.exe
O4 - HKCU\..\Run: [Ogd] C:\WINDOWS\system32\Djq.exe
O4 - HKCU\..\Run: [Teh] C:\WINDOWS\Vpd.exe
O4 - HKCU\..\Run: [Nhr] C:\WINDOWS\Elp.exe
O4 - HKCU\..\Run: [Bfp] C:\WINDOWS\system32\Olf.exe
O4 - HKCU\..\Run: [Mfl] C:\WINDOWS\system32\Ucd.exe
O4 - HKCU\..\Run: [Vhp] C:\WINDOWS\Bcn.exe
O4 - HKCU\..\Run: [Sas] C:\WINDOWS\system32\Gua.exe
O4 - HKCU\..\Run: [Paq] C:\WINDOWS\system32\Gns.exe
O4 - HKCU\..\Run: [Kef] C:\WINDOWS\Btb.exe
O4 - HKCU\..\Run: [Vvf] C:\WINDOWS\system32\Prp.exe
O4 - HKCU\..\Run: [Eeu] C:\WINDOWS\Bdh.exe
O4 - HKCU\..\Run: [Knr] C:\WINDOWS\Maf.exe
O4 - HKCU\..\Run: [Sgr] C:\WINDOWS\system32\Frj.exe
O4 - HKCU\..\Run: [Oio] C:\WINDOWS\system32\Jjc.exe
O4 - HKCU\..\Run: [Sbv] C:\WINDOWS\Vjh.exe
O4 - HKCU\..\Run: [Eeg] C:\WINDOWS\system32\Rfa.exe
O4 - HKCU\..\Run: [Tgb] C:\WINDOWS\Dbd.exe
O4 - HKCU\..\Run: [Gvn] C:\WINDOWS\Qjn.exe
O4 - HKCU\..\Run: [Fid] C:\WINDOWS\system32\Rar.exe
O4 - HKCU\..\Run: [Lfv] C:\WINDOWS\Mrs.exe
O4 - HKCU\..\Run: [Tog] C:\WINDOWS\Ajv.exe
O4 - HKCU\..\Run: [Asu] C:\WINDOWS\Nro.exe
O4 - HKCU\..\Run: [Fin] C:\WINDOWS\Coj.exe
O4 - HKCU\..\Run: [Frp] C:\WINDOWS\Jef.exe
O4 - HKCU\..\Run: [Str] C:\WINDOWS\Opv.exe
O4 - HKCU\..\Run: [Omo] C:\WINDOWS\Nth.exe
O4 - HKCU\..\Run: [Qld] C:\WINDOWS\Vqs.exe
O4 - HKCU\..\Run: [Loq] C:\WINDOWS\system32\Jjv.exe
O4 - HKCU\..\Run: [Ttb] C:\WINDOWS\system32\Uma.exe
O4 - HKCU\..\Run: [Pap] C:\WINDOWS\Gff.exe
O4 - HKCU\..\Run: [Nfs] C:\WINDOWS\Lji.exe
O4 - HKCU\..\Run: [Utd] C:\WINDOWS\Pan.exe
O4 - HKCU\..\Run: [Coa] C:\WINDOWS\Sho.exe
O4 - HKCU\..\Run: [Gso] C:\WINDOWS\Ocj.exe
O4 - HKCU\..\Run: [Hee] C:\WINDOWS\Hgn.exe
O4 - HKCU\..\Run: [Afl] C:\WINDOWS\Imf.exe
O4 - HKCU\..\Run: [Vub] C:\WINDOWS\system32\Ubc.exe
O4 - HKCU\..\Run: [Bsr] C:\WINDOWS\Gfs.exe
O4 - HKCU\..\Run: [Eim] C:\WINDOWS\system32\Rhd.exe
O4 - HKCU\..\Run: [Bgb] C:\WINDOWS\Duk.exe
O4 - HKCU\..\Run: [Fpg] C:\WINDOWS\system32\Dru.exe
O4 - HKCU\..\Run: [Mom] C:\WINDOWS\system32\Nra.exe
O4 - HKCU\..\Run: [Kij] C:\WINDOWS\system32\Vnt.exe
O4 - HKCU\..\Run: [Ask] C:\WINDOWS\Ndt.exe
O4 - HKCU\..\Run: [Nee] C:\WINDOWS\Rar.exe
O4 - HKCU\..\Run: [Vlp] C:\WINDOWS\Dmc.exe
O4 - HKCU\..\Run: [Dpu] C:\WINDOWS\system32\Pga.exe
O4 - HKCU\..\Run: [Pcq] C:\WINDOWS\Vld.exe
O4 - HKCU\..\Run: [Aio] C:\WINDOWS\Ice.exe
O4 - HKCU\..\Run: [Drg] C:\WINDOWS\Osb.exe
O4 - HKCU\..\Run: [Uav] C:\WINDOWS\Ioh.exe
O4 - HKCU\..\Run: [Htp] C:\WINDOWS\system32\Ngr.exe
O4 - HKCU\..\Run: [Gcm] C:\WINDOWS\Qqp.exe
O4 - HKCU\..\Run: [Rhm] C:\WINDOWS\Nkf.exe
O4 - HKCU\..\Run: [Cov] C:\WINDOWS\system32\Jdl.exe
O4 - HKCU\..\Run: [Qvf] C:\WINDOWS\Rpr.exe
O4 - HKCU\..\Run: [Ojh] C:\WINDOWS\system32\Kuj.exe
O4 - HKCU\..\Run: [Hrc] C:\WINDOWS\Nso.exe
O4 - HKCU\..\Run: [Hpt] C:\WINDOWS\system32\Qok.exe
O4 - HKCU\..\Run: [Ukt] C:\WINDOWS\system32\Vab.exe
O4 - HKCU\..\Run: [Vjl] C:\WINDOWS\system32\Esp.exe
O4 - HKCU\..\Run: [Idj] C:\WINDOWS\Rqk.exe
O4 - HKCU\..\Run: [Cqr] C:\WINDOWS\system32\Ndc.exe
O4 - HKCU\..\Run: [Lvh] C:\WINDOWS\Omk.exe
O4 - HKCU\..\Run: [Hap] C:\WINDOWS\Fkd.exe
O4 - HKCU\..\Run: [Lfd] C:\WINDOWS\Jfk.exe
O4 - HKCU\..\Run: [Veq] C:\WINDOWS\system32\Inb.exe
O4 - HKCU\..\Run: [Hge] C:\WINDOWS\system32\Ulp.exe
O4 - HKCU\..\Run: [Grf] C:\WINDOWS\system32\Deu.exe
O4 - HKCU\..\Run: [Njj] C:\WINDOWS\system32\Ltt.exe
O4 - HKCU\..\Run: [Duq] C:\WINDOWS\Lqs.exe
O4 - HKCU\..\Run: [Ntc] C:\WINDOWS\system32\Cmd.exe -=> Delete this file only by following the instructions below!!!
O4 - HKCU\..\Run: [Ejv] C:\WINDOWS\system32\Dcm.exe
O4 - HKCU\..\Run: [Poj] C:\WINDOWS\system32\Ecf.exe
O4 - HKCU\..\Run: [Arg] C:\WINDOWS\Eoh.exe
O4 - HKCU\..\Run: [Umr] C:\WINDOWS\Kgj.exe
O4 - HKCU\..\Run: [Ikq] C:\WINDOWS\system32\Kqn.exe
O4 - HKCU\..\Run: [Eke] C:\WINDOWS\Eno.exe
O4 - HKCU\..\Run: [Ovh] C:\WINDOWS\system32\Bpc.exe
O4 - HKCU\..\Run: [Lsv] C:\WINDOWS\system32\Cnl.exe
O4 - HKCU\..\Run: [Nju] C:\WINDOWS\system32\Tra.exe
O4 - HKCU\..\Run: [Ktr] C:\WINDOWS\Rav.exe
O4 - HKCU\..\Run: [Hmv] C:\WINDOWS\system32\Gnv.exe
O4 - HKCU\..\Run: [Pod] C:\WINDOWS\system32\Oiq.exe
O4 - HKCU\..\Run: [Jkj] C:\WINDOWS\Tti.exe
O4 - HKCU\..\Run: [Onu] C:\WINDOWS\system32\Tvj.exe
O4 - HKCU\..\Run: [Pfi] C:\WINDOWS\system32\Fil.exe
O4 - HKCU\..\Run: [Soe] C:\WINDOWS\Blv.exe
O4 - HKCU\..\Run: [Ifk] C:\WINDOWS\Odg.exe
O4 - HKCU\..\Run: [Ueo] C:\WINDOWS\system32\Tlc.exe
O4 - HKCU\..\Run: [Qvn] C:\WINDOWS\system32\Sme.exe
O4 - HKCU\..\Run: [Guh] C:\WINDOWS\Nje.exe
O4 - HKCU\..\Run: [Scr] C:\WINDOWS\Sfa.exe
O4 - HKCU\..\Run: [Lbj] C:\WINDOWS\Bam.exe
O4 - HKCU\..\Run: [Sio] C:\WINDOWS\Jon.exe
O4 - HKCU\..\Run: [Ngt] C:\WINDOWS\Rmj.exe
O4 - HKCU\..\Run: [Ddi] C:\WINDOWS\system32\Pub.exe
O4 - HKCU\..\Run: [Dol] C:\WINDOWS\system32\Juj.exe
O4 - HKCU\..\Run: [Jrh] C:\WINDOWS\system32\Cvs.exe
O4 - HKCU\..\Run: [Dkq] C:\WINDOWS\system32\Eeh.exe
O4 - HKCU\..\Run: [Pir] C:\WINDOWS\system32\Bum.exe
O4 - HKCU\..\Run: [Gce] C:\WINDOWS\system32\Sfb.exe
O4 - HKCU\..\Run: [Ahq] C:\WINDOWS\system32\Lfb.exe
O4 - HKCU\..\Run: [Uvg] C:\WINDOWS\system32\Hgl.exe
O4 - HKCU\..\Run: [Khv] C:\WINDOWS\system32\Obo.exe
O4 - HKCU\..\Run: [Cma] C:\WINDOWS\Uah.exe
O4 - HKCU\..\Run: [Hfr] C:\WINDOWS\Pup.exe
O4 - HKCU\..\Run: [Nba] C:\WINDOWS\system32\Rbq.exe
O4 - HKCU\..\Run: [Tmv] C:\WINDOWS\system32\Btk.exe
O4 - HKCU\..\Run: [Nib] C:\WINDOWS\system32\Fbh.exe
O4 - HKCU\..\Run: [Hdt] C:\WINDOWS\Ckh.exe
O4 - HKCU\..\Run: [Oic] C:\WINDOWS\system32\Ope.exe
O4 - HKCU\..\Run: [Jkt] C:\WINDOWS\system32\Tge.exe
O4 - HKCU\..\Run: [Hvv] C:\WINDOWS\system32\Vnt.exe
O4 - HKCU\..\Run: [Iru] C:\WINDOWS\system32\Dtg.exe
O4 - HKCU\..\Run: [Mir] C:\WINDOWS\system32\Aed.exe
O4 - HKCU\..\Run: [Ubt] C:\WINDOWS\Pcv.exe
O4 - HKCU\..\Run: [Dkl] C:\WINDOWS\system32\Mfk.exe
O4 - HKCU\..\Run: [Rgt] C:\WINDOWS\system32\Srt.exe
O4 - HKCU\..\Run: [Qem] C:\WINDOWS\Pfc.exe
O4 - HKCU\..\Run: [Nmf] C:\WINDOWS\system32\Ggn.exe
O4 - HKCU\..\Run: [Gkf] C:\WINDOWS\system32\Eqo.exe
O4 - HKCU\..\Run: [Lbg] C:\WINDOWS\Bdc.exe
O4 - HKCU\..\Run: [Tql] C:\WINDOWS\system32\Mtb.exe
O4 - HKCU\..\Run: [Hpp] C:\WINDOWS\Sfe.exe
O4 - HKCU\..\Run: [Gho] C:\WINDOWS\system32\Baj.exe
O4 - HKCU\..\Run: [Lte] C:\WINDOWS\Kgg.exe
O4 - HKCU\..\Run: [Eoc] C:\WINDOWS\Aqk.exe
O4 - HKCU\..\Run: [Ves] C:\WINDOWS\Qpb.exe
O4 - HKCU\..\Run: [Hvo] C:\WINDOWS\Atp.exe
O4 - HKCU\..\Run: [Goo] C:\WINDOWS\Gcn.exe
O4 - HKCU\..\Run: [Enf] C:\WINDOWS\system32\Gfl.exe
O4 - HKCU\..\Run: [Iih] C:\WINDOWS\Grg.exe
O4 - HKCU\..\Run: [Shp] C:\WINDOWS\Dcr.exe
O4 - HKCU\..\Run: [Epm] C:\WINDOWS\system32\Ucu.exe
O4 - HKCU\..\Run: [Pem] C:\WINDOWS\Kcs.exe
O4 - HKCU\..\Run: [Dqt] C:\WINDOWS\Gme.exe
O4 - HKCU\..\Run: [Ugm] C:\WINDOWS\system32\Rcc.exe
O4 - HKCU\..\Run: [Uch] C:\WINDOWS\Lqo.exe
O4 - HKCU\..\Run: [Sha] C:\WINDOWS\Bvi.exe
O4 - HKCU\..\Run: [Ert] C:\WINDOWS\Dci.exe
O4 - HKCU\..\Run: [Prj] C:\WINDOWS\system32\Han.exe
O4 - HKCU\..\Run: [Hqd] C:\WINDOWS\Kgr.exe
O4 - HKCU\..\Run: [Atm] C:\WINDOWS\Qkg.exe
O4 - HKCU\..\Run: [Vgc] C:\WINDOWS\Clf.exe
O4 - HKCU\..\Run: [Pel] C:\WINDOWS\Jet.exe
O4 - HKCU\..\Run: [Hna] C:\WINDOWS\Fbq.exe
O4 - HKCU\..\Run: [Hcb] C:\WINDOWS\system32\Epa.exe
O4 - HKCU\..\Run: [Mhl] C:\WINDOWS\Abi.exe
O4 - HKCU\..\Run: [Srp] C:\WINDOWS\system32\Crg.exe
O4 - HKCU\..\Run: [Aoc] C:\WINDOWS\Iej.exe
O4 - HKCU\..\Run: [Joc] C:\WINDOWS\system32\Euq.exe
O4 - HKCU\..\Run: [Uig] C:\WINDOWS\Afn.exe
O4 - HKCU\..\Run: [Nnm] C:\WINDOWS\system32\Uag.exe
O4 - HKCU\..\Run: [Mcp] C:\WINDOWS\Fqc.exe
O4 - HKCU\..\Run: [Pmq] C:\WINDOWS\system32\Csk.exe
O4 - HKCU\..\Run: [Mtt] C:\WINDOWS\Igh.exe
O4 - HKCU\..\Run: [Bkq] C:\WINDOWS\system32\Kmh.exe
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

Make sure to delete ALL of the files listed above in the O4 entries that are highlighted in RED.

cmd.exe -=> Do a search for this file. (You will probably find a few of them.) Right click and select Properties > Version > Company Name. If the name of the company is NOT Microsoft Corporation, then DELETE it.... Do this for each of the instances of this file found.

C:\Program Files\Common Files\WinTools\
C:\Program Files\Media Pass\

C:\WINDOWS\system32\Flc.exe
C:\WINDOWS\system32\ntddetect.exe

Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

You should clear out the files in the Prefetch folder. Go to C:\Windows\ or C:\WINNT\ and look for the Prefetch folder. Open it up and delete all the files in that folder.

Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.
Last edited by kworley517 : 04-11-2005 at 10:08 PM.
kworley517 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 04-13-2005, 10:36 AM   #3 (permalink)
Registered User
 
Join Date: Mar 2005
Posts: 10
OS: xp pro


Still some issues!
Here is the analyzer log after following your instructions. I still have a desktop backround with a smartsecurity spyware ad that I can't get rid of.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 4/1/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 12:29:07 PM, on 4/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\WINDOWS\Bng.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Ntc] C:\WINDOWS\system32\Cmd.exe
O4 - HKLM\..\Run: [Gqd] C:\WINDOWS\Eua.exe
O4 - HKLM\..\Run: [Kfp] C:\WINDOWS\Bng.exe
O4 - HKLM\..\Run: [Dqo] C:\WINDOWS\system32\Qql.exe
O4 - HKLM\..\Run: [Apd] C:\WINDOWS\system32\Pvb.exe
O4 - HKLM\..\Run: [Tfh] C:\WINDOWS\Egk.exe
O4 - HKLM\..\Run: [Tja] C:\WINDOWS\Kri.exe
O4 - HKLM\..\Run: [Ctf] C:\WINDOWS\system32\Qbp.exe
O4 - HKLM\..\Run: [Uvh] C:\WINDOWS\system32\Gul.exe
O4 - HKLM\..\Run: [Lgr] C:\WINDOWS\Qqe.exe
O4 - HKLM\..\Run: [Emj] C:\WINDOWS\Bve.exe
O4 - HKLM\..\Run: [Nds] C:\WINDOWS\system32\Sbj.exe
O4 - HKLM\..\Run: [Phi] C:\WINDOWS\Cak.exe
O4 - HKLM\..\Run: [Hcs] C:\WINDOWS\system32\Gsp.exe
O4 - HKLM\..\Run: [Dfa] C:\WINDOWS\Rqg.exe
O4 - HKLM\..\Run: [Rop] C:\WINDOWS\system32\Sua.exe
O4 - HKLM\..\Run: [Bfg] C:\WINDOWS\system32\Ekq.exe
O4 - HKLM\..\Run: [Gik] C:\WINDOWS\Ach.exe
O4 - HKLM\..\Run: [Chq] C:\WINDOWS\system32\Ugh.exe
O4 - HKLM\..\Run: [Umn] C:\WINDOWS\Bac.exe
O4 - HKLM\..\Run: [Qfb] C:\WINDOWS\system32\Aht.exe
O4 - HKLM\..\Run: [Otd] C:\WINDOWS\system32\Tdr.exe
O4 - HKLM\..\Run: [Mgg] C:\WINDOWS\Kss.exe
O4 - HKLM\..\Run: [Ana] C:\WINDOWS\system32\Aun.exe
O4 - HKLM\..\Run: [Bve] C:\WINDOWS\Rit.exe
O4 - HKLM\..\Run: [Tuc] C:\WINDOWS\system32\Rkd.exe
O4 - HKLM\..\Run: [Sit] C:\WINDOWS\system32\Qgc.exe
O4 - HKLM\..\Run: [Nra] C:\WINDOWS\Epo.exe
O4 - HKLM\..\Run: [Uhl] C:\WINDOWS\system32\Otc.exe
O4 - HKLM\..\Run: [Lcb] C:\WINDOWS\Bfh.exe
O4 - HKLM\..\Run: [Atq] C:\WINDOWS\Tto.exe
O4 - HKLM\..\Run: [Eev] C:\WINDOWS\system32\Ovj.exe
O4 - HKLM\..\Run: [Nuk] C:\WINDOWS\system32\Dka.exe
O4 - HKLM\..\Run: [Slp] C:\WINDOWS\system32\Ttt.exe
O4 - HKLM\..\Run: [Cko] C:\WINDOWS\system32\Qea.exe
O4 - HKLM\..\Run: [Stn] C:\WINDOWS\system32\Kqa.exe
O4 - HKLM\..\Run: [Vru] C:\WINDOWS\Bdq.exe
O4 - HKLM\..\Run: [Jou] C:\WINDOWS\system32\Bli.exe
O4 - HKLM\..\Run: [Mva] C:\WINDOWS\Ttu.exe
O4 - HKLM\..\Run: [Foj] C:\WINDOWS\system32\Lnf.exe
O4 - HKLM\..\Run: [Muk] C:\WINDOWS\system32\Fim.exe
O4 - HKLM\..\Run: [Hqn] C:\WINDOWS\Gog.exe
O4 - HKLM\..\Run: [Mcs] C:\WINDOWS\Otp.exe
O4 - HKLM\..\Run: [Qto] C:\WINDOWS\system32\Bic.exe
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINDOWS\Temp\WTuninst.exe /remove
O4 - HKLM\..\Run: [Jro] C:\WINDOWS\system32\Bph.exe
O4 - HKLM\..\RunServices: [ntddetect] C:\WINDOWS\system32\ntddetect.exe
O4 - HKCU\..\Run: [Ntc] C:\WINDOWS\system32\Cmd.exe
O4 - HKCU\..\Run: [Gqd] C:\WINDOWS\Eua.exe
O4 - HKCU\..\Run: [Kfp] C:\WINDOWS\Bng.exe
O4 - HKCU\..\Run: [Dqo] C:\WINDOWS\system32\Qql.exe
O4 - HKCU\..\Run: [Apd] C:\WINDOWS\system32\Pvb.exe
O4 - HKCU\..\Run: [Tfh] C:\WINDOWS\Egk.exe
O4 - HKCU\..\Run: [Tja] C:\WINDOWS\Kri.exe
O4 - HKCU\..\Run: [Ctf] C:\WINDOWS\system32\Qbp.exe
O4 - HKCU\..\Run: [Uvh] C:\WINDOWS\system32\Gul.exe
O4 - HKCU\..\Run: [Lgr] C:\WINDOWS\Qqe.exe
O4 - HKCU\..\Run: [Emj] C:\WINDOWS\Bve.exe
O4 - HKCU\..\Run: [Nds] C:\WINDOWS\system32\Sbj.exe
O4 - HKCU\..\Run: [Phi] C:\WINDOWS\Cak.exe
O4 - HKCU\..\Run: [Hcs] C:\WINDOWS\system32\Gsp.exe
O4 - HKCU\..\Run: [Dfa] C:\WINDOWS\Rqg.exe
O4 - HKCU\..\Run: [Rop] C:\WINDOWS\system32\Sua.exe
O4 - HKCU\..\Run: [Bfg] C:\WINDOWS\system32\Ekq.exe
O4 - HKCU\..\Run: [Gik] C:\WINDOWS\Ach.exe
O4 - HKCU\..\Run: [Chq] C:\WINDOWS\system32\Ugh.exe
O4 - HKCU\..\Run: [Umn] C:\WINDOWS\Bac.exe
O4 - HKCU\..\Run: [Qfb] C:\WINDOWS\system32\Aht.exe
O4 - HKCU\..\Run: [Otd] C:\WINDOWS\system32\Tdr.exe
O4 - HKCU\..\Run: [Mgg] C:\WINDOWS\Kss.exe
O4 - HKCU\..\Run: [Ana] C:\WINDOWS\system32\Aun.exe
O4 - HKCU\..\Run: [Bve] C:\WINDOWS\Rit.exe
O4 - HKCU\..\Run: [Tuc] C:\WINDOWS\system32\Rkd.exe
O4 - HKCU\..\Run: [Sit] C:\WINDOWS\system32\Qgc.exe
O4 - HKCU\..\Run: [Nra] C:\WINDOWS\Epo.exe
O4 - HKCU\..\Run: [Uhl] C:\WINDOWS\system32\Otc.exe
O4 - HKCU\..\Run: [Lcb] C:\WINDOWS\Bfh.exe
O4 - HKCU\..\Run: [Atq] C:\WINDOWS\Tto.exe
O4 - HKCU\..\Run: [Eev] C:\WINDOWS\system32\Ovj.exe
O4 - HKCU\..\Run: [Nuk] C:\WINDOWS\system32\Dka.exe
O4 - HKCU\..\Run: [Slp] C:\WINDOWS\system32\Ttt.exe
O4 - HKCU\..\Run: [Cko] C:\WINDOWS\system32\Qea.exe
O4 - HKCU\..\Run: [Stn] C:\WINDOWS\system32\Kqa.exe
O4 - HKCU\..\Run: [Vru] C:\WINDOWS\Bdq.exe
O4 - HKCU\..\Run: [Jou] C:\WINDOWS\system32\Bli.exe
O4 - HKCU\..\Run: [Mva] C:\WINDOWS\Ttu.exe
O4 - HKCU\..\Run: [Foj] C:\WINDOWS\system32\Lnf.exe
O4 - HKCU\..\Run: [Muk] C:\WINDOWS\system32\Fim.exe
O4 - HKCU\..\Run: [Hqn] C:\WINDOWS\Gog.exe
O4 - HKCU\..\Run: [Mcs] C:\WINDOWS\Otp.exe
O4 - HKCU\..\Run: [Qto] C:\WINDOWS\system32\Bic.exe
O4 - HKCU\..\Run: [Jro] C:\WINDOWS\system32\Bph.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1109833910141
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab


End of KRC HijackThis Analyzer Log.
====================================================================
bpurcy76 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 04-13-2005, 10:09 PM   #4 (permalink)
Analyst, Security Team
 
greyknight17's Avatar
 
Join Date: Jul 2004
Location: New York
Posts: 14,259
OS: Windows 98 & Windows XP Home/Pro

My System

OK, do this instead.

Go to Grisoft and download their AVG antivirus program. Install it and then immediately disable Norton Antivirus. We don't want to have two of them running at the same time. Better yet, disable Norton before installing AVG. Now update AVG first and then run a full system scan.

After that's done, restart and post a new HijackThis log.
__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it.
greyknight17 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Reply With Quote
Old 04-24-2005, 10:13 AM   #5 (permalink)
Registered User
 
Join Date: Mar 2005
Posts: 10
OS: xp pro


I did run the virus scan and it did find a virus and so I followed the instructions and here is were I am at. I still have a smartsecurity desktop backdrop that I can't get rid of yet.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 4/1/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Ant