Hijack this log - help? =/

Question

Hey everyone, first off - thanks in advance if you can help me with this. ^_^ For a little over a month now I've had serious popup problems. I'd run my programs such as spybot search and destory, adaware, and even tried spyware doctor. None of them seemed to help, but I figured I could live with a few popups. I even tried hijackthis on my own a couple weeks ago (pasting the new log, not the last one) but I'm pretty ignorant on this stuff. My most recent problem is a program called SysProtect randomly downloaded itself onto my computer and it did it so fast I didn't even have time to cancel it. Now despite having removed it several times, everytime I restart my computer it puts itself right back onto my desktop (no downloading, just appears) and tries to 'scan' my files. I did a google on this and hijackthis along with this forum was suggested...so here I am! It has been making my computer run extremely slow and lag whenever I try to play games I used to have no problems with.   Again...thank you if you can help. =)   The log is below:   Logfile of HijackThis v1.99.1 Scan saved at 12:54:51 PM, on 8/14/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINXP\system32\svchost.exe C:\WINXP\Explorer.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINXP\ALCXMNTR.EXE C:\WINXP\AGRSMMSG.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINXP\system32\wscntfy.exe C:\WINXP\system32\WgaTray.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\system32\wuauclt.exe C:\HJT\HijackThis.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [7506ec5.exe] C:\WINXP\system32\7506ec5.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [NI.USYP_0003_N91M0908] 'C:\WINXP\Downloaded Program Files\USYP_0003_N91M0908NetInstaller.exe' -nag O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [7506ec5.exe] C:\Documents and Settings\Shorty\Local Settings\Application Data\7506ec5.exe O4 - HKCU\..\Run: [Foqjdfa] C:\Documents and Settings\Shorty\My Documents\s?stem\m?dtc.exe O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152017761890 O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs:  C:\WINXP\system32
opdb.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe

_KotaGuy · Answer

Hi Sarah! If you still require help could you post a new HijackThis log for me please. Its bee a few days since you've posted and something in it may have changed since then. Thanks!

ShortySarah · Answer

Oh certainly! I appreciate this very much. :)   Logfile of HijackThis v1.99.1 Scan saved at 5:09:50 AM, on 8/17/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\wscntfy.exe C:\WINXP\system32\WgaTray.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINXP\ALCXMNTR.EXE C:\WINXP\AGRSMMSG.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINXP\system32\svchost.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\AIM\aim.exe C:\WINXP\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\HJT\HijackThis.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [7506ec5.exe] C:\WINXP\system32\7506ec5.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [7506ec5.exe] C:\Documents and Settings\Shorty\Local Settings\Application Data\7506ec5.exe O4 - HKCU\..\Run: [Foqjdfa] C:\Documents and Settings\Shorty\My Documents\s?stem\m?dtc.exe O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O4 - HKCU\..\Run: [SysProtect Free] 'C:\Program Files\SysProtect Free\USYP.exe' /min O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152017761890 O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/control/tricksterActiveX.cab O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs:  C:\WINXP\system32
opdb.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe

_KotaGuy · Answer

Thank you. Can I get you to rename HijackThis.exe to Scan.exe please. I'm pretty sure you have an infection that hides itself from HijackThis and renaming it should make it appear. Once you've done that... run the newly renamed HijackThis(Scan.exe)... click the Misc Tools button... then the Uninstall Manager button... then the Save List button and save that list to your Desktop. Once you got that list saved to your Desktop... click the Back button then the Scan button. Once its done the scan click the Save Log button. Post the contents of the new HijackThis log along with the Uninstall List in your next reply. Thanks!

ShortySarah · Answer

Here is to hoping I did this completely right. =D You're amazing so far, lol.   This first part is the uninstall_list (colored red to stand out easier)   Ad-Aware SE PersonalAgere Systems PCI Soft ModemAOL Instant MessengerEasy Thumbnails (Remove only)GdiplusUpgradeH-GamesHijackThis 1.99.1HP Imaging Device Functions 5.3HP Photosmart EssentialHP PSC & OfficeJet 5.3.BHP Software UpdateHP Solution Center & Imaging Support Tools 5.3iTunesJ2SE Runtime Environment 5.0 Update 6Jasc Paint Shop Pro 8KCsaver1_PC Screen SaverKSignAccessToolkit v1.0Logitech QuickCam SoftwareLogitech® Camera DriverMacromedia Flash Player 8Macromedia Shockwave PlayerMapleStoryMapleStoryMicrosoft .NET Framework 2.0Microsoft Office XP Professional with FrontPageMicrosoft Windows Journal ViewerMozilla Firefox (1.5.0.6)MSN Music AssistantNeed2Find BarOpera 9.0Proxifier version 2.0QuickTimeRagnarok OnlineRagnarok SakrayRagnarokOnlineRealPlayerRealtek AC'97 AudioSecurity Update for Microsoft .NET Framework 2.0 (KB917283)Security Update for Windows Media Player (KB911564)Security Update for Windows Media Player 10 (KB917734)Security Update for Windows Media Player 9 (KB917734)Security Update for Windows XP (KB890046)Security Update for Windows XP (KB893756)Security Update for Windows XP (KB896358)Security Update for Windows XP (KB896422)Security Update for Windows XP (KB896423)Security Update for Windows XP (KB896424)Security Update for Windows XP (KB896428)Security Update for Windows XP (KB899587)Security Update for Windows XP (KB899589)Security Update for Windows XP (KB899591)Security Update for Windows XP (KB900725)Security Update for Windows XP (KB901017)Security Update for Windows XP (KB901214)Security Update for Windows XP (KB902400)Security Update for Windows XP (KB904706)Security Update for Windows XP (KB905414)Security Update for Windows XP (KB905749)Security Update for Windows XP (KB908519)Security Update for Windows XP (KB911562)Security Update for Windows XP (KB911567)Security Update for Windows XP (KB911927)Security Update for Windows XP (KB912919)Security Update for Windows XP (KB913580)Security Update for Windows XP (KB914388)Security Update for Windows XP (KB914389)Security Update for Windows XP (KB916281)Security Update for Windows XP (KB917159)Security Update for Windows XP (KB917344)Security Update for Windows XP (KB917422)Security Update for Windows XP (KB917953)Security Update for Windows XP (KB918439)Security Update for Windows XP (KB918899)Security Update for Windows XP (KB920214)Security Update for Windows XP (KB920670)Security Update for Windows XP (KB920683)Security Update for Windows XP (KB921398)Security Update for Windows XP (KB921883)Security Update for Windows XP (KB922616)Spybot - Search & Destroy 1.4SysProtect 1.3.152.1TricksterEngUpdate for Windows XP (KB894391)Update for Windows XP (KB898461)Update for Windows XP (KB900485)Update for Windows XP (KB908531)Update for Windows XP (KB910437)Update for Windows XP (KB911280)Update for Windows XP (KB914882)Update for Windows XP (KB916595)VideoLAN VLC media player 0.8.4aViewpoint Manager (Remove Only)Viewpoint Media PlayerWH GBP CasinoWinamp (remove only)Windows Driver Package - MSN (usbccgp) USB  (04/19/2006 1.1.0.2)Windows Installer 3.1 (KB893803)Windows Live MessengerWindows Live Sign-in AssistantWindows Media Format RuntimeWindows Media Player 10Windows XP Hotfix - KB873339Windows XP Hotfix - KB885835Windows XP Hotfix - KB885836Windows XP Hotfix - KB885884Windows XP Hotfix - KB886185Windows XP Hotfix - KB887472Windows XP Hotfix - KB887742Windows XP Hotfix - KB888113Windows XP Hotfix - KB888302Windows XP Hotfix - KB890859Windows XP Hotfix - KB891781WinRAR archiverWinZipYahoo! Internet MailYahoo! MessengerYahoo! Photos Easy Upload Tool 1v7Yazzle by OIN     Man...I have a lot of crud. o_O   Anyway, next is the save log. =)   Logfile of HijackThis v1.99.1 Scan saved at 2:00:40 PM, on 8/17/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\wscntfy.exe C:\WINXP\system32\WgaTray.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINXP\ALCXMNTR.EXE C:\WINXP\AGRSMMSG.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\system32\svchost.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINXP\explorer.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Shorty\Desktop\Scan.exe.exe C:\WINXP\system32
otepad.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {277C05E9-6FC4-4B00-8829-99DFDBDB9650} - C:\WINXP\system32\vturq.dll O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [7506ec5.exe] C:\WINXP\system32\7506ec5.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [7506ec5.exe] C:\Documents and Settings\Shorty\Local Settings\Application Data\7506ec5.exe O4 - HKCU\..\Run: [Foqjdfa] C:\Documents and Settings\Shorty\My Documents\s?stem\m?dtc.exe O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O4 - HKCU\..\Run: [SysProtect Free] 'C:\Program Files\SysProtect Free\USYP.exe' /min O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O15 - Trusted Zone: http://www.amaena.com O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com O15 - Trusted Zone: http://scanner.sysprotect.com O15 - Trusted Zone: http://*.systemdoctor.com O15 - Trusted Zone: http://www.winantivirus.com O15 - Trusted Zone: http://www.winantiviruspro.com O15 - Trusted Zone: http://download.cdn.winsoftware.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152017761890 O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/control/tricksterActiveX.cab O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs:  C:\WINXP\system32
opdb.dll O20 - Winlogon Notify: vturq - C:\WINXP\system32\vturq.dll O20 - Winlogon Notify: WgaLogon - C:\WINXP\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe   Message Edited by ShortySarah on 08-17-200601:04 PM Message Edited by ShortySarah on 08-17-200601:04 PM

ShortySarah · Answer

Hey! Not sure if it is good news or not, but the Vundo said it found no files - and sysprotect didn't try putting itself back on! I'm assuming that uninstaller thing solved that? Overall, I think you solved my problem. xD If that is the case - thanks a million!   Here is the new hijackthis(scan.exe) log. =)   Logfile of HijackThis v1.99.1 Scan saved at 3:33:59 PM, on 8/17/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINXP\system32\svchost.exe C:\WINXP\Explorer.EXE C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINXP\ALCXMNTR.EXE C:\WINXP\AGRSMMSG.exe C:\WINXP\system32\ctfmon.exe C:\WINXP\system32\wscntfy.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINXP\system32\WgaTray.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINXP\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\system32\svchost.exe C:\Documents and Settings\Shorty\Desktop\Scan.exe.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {0BB52110-E859-4D2B-A5F4-8ED31E49FF4A} - C:\WINXP\system32\vturq.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [7506ec5.exe] C:\WINXP\system32\7506ec5.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [7506ec5.exe] C:\Documents and Settings\Shorty\Local Settings\Application Data\7506ec5.exe O4 - HKCU\..\Run: [SysProtect Free] 'C:\Program Files\SysProtect Free\USYP.exe' /min O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O15 - Trusted Zone: http://www.amaena.com O15 - Trusted Zone: http://locator.cdn.imageservr.com O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com O15 - Trusted Zone: http://scanner.sysprotect.com O15 - Trusted Zone: http://*.systemdoctor.com O15 - Trusted Zone: http://www.winantivirus.com O15 - Trusted Zone: http://www.winantiviruspro.com O15 - Trusted Zone: http://download.cdn.winsoftware.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152017761890 O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/control/tricksterActiveX.cab O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs:  C:\WINXP\system32
opdb.dll O20 - Winlogon Notify: vturq - C:\WINXP\system32\vturq.dll O20 - Winlogon Notify: WgaLogon - C:\WINXP\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe

_KotaGuy · Answer

Thank you.

Click Start>Run type in appwiz.cpl and hit Enter. From the list uninstall the following:

J2SE Runtime Environment 5.0 Update 6
Need2Find Bar
SysProtect 1.3.152.1
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Yazzle by OIN

You can close that when you are done.

Download the PurityScan Uninstaller. Run the program and let it do what it needs to do. There is a tutorial for it that you can follow here.

After the reboot please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES.
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
[*}It will produce a log I would like you to post... C:\vundofix.txt.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears at reboot.

Post an new HijackThis(Scan.exe) log and the VundoFix log(C:\vundofix.txt) when done. Thanks!

_KotaGuy · Answer

Not quite done yet ;)

We're going to have to add the files to the Vundo scan manually. So...

Run VundoFix again.
Click the Scan for Vundo button.
It will report no file found like last time... thats ok.
Once the scan is complete, right click inside the listbox(white box) and select Add More Files.
Copy/Paste the 2 entries below into the top 2 boxes:
- C:\WINXP\system32\vturq.dll
- C:\WINXP\system32\qrutv.*
Click Add Files then click Close Window.
Click the Remove Vundo button.
You should receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.

Once back in Windows post the contents of C:\vundofix.txt and a new HiJackThis log.

Thanks!

Message Edited by _KotaGuy on 08-17-200603:00 PM

Message Edited by _KotaGuy on 08-17-200603:01 PM

ShortySarah · Answer

Aww...lol and I thought it was over. =D Hopefully this is close to the end? xD   Vundo is:   VundoFix V6.0.1 Checking Java version... Java version is 1.5.0.6 Scan started at 3:31:58 PM 8/17/2006 Listing files found while scanning.... No infected files were found. Beginning removal... VundoFix V6.0.1 Checking Java version... Java version is 1.5.0.6 Scan started at 6:31:21 PM 8/17/2006 Listing files found while scanning.... No infected files were found. Beginning removal...  Attempting to delete C:\WINXP\system32\vturq.dllC:\WINXP\system32\vturq.dll Has been deleted! Performing Repairs to the registry.Done! Hijack(scan) is:   Logfile of HijackThis v1.99.1 Scan saved at 6:36:32 PM, on 8/17/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\WgaTray.exe C:\WINXP\Explorer.EXE C:\WINXP\system32\wscntfy.exe C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINXP\ALCXMNTR.EXE C:\WINXP\AGRSMMSG.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\system32\wuauclt.exe C:\WINXP\system32\NOTEPAD.EXE C:\Documents and Settings\Shorty\Desktop\Scan.exe.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [7506ec5.exe] C:\WINXP\system32\7506ec5.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [7506ec5.exe] C:\Documents and Settings\Shorty\Local Settings\Application Data\7506ec5.exe O4 - HKCU\..\Run: [SysProtect Free] 'C:\Program Files\SysProtect Free\USYP.exe' /min O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152017761890 O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/control/tricksterActiveX.cab O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs:  C:\WINXP\system32
opdb.dll O20 - Winlogon Notify: WgaLogon - C:\WINXP\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe

_KotaGuy · Answer

Almost done, Sarah :) Download and install CCleaner. You don't need to install the Yahoo! Toolbar. Don't run the program yet. Download and install Ewido Anti-Spyware. Don't activate the Ewido Guard(it Resident Monitor). Update the program's definition files. Don't scan with it yet. Run and scan with HijackThis(Scan.exe) and place checks beside the following: R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)O4 - HKLM\..\Run: [7506ec5.exe] C:\WINXP\system32\7506ec5.exeO4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXEO4 - HKCU\..\Run: [7506ec5.exe] C:\Documents and Settings\Shorty\Local Settings\Application Data\7506ec5.exeO4 - HKCU\..\Run: [SysProtect Free] 'C:\Program Files\SysProtect Free\USYP.exe' /minO15 - Trusted Zone: http://locator1.cdn.imagesrvr.comO16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cabO18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dllO20 - AppInit_DLLs: C:\WINXP\system32
opdb.dll Close all open browsers/windows and click the Fix button. Print the rest of these instructions out as you won't be able to access them while in Safe Mode. Boot your computer into Safe Mode. To do this: 1. Reboot your computer. 2. Tap the F8 button as your computer is booting to bring you to the Advanced Options Menu. 3. Select Safe Mode and press Enter. Make sure no files will be hidden. To do this: 1. Click Start. 2. Open My Computer. 3. Select the Tools menu and click Folder Options. 4. Select the View Tab. 5. Under the Hidden files and folders heading select Show hidden files and folders. 6. Uncheck the Hide protected operating system files (recommended) option. 7. Click Yes to confirm. 8. Click OK. Search for and delete these folders: C:\Program Files\ RXToolBar C:\Program Files\ SysProtect Free C:\Program Files\ ViewPoint Search for and delete these files C:\WINXP\system32\ 7506ec5.exe C:\WINXP\system32\ nopdb.dll C:\Documents and Settings\Shorty\Local Settings\Application Data\ 7506ec5.exe C:\WINXP\Downloaded Program Files\ USYP_0003_N91M0908NetInstaller.exe Emtpy your Recycle Bin. Run CCleaner and let it clean up the junk. Close it once it has. Run Ewido. Select Scanner. Select Settings. Under How to Act? click on Recommended Action and choose Quarantine from the popup menu. Under How to Scan? all boxes should be checked. Under Possibly Unwanted Software all boxes should be checked. Under Reports Make sure Automatically generate report after every scan is checked and uncheck Only if threats were found Under What to Scan? check Scan every file. Select Scan at the top. Click on Complete System Scan to start the scan process. When the scan has finished, follow the instructions below: IMPORTANT : Don't click on the 'Save Scan Report' button before you hit the 'Apply all Actions' button. Make sure that Set all elements to: shows Quarantine. If not click on the link and choose Quarantine from the popup menu. At the bottom of the window click on the Apply all Actions button. When done, click the Save Scan Report button. Click the Save Report as button and save it to your Desktop. Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes. Reboot your computer normally. Once back in Windows post the Ewido log along with a new HijackThis(Scan.exe) log. Thanks!

ShortySarah · Answer

Hello again. Hope your day is going/has went well. =)   Okay...I ran into a couple problems, but did as much of the previous steps as I could - hopefully I didn't mess anything up. o.o   While fixing the files in the hijackthis step I got an error. I took a screenshot of it and put it on photobucket rather than try to type it all out.   http://img.photobucket.com/albums/v489/kitty_kat159/error.jpg   I figured since it was the one file, I should proceed at least as much as I could with the rest. This will hopefully only mean I have to basically repeat some of these steps again, lol and not that I messed something up.   However, it had a ripple affect. I imagine somehow not being able to remove that caused something else to happen because when I did the search for deleting of the files and folders you listed I couldn't find the following two: C:\WINXP\system32
opdb.dll C:\WINXP\Downloaded Program Files\USYP_0003_N91M0908NetInstaller.exe This included a manual search into the folders and a regular search (including hidden folders). Aside from that everything went well. I did the Ewido step without a hitch. The following is the Ewido report:---------------------------------------------------------ewido anti-spyware - Scan Report---------------------------------------------------------  + Created at: 9:54:42 AM 8/18/2006  + Scan result:    C:\Program Files\INSTAFINK -> Adware.404Search : Cleaned with backup (quarantined).C:\Program Files\INSTAFINK\instafink.dll -> Adware.404Search : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\ADM25.ADM25.1 -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\ADM4.ADM4.1 -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\ADM4.ADM4\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : Cleaned with backup (quarantined).HKU\S-1-5-21-57989841-926492609-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{59879FA4-4790-461C-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup (quarantined).C:\Program Files\SpyQuake2.com -> Adware.SpywareQuake : Cleaned with backup (quarantined).C:\Program Files\SpyQuake2.com\Spy-Quake2.exe -> Adware.SpywareQuake : Cleaned with backup (quarantined).C:\Program Files\SpyQuake2.com\ignored.lst -> Adware.SpywareQuake : Cleaned with backup (quarantined).C:\Program Files\SpyQuake2.com\sq.ini -> Adware.SpywareQuake : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\AppID\{4F5E5D72-C915-4f3b-908B-527D064B0FAA} -> Adware.SysProtect : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\CLSID\{EF130E77-0A34-4365-BFB7-218FD3DDCD5F} -> Adware.SysProtect : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\Interface\{02946FD1-2D99-46E6-A790-3A089714EDD9} -> Adware.SysProtect : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\TypeLib\{7EACF70B-302F-4049-AC68-2D62EB43E473} -> Adware.SysProtect : Cleaned with backup (quarantined).C:\WINXP\system32\vtutsqn.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Local Settings\Temporary Internet Files\Content.IE5\QJSPA1AR\popup[1].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).C:\mx.exe -> Hijacker.VB.lb : Cleaned with backup (quarantined).C:\WINXP\Downloaded Program Files\CONFLICT.1\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).C:\WINXP\Downloaded Program Files\USYP_0003_N91M0908NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).C:\WINXP\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@122.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@msninvite.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@ad.adition[2].txt -> TrackingCookie.Adition : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@as.casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@data4.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).C:\Documents and Settings\Sarah\Cookies\sarah@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).C:\WINXP\system32\behpbohd.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).C:\WINXP\system32\drivers\DP.sys -> Trojan.Agent.ny : Cleaned with backup (quarantined).C:\WINXP\system32\eicquect.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).C:\WINXP\system32\1024 -> Trojan.Small : Cleaned with backup (quarantined).C:\WINXP\system32\winjgf32.dll -> Trojan.Small : Cleaned with backup (quarantined). ::Report end   And now the fun hijack (scan) log:   Logfile of HijackThis v1.99.1 Scan saved at 10:00:17 AM, on 8/18/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\wscntfy.exe C:\WINXP\system32\WgaTray.exe C:\WINXP\Explorer.EXE C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINXP\AGRSMMSG.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINXP\system32\wuauclt.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINXP\system32\svchost.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\system32
otepad.exe C:\Documents and Settings\Shorty\Desktop\Scan.exe.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Shorty\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [!ewido] 'C:\Program Files\ewido anti-spyware 4.0\ewido.exe' /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152017761890 O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/control/tricksterActiveX.cab O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINXP\SYSTEM32\WgaLogon.dll O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe       I have to admit, I didn't like seeing 'trojan' in two of the names for the Ewido search. :X

ShortySarah · Answer

Yay!

Been running great. =) I still get some popups but that's just do to them being on the site and not having a popup blocker enabled. :p

Feels good having a faster computer that doesn't have random full page ads showing up when I'm not even on the net. =D

Thank you for helping me out. ^_^

Really appreciated it.

- Sarah

_KotaGuy · Answer

Don't worry about that error... you got it because it seems that files wasn't there, I believe. Good news though... your log is now clean :) How is your computer behaving?

_KotaGuy · Answer

Good to hear and glad I was able to help :)

Some suggestions for you...

If you don't have them, download Ad-Aware and Spybot S&D. Visit this page for proper configuration of Spybot and Ad-Aware. Run and scan with both, letting them fix whatever they find. Remember to reboot between each scan.

Now that your computer is clean, its a good time to reset your System Restore point. This will ensure a clean backup to fall upon if you ever need it. To do this:

Right-click My Computer, and then click Properties.
Click the System Restore tab.
Check the "Turn off System Restore" or "Turn off System Restore on all drives"

Reboot your computer, follow the steps above, this time unchecking the "Turn off System Restore" and reboot.

I recommend downloading and installing SpywareBlaster, SpywareGuard, and IE-SPYAD as well. You can get them from the links in my sig. The programs are free and can be updated... so please do so. Installing these will go a long way in preventing reinfection.

If you don't have one, I recommend installing a Firewall. I'm sure you've heard of ZoneAlarm.

Check out these links How'd I get Infected and Understanding Spyware as well, some good information for you.

Other than that, remember to update Windows frequently, update your protection programs, scan often and...

Surf Safe!

ShortySarah · Answer

For the most part I already had everything you listed, which was why I was getting so mad that I couldn't seem to get rid of the stuff on my computer lol.   Going to check out those you listed which I don't have as well. :)   Thanks again! ^_^

Virus & Spyware

Hijack this log - help? =/

Was this post helpful?