HiJackThis log from Kaifas

Question

Hi. I get this annoying message where im told to install a program named Sysprotect. There is no way to abandon this install, and the program is now installed. I have tried several steps found on various forums, but I am not able to get rid of the problem. There is one file in particular that seems to cause trouble - ddayx.dll Hope you can help, and thanks in advance. -- Regards, Kaifas Logfile of HijackThis v1.99.1 Scan saved at 11:56:35, on 12.08.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe D:\Program Files\D-Tools\daemon.exe D:\Program Files\NetLimiter\NetLimiter.exe D:\Program Files\Anti-Blaxx\Anti-Blaxx.exe C:\Program Files\QuickTime\qttask.exe D:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.exe D:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\VMware\VMware Player\vmware-authd.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\WINDOWS\system32\vmnat.exe C:\Program Files\UltraVNC\WinVNC.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe D:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Bon Echo\firefox.exe D:\Apps\Antivirus antispam\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.norsk-tipping.no/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://oca.microsoft.com/resredir.aspx?sid=10&Bucket=0x8E_nt!ExAllocatePoolWithTag%2b2b8&State=1&ID=8c622aab-de80-42fc-a1ea-7e1cbeae3199&LCID=1033 F2 - REG:system.ini: UserInit=userinit.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DAEMON Tools-1033] 'D:\Program Files\D-Tools\daemon.exe' -lang 1033 O4 - HKLM\..\Run: [NetLimiter] d:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [Anti-Blaxx Manager] d:\Program Files\Anti-Blaxx\Anti-Blaxx.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [iTunesHelper] 'D:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [WinampAgent] d:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [WinVNC] 'C:\Program Files\UltraVNC\WinVNC.exe' -servicehelper O4 - HKLM\..\Run: [NI.USYP_0002_N91M0908] 'C:\WINDOWS\Downloaded Program Files\USYP_0002_N91M0908NetInstaller.exe' -nag O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O4 - HKCU\..\Run: [SysProtect] C:\Program Files\SysProtect Free\USYP.exe /scan O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SysProtect Free] 'C:\Program Files\SysProtect Free\USYP.exe' /min O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL O9 - Extra 'Tools' menuitem: Tri&xie Options... - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - C:\WINDOWS\system32\mscoree.DLL O9 - Extra button: Centrebet Poker - {8A12431A-A23D-4a88-BEED-4EFC434B70D7} - C:\Program Files\Centrebet Poker\casino.exe O9 - Extra 'Tools' menuitem: Centrebet Poker - {8A12431A-A23D-4a88-BEED-4EFC434B70D7} - C:\Program Files\Centrebet Poker\casino.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1819853F-A3CA-4BC4-AD65-EC29D7448494} (CBPLauncher Class) - https://sports.centrebet.com/poker/centrebetpokerlauncher.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135841266186 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139221575500 O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123 O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe' /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe' /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\Program Files\VMware\VMware Player\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe' -service (file missing)

Bugbatter · Answer

Hi, Kaifas, We will need to disable Spywareguard so it does not interfere with our fixes. Right-click on the SG icon in your system tray and SpywareGuard should open. Click 'Options' and then uncheck these options under the 'General' tab: Enable Real-Time Scanning Enable Download Protection Enable Browser Hijack Protection Click 'Save Settings' ** When we have completed ALL of your fixes, please re-enable these settings. We'll need to disable Teatimer as well. Go to Msconfig/Startup and UNcheck the entry for TeaTimer as well until this is over... 1. Open Spybot 2. Click Mode -> Advanced Mode 3. Click Yes 4. Click Tools (located in the bottom left corner) -> Resident 5. Uncheck 'Resident 'TeaTimer' (Protection of over-all system settings) active' 6. Then close Spybot. First we will search for some bad files. After your next post we'll clean them. Please download VundoFix.exe to your desktop. Do not run it yet. If we need to we will do that after your next post. Go to your Hijackthis folder here: D:\Apps\Antivirus antispam\hijackthis\HijackThis.exe and rename Hijackthis.exe to analyzer.exe Reboot. After reboot, run analyzer.exe (which is actually your renamed hijackthis) and post the log it creates in your next reply.

Virus & Spyware

HiJackThis log from Kaifas

Was this post helpful?