HJT Log 03-27-08

Question

I just moved to new post at work, and the system I'm assigned seems to have some infections. I am given full authority to modify the system as it seems fit, upto and including formatting. HJT Log as follows:       Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:00:43 AM, on 3/27/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16608)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\savedump.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\SVCH0ST.EXEC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Windows Live\Messenger\MsnMsgr.ExeC:\Program Files\Digital Line Detect\DLG.exeC:\WINDOWS\system32
tvdm.exeC:\WINDOWS\system32
tvdm.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\System32\wbem\wmiprvse.exeC:\Program Files\Windows Live\Messenger\usnsvc.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\internt.exe,O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exeO4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXEO4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNCO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe'O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe' /backgroundO4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cabO16 - DPF: {27AAC9F7-A327-4ABE-A361-C39744135D07} (EHtml Control) - http://www3.edaily.co.kr/efriends/efActiveX/LiveUp.CABO16 - DPF: {28E52D43-46EB-439B-8334-DA8D9C63D5B7} (ENCMAX Control) - http://wucma.wyldfyre.com/xbin/ENCMAX.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cabO16 - DPF: {340CCF52-D65F-4A11-80B3-13DC23697B59} (BugsInstall Control) - http://player.bugs.co.kr/install/BugsInstall.cabO16 - DPF: {3E5BBDC8-18F9-4A70-94B5-DD64929C0AF4} (AniCastH Class) - http://gogo.jaeminara.co.kr/gogo/hansol/yahoo/control/axacastH.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113543002229O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20060116/SVPorsche.cabO16 - DPF: {92D0D610-A6FA-48D8-94CB-BD47FDF68655} - http://app.ipop.co.kr/ipop/ipopx.cabO16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/XTools.cabO16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cabO16 - DPF: {BE92758D-C33A-4EF1-AAC4-EED002F3C631} (SBSQuizStarter Control) - http://sbsi.gscdn.com/sbsi/SBSQuizStarter/SBSQuizStarter.cabO16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1008 Class) - http://cdn.hangame.com/hangame/hansetup/HanSetup1008.cabO16 - DPF: {DE4B0C89-2566-41B4-AE50-D982CD7FA0A6} (Install Class) - http://www.arisu.co.kr/xtra/ActiveX/arisucab1.cabO16 - DPF: {E9178429-0886-4878-AE31-4942F18BC3DF} (AnyVCSNewLogin Control) - http://www.vcsys.co.kr/common/AnyVCSNewLogin.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MarathonFunding.comO17 - HKLM\Software\..\Telephony: DomainName = MarathonFunding.comO17 - HKLM\System\CCS\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MarathonFunding.comO17 - HKLM\System\CS1\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe --End of file - 7451 bytes Message Edited by jtmfg on 03-27-2008 12:08 PM

bamajim · Answer

jtmfg 1. Go HERE and download FakeAlertFix Save it to your Desktop. But do not run it yet. 2. Reboot into Safe Mode This can be done by Restart your PC, and after it starts, but before you see the Windows Splash screen Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices) Use your arrow keys and select Safe Mode and then Enter 3. Close all Internet Explorer Windows and Run FakeAlertFix Double click the fakealertfix.Zip file to unzip it. Open the FakeAlertFix Folder Double Click FakeAlertFix.vbe to run the program Then Select O.K. at the prompt Allow the program to run (Your desktop will disappear, then re-appear. This is normal) When it is finished it wil produce a log C:\FakeAlertFix.txt Copy and paste the results of that log in your reply 4. Then reboot your PC into Normal Windows Mode->> Rerun Hijackthis and post a fresh Hiajckthis log. As well as the C:\FakeAlertfix.txt log Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

jtmfg · Answer

========================================
FakeAlertFix

Version 1.5.8

By bamajim @ CastleCops.com

========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\sessmgr.exe
%windir%\Network Diagnostic\xpnetdiag.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\livecall.exe
========================================
FakeAlertFix

Version 1.5.8

By bamajim @ CastleCops.com

========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\sessmgr.exe
%windir%\Network Diagnostic\xpnetdiag.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\livecall.exe

jtmfg · Answer

Thank you and here you go:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:06:36 PM, on 3/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\SVCH0ST.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {27AAC9F7-A327-4ABE-A361-C39744135D07} (EHtml Control) - http://www3.edaily.co.kr/efriends/efActiveX/LiveUp.CAB
O16 - DPF: {28E52D43-46EB-439B-8334-DA8D9C63D5B7} (ENCMAX Control) - http://wucma.wyldfyre.com/xbin/ENCMAX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {340CCF52-D65F-4A11-80B3-13DC23697B59} (BugsInstall Control) - http://player.bugs.co.kr/install/BugsInstall.cab
O16 - DPF: {3E5BBDC8-18F9-4A70-94B5-DD64929C0AF4} (AniCastH Class) - http://gogo.jaeminara.co.kr/gogo/hansol/yahoo/control/axacastH.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113543002229
O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20060116/SVPorsche.cab
O16 - DPF: {92D0D610-A6FA-48D8-94CB-BD47FDF68655} - http://app.ipop.co.kr/ipop/ipopx.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/XTools.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BE92758D-C33A-4EF1-AAC4-EED002F3C631} (SBSQuizStarter Control) - http://sbsi.gscdn.com/sbsi/SBSQuizStarter/SBSQuizStarter.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1008 Class) - http://cdn.hangame.com/hangame/hansetup/HanSetup1008.cab
O16 - DPF: {DE4B0C89-2566-41B4-AE50-D982CD7FA0A6} (Install Class) - http://www.arisu.co.kr/xtra/ActiveX/arisucab1.cab
O16 - DPF: {E9178429-0886-4878-AE31-4942F18BC3DF} (AnyVCSNewLogin Control) - http://www.vcsys.co.kr/common/AnyVCSNewLogin.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\Software\..\Telephony: DomainName = MarathonFunding.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

--
End of file - 7204 bytes

bamajim · Answer

jtmfg

Good work so far.

1. Using Windows Explorer

(Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)

Locate and Delete the following file (If found)

C:\WINDOWS\system32\internt.exe <<-Note the Spelling

Close windows explorer.

2. Run an online virus scan called Kaspersky from HERE.

1. Click on " Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on " Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on " Next"->>" Scan Settings", and make sure the database is set to " extended". And check both the scan options. Then click OK.
5. Then click on " My Computer". And the scan will start.
6. When the scan is complete Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.

Copy and post the results of the Kaspersky Online scan

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

jtmfg · Answer

------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, March 28, 2008 12:04:08 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 28/03/2008 Kaspersky Anti-Virus database records: 668934------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ F:\ Scan Statistics: Total number of scanned objects: 86207 Number of viruses found: 5 Number of infected objects: 14 Number of suspicious objects: 0 Duration of the scan process: 01:25:25 Infected Object Name / Virus Name / Last ActionC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skippedC:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skippedC:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\LocalService
tuser.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\NetworkService
tuser.dat.LOG Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Application Data\Adobe\Acrobat\7.0\Updater\udlog.txt Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Cookies\INDEX.DAT Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Messenger\primepropertiesBPO@live.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Messenger\primepropertiesBPO@live.com\SharingMetadata\pending.dat Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Messenger\primepropertiesBPO@live.com\SharingMetadata\Working\database_22B4_53A_B405_1249\dfsr.db Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Messenger\primepropertiesBPO@live.com\SharingMetadata\Working\database_22B4_53A_B405_1249\fsr.log Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Messenger\primepropertiesBPO@live.com\SharingMetadata\Working\database_22B4_53A_B405_1249\fsrtmp.log Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Messenger\primepropertiesBPO@live.com\SharingMetadata\Working\database_22B4_53A_B405_1249	mp.edb Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Application Data\Microsoft\Windows Live Contacts\primepropertiesBPO@live.comeal\members.stg Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\History\History.IE5\INDEX.DAT Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\History\History.IE5\MSHist012008032820080329\index.dat Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Temp\~DF26BB.tmp Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Temp\~DF26CD.tmp Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Temp\~DF5CD9.tmp Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Temp\~DF5CE6.tmp Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING\NTUSER.DAT Object is locked skippedC:\Documents and Settings\User3.MARATHONFUNDING
tuser.dat.LOG Object is locked skippedC:\Program Files\Common Files\System\IODriver.pif Infected: Packed.Win32.Klone.h skippedC:\Program Files\Microsoft\svhost32.exe Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skippedC:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skippedC:\System Volume Information\catalog.wci\00010002.ci Object is locked skippedC:\System Volume Information\catalog.wci\cicat.fid Object is locked skippedC:\System Volume Information\catalog.wci\cicat.hsh Object is locked skippedC:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skippedC:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skippedC:\System Volume Information\catalog.wci\INDEX.000 Object is locked skippedC:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skippedC:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP342\A0042344.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP347\A0043344.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP351\A0047773.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP352\A0048421.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP353\A0048910.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP354\A0049108.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP362\A0050088.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP363\A0051092.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP365\A0053268.exe Infected: Trojan-Downloader.Win32.Cn911.j skippedC:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP365\change.log Object is locked skippedC:\WINDOWS\CSC\00000001 Object is locked skippedC:\WINDOWS\Debug\Netlogon.log Object is locked skippedC:\WINDOWS\Debug\PASSWD.LOG Object is locked skippedC:\WINDOWS\SchedLgU.Txt Object is locked skippedC:\WINDOWS\SoftwareDistribution\EventCache\{854FB51A-6F50-43F9-AD7A-B506EE91799B}.bin Object is locked skippedC:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skippedC:\WINDOWS\Sti_Trace.log Object is locked skippedC:\WINDOWS\SYSTEM32\bdscheca001.dll Infected: Trojan-PSW.Win32.WOW.pv skippedC:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skippedC:\WINDOWS\SYSTEM32\CatRoot2	mp.edb Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\dms.dll Infected: Trojan-PSW.Win32.Nilage.auc skippedC:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skippedC:\WINDOWS\SYSTEM32\jbhook.dll Infected: Trojan.Win32.Agent.bo skippedC:\WINDOWS\SYSTEM32\SVCH0ST.EXE Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skippedC:\WINDOWS\WIADEBUG.LOG Object is locked skippedC:\WINDOWS\WIASERVC.LOG Object is locked skippedC:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

bamajim · Answer

jtmfg

1. Using Windows Explorer again
Locate and delete the following files

C:\Program Files\Common Files\System\IODriver.pif
C:\Program Files\Microsoft\svhost32.exe
C:\WINDOWS\SYSTEM32\bdscheca001.dll
C:\WINDOWS\SYSTEM32\dms.dll
C:\WINDOWS\SYSTEM32\jbhook.dll

Close windows explorer ->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

jtmfg · Answer

bamajim,

Some files couldn't be located, even with "show hidden files" on

C:\Program Files\Common Files\System\IODriver.pif - the file couldn't be located.
C:\Program Files\Microsoft\svhost32.exe - found and deleted
C:\WINDOWS\SYSTEM32\bdscheca001.dll - gives error message "Cannot delete bdscheca001: Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use."
C:\WINDOWS\SYSTEM32\dms.dll - found and deleted
C:\WINDOWS\SYSTEM32\jbhook.dll the file couldn't be located.

Following is new HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:10:44 AM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\SVCH0ST.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {27AAC9F7-A327-4ABE-A361-C39744135D07} (EHtml Control) - http://www3.edaily.co.kr/efriends/efActiveX/LiveUp.CAB
O16 - DPF: {28E52D43-46EB-439B-8334-DA8D9C63D5B7} (ENCMAX Control) - http://wucma.wyldfyre.com/xbin/ENCMAX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {340CCF52-D65F-4A11-80B3-13DC23697B59} (BugsInstall Control) - http://player.bugs.co.kr/install/BugsInstall.cab
O16 - DPF: {3E5BBDC8-18F9-4A70-94B5-DD64929C0AF4} (AniCastH Class) - http://gogo.jaeminara.co.kr/gogo/hansol/yahoo/control/axacastH.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113543002229
O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20060116/SVPorsche.cab
O16 - DPF: {92D0D610-A6FA-48D8-94CB-BD47FDF68655} - http://app.ipop.co.kr/ipop/ipopx.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/XTools.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BE92758D-C33A-4EF1-AAC4-EED002F3C631} (SBSQuizStarter Control) - http://sbsi.gscdn.com/sbsi/SBSQuizStarter/SBSQuizStarter.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1008 Class) - http://cdn.hangame.com/hangame/hansetup/HanSetup1008.cab
O16 - DPF: {DE4B0C89-2566-41B4-AE50-D982CD7FA0A6} (Install Class) - http://www.arisu.co.kr/xtra/ActiveX/arisucab1.cab
O16 - DPF: {E9178429-0886-4878-AE31-4942F18BC3DF} (AnyVCSNewLogin Control) - http://www.vcsys.co.kr/common/AnyVCSNewLogin.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\Software\..\Telephony: DomainName = MarathonFunding.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

--
End of file - 7716 bytes

bamajim · Answer

jtfmg   How's your PC running now?     Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

jtmfg · Answer

I erased bdscheca001.dll by using unlocker utility.

New HJT Log as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:23:45 AM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\SVCH0ST.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {27AAC9F7-A327-4ABE-A361-C39744135D07} (EHtml Control) - http://www3.edaily.co.kr/efriends/efActiveX/LiveUp.CAB
O16 - DPF: {28E52D43-46EB-439B-8334-DA8D9C63D5B7} (ENCMAX Control) - http://wucma.wyldfyre.com/xbin/ENCMAX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {340CCF52-D65F-4A11-80B3-13DC23697B59} (BugsInstall Control) - http://player.bugs.co.kr/install/BugsInstall.cab
O16 - DPF: {3E5BBDC8-18F9-4A70-94B5-DD64929C0AF4} (AniCastH Class) - http://gogo.jaeminara.co.kr/gogo/hansol/yahoo/control/axacastH.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113543002229
O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20060116/SVPorsche.cab
O16 - DPF: {92D0D610-A6FA-48D8-94CB-BD47FDF68655} - http://app.ipop.co.kr/ipop/ipopx.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/XTools.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BE92758D-C33A-4EF1-AAC4-EED002F3C631} (SBSQuizStarter Control) - http://sbsi.gscdn.com/sbsi/SBSQuizStarter/SBSQuizStarter.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1008 Class) - http://cdn.hangame.com/hangame/hansetup/HanSetup1008.cab
O16 - DPF: {DE4B0C89-2566-41B4-AE50-D982CD7FA0A6} (Install Class) - http://www.arisu.co.kr/xtra/ActiveX/arisucab1.cab
O16 - DPF: {E9178429-0886-4878-AE31-4942F18BC3DF} (AnyVCSNewLogin Control) - http://www.vcsys.co.kr/common/AnyVCSNewLogin.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\Software\..\Telephony: DomainName = MarathonFunding.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

--
End of file - 7514 bytes

Message Edited by jtmfg on 03-31-2008 11:26 AM

jtmfg · Answer

Boots bit faster than when I first took over and did updates, (OS was still XP SP1 when I first got it) erased lots and lots of stuff last guy installed in this system.

However, it's still very laggy after Win logo splash is gone and desktop shows.

I usually just run task manager and kill svch0st.exe process, then system runs bit better.

However IE loads very slowly, and after loading switching between tabs and/or windows is very slow, moving between fields on a web page (i.e. from username field to passwords, etc) using tab is very slow.

System generally responds slowly, for instance, I only type about 80 wpm and the display (while typing this post) can't catch up to such speed. Now, I know that's not because of system hardware, since my last system has exact same hardwares.

bamajim · Answer

jtmfg Let's do a little clean up 1. *NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner! Download CCleaner from here to clean temp files from your computer. Double click on the file to start the installation of the program. Select your language and click OK, then next. Read the license agreement and click I Agree. Click next to use the default install location. Click Install then finish to complete installation. Double click the CCleaner shortcut on the desktop to start the program. On the 'Windows' tab, under 'Internet Explorer,' uncheck 'Cookies' if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit). If you use either the Firefox or Mozilla browsers, the box to uncheck for 'Cookies' is on the Applications tab, under Firefox/Mozilla. Click on the 'Options' icon at the left side of the window, then click on 'Advanced.' deselect 'Only delete files in Windows Temp folders older than 48 hours.' Click on the 'Cleaner' icon on the left side of the window, then click Run Cleaner to run the program. Caution: It is not recommended that you use the 'Issues' feature unless you are very familiar with the registry as it has been known to find legitimate items. After CCleaner has completed its process, click Exit. 1. Rerun Hijackthis (scan only) and place checks beside the following entries O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background <<_This is a legit program, but a resource hog and not needed to run at Start-up) Close all other open windows except Hijackthis and Select ' Fix checked' Close Hijackthis ->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log Microsoft MVP Consumer-Security CastleCops Instructor 'The world is what you make of it'

jtmfg · Answer

All instructions were followed, and deleted cookies also.

New HJT log as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:30:05 PM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\SVCH0ST.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {27AAC9F7-A327-4ABE-A361-C39744135D07} (EHtml Control) - http://www3.edaily.co.kr/efriends/efActiveX/LiveUp.CAB
O16 - DPF: {28E52D43-46EB-439B-8334-DA8D9C63D5B7} (ENCMAX Control) - http://wucma.wyldfyre.com/xbin/ENCMAX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {340CCF52-D65F-4A11-80B3-13DC23697B59} (BugsInstall Control) - http://player.bugs.co.kr/install/BugsInstall.cab
O16 - DPF: {3E5BBDC8-18F9-4A70-94B5-DD64929C0AF4} (AniCastH Class) - http://gogo.jaeminara.co.kr/gogo/hansol/yahoo/control/axacastH.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113543002229
O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20060116/SVPorsche.cab
O16 - DPF: {92D0D610-A6FA-48D8-94CB-BD47FDF68655} - http://app.ipop.co.kr/ipop/ipopx.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/XTools.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BE92758D-C33A-4EF1-AAC4-EED002F3C631} (SBSQuizStarter Control) - http://sbsi.gscdn.com/sbsi/SBSQuizStarter/SBSQuizStarter.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1008 Class) - http://cdn.hangame.com/hangame/hansetup/HanSetup1008.cab
O16 - DPF: {DE4B0C89-2566-41B4-AE50-D982CD7FA0A6} (Install Class) - http://www.arisu.co.kr/xtra/ActiveX/arisucab1.cab
O16 - DPF: {E9178429-0886-4878-AE31-4942F18BC3DF} (AnyVCSNewLogin Control) - http://www.vcsys.co.kr/common/AnyVCSNewLogin.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\Software\..\Telephony: DomainName = MarathonFunding.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MarathonFunding.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C632DBF-3199-4737-B815-F050A3274F9A}: NameServer = 192.168.1.200,192.168.1.254
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

--
End of file - 7128 bytes

bamajim · Answer

jtmfg   DId that improve your situation?     Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

jtmfg · Answer

Slightly.

IE still loads very slowly, switch between windows/tabs are quite slow as well.

I'll try defragmenting the drive later before I go home.

Just a question,

What is this:

C:\WINDOWS\System32\SVCH0ST.EXE

and can I erase it?

It seems like this hogs lots of system resource, and I run task manager to kill this process every time I boot, which has no negative effect on the system (as far as I see)

bamajim · Answer

jtmfg The file in question C:\WINDOWS\System32\SVCH0ST.EXE Does need to go. Open Task Manager->> Hilite the file and Select ' End Process' Then Using windows Explorer locate and delete the file C:\WINDOWS\System32\SVCH0ST.EXE <<- NOTE the spelling, for SvcHost.exe is a legit file. The file that needs to be deleted has a '0 (zero) instead of an o' Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log. Microsoft MVP Consumer-Security CastleCops Instructor 'The world is what you make of it'

Virus & Spyware

HJT Log 03-27-08

Was this post helpful?