Hijackthis log PLEASE HELP!!

Question

I am trying to help out a friend of mine who has the 'fatal exception error in IE error trojan.spy.smitfraud.c.'  I downloaded hijackthis and this is the log file that I pulled off the computer.   Thanks to anyone who can help!!   Logfile of HijackThis v1.99.1 Scan saved at 5:58:23 PM, on 12/7/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\HPConfig.exe C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe C:\WINDOWS\System32\hwclock.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\System32\Ebcmjd32.exe C:\WINDOWS\System32\carpserv.exe C:\WINDOWS\System32undll32.exe C:\WINDOWS\System32\intel32.exe C:\Program Files\MSN\MSNCoreFiles\msn6.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\quatie zubrowski\My Documents\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll/space.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8l.hpwis.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll/space.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\faymt.dll O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: (no name) - {910ECB3F-9332-46C0-BDF5-76730BFAF302} - C:\WINDOWS\System32\mnmg.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\faymt.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe O4 - HKLM\..\Run: [TV Now] C:\Program Files\HPQ\Notebook Utilities\TvNow.exe /RK O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe' O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\1.tmp O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll,DllInstall O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\System32\hgqhp.exe O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sywsvcs.exe O4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstart O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm O14 - IERESET.INF: START_PAGE_URL=http://us8l.hpwis.com O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0CC41644-D65A-4042-A139-32D61D59CCE3}: NameServer = 85.255.115.98,85.255.112.85 O17 - HKLM\System\CCS\Services\Tcpip\..\{2EB17269-0E0E-441D-93BF-AEDF144CB972}: NameServer = 85.255.115.98,85.255.112.85 O17 - HKLM\System\CCS\Services\Tcpip\..\{A527BF3A-5B3A-4ADF-9BF6-0C33591EB07E}: NameServer = 85.255.115.98,85.255.112.85 O17 - HKLM\System\CCS\Services\Tcpip\..\{B89278C6-9015-44A7-949D-73B329ACF0A5}: NameServer = 85.255.115.98,85.255.112.85 O17 - HKLM\System\CS1\Services\Tcpip\..\{0CC41644-D65A-4042-A139-32D61D59CCE3}: NameServer = 85.255.115.98,85.255.112.85 O17 - HKLM\System\CS2\Services\Tcpip\..\{0CC41644-D65A-4042-A139-32D61D59CCE3}: NameServer = 85.255.115.98,85.255.112.85 O18 - Filter: text/html - {1909C0C8-64DD-40BF-8055-2D14ACB72BF1} - C:\WINDOWS\System32\mnmg.dll O18 - Filter: text/plain - {1909C0C8-64DD-40BF-8055-2D14ACB72BF1} - C:\WINDOWS\System32\mnmg.dll O20 - Winlogon Notify: st3 - C:\WINDOWS\q9229541_disk.dll O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} - C:\WINDOWS\System32\dcom_9.dll O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} - C:\WINDOWS\System32\dcom_9.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: License Manager (WksPatch) - Unknown owner - C:\WINDOWS\System32\drivers\svchost.exe (file missing)

RKinner · Answer

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Use your usual login or you will have problems finding your desktop.

Run HijackThis and just do a Scan only. Check then Fix Checked the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\faymt.dll
O2 - BHO: (no name) - {910ECB3F-9332-46C0-BDF5-76730BFAF302} - C:\WINDOWS\System32\mnmg.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\faymt.dll
O4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\1.tmp
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\System32\hgqhp.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sywsvcs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CC41644-D65A-4042-A139-32D61D59CCE3}: NameServer = 85.255.115.98,85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\..\{2EB17269-0E0E-441D-93BF-AEDF144CB972}: NameServer = 85.255.115.98,85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\..\{A527BF3A-5B3A-4ADF-9BF6-0C33591EB07E}: NameServer = 85.255.115.98,85.255.112.85
O17 - HKLM\System\CCS\Services\Tcpip\..\{B89278C6-9015-44A7-949D-73B329ACF0A5}: NameServer = 85.255.115.98,85.255.112.85
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CC41644-D65A-4042-A139-32D61D59CCE3}: NameServer = 85.255.115.98,85.255.112.85
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CC41644-D65A-4042-A139-32D61D59CCE3}: NameServer = 85.255.115.98,85.255.112.85
O18 - Filter: text/html - {1909C0C8-64DD-40BF-8055-2D14ACB72BF1} - C:\WINDOWS\System32\mnmg.dll
O18 - Filter: text/plain - {1909C0C8-64DD-40BF-8055-2D14ACB72BF1} - C:\WINDOWS\System32\mnmg.dll
O20 - Winlogon Notify: st3 - C:\WINDOWS\q9229541_disk.dll
O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} - C:\WINDOWS\System32\dcom_9.dll
O21 - SSODL: DCOM Server - {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} - C:\WINDOWS\System32\dcom_9.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: License Manager (WksPatch) - Unknown owner - C:\WINDOWS\System32\drivers\svchost.exe (file missing)

Then reboot. The O17 entries are from a malware DNS in the Ukraine. They don't like to tell your PC how to get to antivirus sites.

Now download smitrem from

http://noahdfear.geekstogo.com/

and run it per the instructions.

You will also probably need to get the SPSEHJFIX progran from:

http://www.derbilk.de/SpSeHjfix112.zip

Save it to the desktop and right click on it and Extract it to the desktop.

Disconnect from the net and Close ALL OPEN PROGRAMS.
Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.

This tool will attempt to get rid of these lines:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\QUATIE~1\LOCALS~1\Temp\se.dll/space.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

So if they go away and stay away then you don't need it.

Post a new log as a reply when done.

Ron

skgodfrey1 · Answer

Ron:   Thank you SO MUCH for your advice.  I ran everything as you instructed, and it seems to be running well.  There was one thing that did not exist on the computer, that was in your instructions.  When running highjack this there was one file that you mentioned to fix that was not there....there was only one 021 entry.    After I finished running everything I did get that toolbar on the right for gambling, pharmacy etc....I used killbox and that seemed to resolve that issue.  Do you think it's all set now?   You are AMAZING!!   Thanks a million.   Sarah

RKinner · Answer

Would need to see a new log to tell for sure. Ron

Virus & Spyware

Hijackthis log PLEASE HELP!!

Was this post helpful?