HijackThis Log file tb checked, Thanks!

Question

Logfile of HijackThis v1.99.1 Scan saved at 12:03:56 AM, on 5/17/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\S24EvMon.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\RegSrvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\System32\1XConfig.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\System32\BacsTray.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Juno\bin\juno.exe C:\WINDOWS\system32
tvdm.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\System32\wuauclt.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://targetclicks.net/srch.php?qq=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\_h.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\_s.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\dskrfuoui.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\dskrfuoui.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\_h.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\_h.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\dskrfuoui.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\dskrfuoui.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\dskrfuoui.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\dskrfuoui.dll/sp.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = C:\WINDOWS\_h.html R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = C:\WINDOWS\_h.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: Name - {751894E1-0947-4B27-8DFB-0147872D4F80} - C:\WINDOWS\System32\mszvl.dll (file missing) O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [bacstray] BacsTray.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [qmxnlrpgd] C:\WINDOWS\System32\yluiyln.exe O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINDOWS\srchupdt.exe O4 - HKLM\..\Run: [dwcrnt.exe] dwcrnt.exe O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [d3d8] C:\WINDOWS\System32\d3d8.exe O4 - HKCU\..\Run: [wccapp] c:\windows\winhelp.exe O4 - HKCU\..\Run: [serwvdrv] C:\WINDOWS\System32\serwvdrv.exe O4 - HKCU\..\Run: [WareOut] 'C:\Program Files\WareOut\WareOut.exe' O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O15 - Trusted Zone: http://*.63.219.181.7 O15 - Trusted Zone: http://*.public.windupdates.com O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3082F763-4A70-43E4-9151-623244CD9B9B}: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CCS\Services\Tcpip\..\{95F90027-B28D-4E23-A721-073E6C0CDCD3}: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CCS\Services\Tcpip\..\{AC71EF8F-F453-4DCF-BE65-6EC2B500E6AC}: NameServer = 69.50.184.84,195.225.176.37 O17 - HKLM\System\CCS\Services\Tcpip\..\{CAD71C2B-3955-4819-945C-CEE3EBC4EA2C}: NameServer = 64.136.28.120 64.136.20.120 O17 - HKLM\System\CS1\Services\Tcpip\..\{3082F763-4A70-43E4-9151-623244CD9B9B}: NameServer = 69.50.184.84,195.225.176.37 O18 - Filter: text/html - {A5DE0377-CB47-4BC9-A98E-0846D892FF48} - (no file) O18 - Filter: text/plain - {A5DE0377-CB47-4BC9-A98E-0846D892FF48} - (no file) O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

BurtonJ · Answer

Hello - Let's get started:   There's a little info I'll need to proceed. Is your PC experiencing pop up ads; home page redirections, startup or shutdown error messages; PC running slow / sluggish; does your current anti virus software alert you of an infection?

enoughalready99 · Answer

Hi there. Pretty much all of the above, at least until I update my McAfee virus protection last night. That seems to have cured the homepage redirect and unwanted bookmarks, However, it's still running slow and I'm getting an unusual amount of script errors. I'm also getting pop-ups asking me if I want to update some Sonic product which I'm pretty sure I don't have. And, yes, the virus scan tells me often that it has detected and removed a virus. Also getting the small dialogue box at bottom (unsure of source) stating the obvious about possible spyware problems. Thanks for your help.

BurtonJ · Answer

Before you do the HiJackTHis thing are you familiar with the Ad-Aware and/or Spybot Search and Destroy programs?

enoughalready99 · Answer

Yup. I downloaded both the last time I used HijackThis a few months ago. BTW, that session seemed to work well (for a while anyway), except for a blank blue 'Microsoft Help' window that pops up at the start of every session and seems to be more annoying than harmful. I do try and run Spybot and Adaware regularly, but it seems they weren't enough by themselves to keep everything cool.

BurtonJ · Answer

Ok. I'm checking your Hijack log file and I'll reply shortly...

enoughalready99 · Answer

Thanks so much. My machines at home, so I'll have to put this plan in action tonight. Thanks again.

BurtonJ · Answer

First! I suggest backing up any files that you POTENTIALLY could lose. By the looks of your log file you have a number of virus (trojan type) infections; and the damage might alreay be done to some of your core XP operating system files. If the following fixes do not work or seem to improve your PC's performance I'd suggest a full format and then a XP re-install. But if you're HiJackThis keen......

Check the following items via HiJackThis and Fix Selected.

O2 - BHO: Name - {751894E1-0947-4B27-8DFB-0147872D4F80}
O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINDOWS\srchupdt.exe
O4 - HKLM\..\Run: [dwcrnt.exe] dwcrnt.exe
O4 - HKCU\..\Run: [d3d8] C:\WINDOWS\System32\d3d8.exe
O4 - HKCU\..\Run: [wccapp] c:\windows\winhelp.exe
O4 - HKCU\..\Run: [serwvdrv] C:\WINDOWS\System32\serwvdrv.exe
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O15 - Trusted Zone: http://*.public.windupdates.com
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D}
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll

After running HiJackThis and before you reboot your PC Click Start > Run and type msconfig into the run dialog box. Click on the Start Up tab. Uncheck the following items:

Quick Time or qttask

RealPlayer or realsched

anything MusicMatch or DellJuke box related

anything Windows Messenger related.

Click apply, click close and reboot normally.

After reboot, run free online scan at http://housecall.trendmicro.com . Run beta if possible.

Post results of HouseCall.

enoughalready99 · Answer

So...I'm wondering what to do now. Can someone elaborate on this: 'Anyone that works logs knows...that you need to clean up these peripheral infections before attending to the log.' Thanks

zbestwun2001 · Answer

I am sorry you got caught up in this mess. Please repost your log in a new thread so that someone will see that it hasn't been worked yet. thanks Steve

Virus & Spyware

HijackThis Log file tb checked, Thanks!

Was this post helpful?