My First Hijackthis Logfile

Hi Bebe_Queen

I'm taking a look at your log and will post a fix shortly.

Please print out these instructions and read through them completely before proceeding. You have a lot to fix, I recommend checking off the items as you complete all of the items in order. If not done in this order, some of the fixes will fail.

You have the Peper trojan.
Download Peperfix from http://www.bleepingcomputer.com/files/peperremover.php and save it to your Desktop.Make sure you are connected to the Internet and run it; reboot afterwards. 
Repeat the procedure as it has to be run twice to ensure its effectiveness.

You have two antispyware applications running, but they could interfere with fixes you will need to do.

Disable Microsoft AntiSpyware
Open Microsoft AntiSpyware.
Click on Tools, Settings.
In the left pane, click on Real-time Protection.
Under Startup Options uncheck> "Enable the Microsoft AntiSpyware Security Agents on startup (recommended".
Under Real-time spyware threat protection uncheck> "Enable real-time spyware threat protection (recommended)".
After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.
You can re-enable Microsoft AntiSpyware after your system has been cleaned.

Also Disable McAfee AntiSpyware

Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found:

QuickSearch Toolbar
FirstLook
New.net domains
Virtual Bouncer

From add or Remove Programs you can also optionally uninstall:

My Web Search Bar - An IE toolbar providing search features, and a homepage-/search-hijacker, targeted at the sites run by MyWay. I highly recommend uninstalling it and using a safer search bar like Google Toolbar or Yahoo! Toolbar.
To uninstall My Web Search Bar:
Go to Start -> Settings -> Control Panel -> Add or Remove Programs and uninstall the following program if there:
My Web Search Bar

Now please download the Symantec Adware.IEPlugin Removal Tool from here:
http://securityresponse.symantec.com/avcenter/FxIeplgn.exe

Save it to the desktop, but do NOT run it yet.

Please download, install, and update the free version of Ewido trojan scanner from http://www.ewido.net/en/download/.
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
When you run ewido for the first time, you will get a warning "Database could not be found!".  Click OK.  We will fix this in a moment.
From the main ewido screen, click on update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful")
Exit Ewido.  DO NOT scan yet.

Download CCleaner from http://www.ccleaner.com/ccdownload.asp and install, but do not run it yet.

Please download Nailfix from  http://www.noidea.us/easyfile/file.php?download=20050515010747824 and Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.cmd.  Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now run HijackThis, click "Open the Misc Tools section", and then click "Delete an NT service".
In the "Delete a Windows NT Service" window that opens, type:
kgujtfyndq and hit OK.
Repeat the procedure and this time in the "Delete a Windows NT Service" window that opens, type:
ocwsjbbjrk and hit OK.
Close HijackThis.

Locate FxIeplgn.exe on your desktop and double click on it to run it.

Next, run CCleaner. 
Uncheck "Cookies" under "Internet Explorer".
If you are running Firefox:, then click on the "Applications" tab and uncheck "Cookies" under "Firefox".
Click on Run Cleaner in the lower right-hand corner.  This can take quite a while to run.

Now run Ewido again and run a full system scan (this could take q while).  Save the logfile from the scan, you will need to post it later.

Now you need to run HijackThis and click "Do a system scan only." Place a check next to the following entries (if they are still there):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O4 - HKLM\..\Run: [FSCQHS] C:\WINDOWS\FSCQHS.exe
O4 - HKLM\..\Run: [wdskctl] C:\WINDOWS\wdskctl.exe
O4 - HKLM\..\Run: [9jc] C:\documents and settings\owner\local settings\temp\9jc.exe
O4 - HKLM\..\Run: [buvrhes] C:\WINDOWS\tzcvdxd.exe
O4 - HKLM\..\Run: [tkulei] C:\WINDOWS\ljnzrnpl.exe
O4 - HKLM\..\Run: [mtdcuefgk] C:\WINDOWS\llbzzqz.exe
O4 - HKLM\..\Run: [eH] C:\documents and settings\owner\local settings\temp\eH.exe
O4 - HKLM\..\Run: [rwnpn] C:\documents and settings\owner\local settings\temp\rwnpn.exe
O4 - HKLM\..\Run: C:\documents and settings\owner\local settings\temp\E.exe
O4 - HKLM\..\Run: [RM] C:\documents and settings\owner\local settings\temp\RM.exe
O4 - HKLM\..\Run: [pjWKtCc] C:\documents and settings\owner\local settings\temp\pjWKtCc.exe
O4 - HKLM\..\Run: [lMgd7En] C:\documents and settings\owner\local settings\temp\lMgd7En.exe
O4 - HKLM\..\Run: [iGS3cvz] C:\documents and settings\owner\local settings\temp\iGS3cvz.exe
O4 - HKLM\..\Run: [81d1QQo] C:\documents and settings\owner\local settings\temp\81d1QQo.exe
O4 - HKLM\..\Run: [kEATQda6A] C:\documents and settings\owner\local settings\temp\kEATQda6A.exe
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - HKLM\..\Run: [rrvxnakg] C:\WINDOWS\system32\wkpx\rrvxnakg.exe
O4 - HKLM\..\Run: [kguj] C:\WINDOWS\system32\tfyndq\kguj.exe
O4 - HKLM\..\Run: [givnoklo] C:\WINDOWS\system32\pwbhwlo\givnoklo.exe
O4 - HKLM\..\Run: [rfdy] C:\WINDOWS\system32\kmixlcod\rfdy.exe
O4 - HKLM\..\Run: [ocwsj] C:\WINDOWS\system32\bbjrk\ocwsj.exe
O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Owner\LOCALS~1\Temp\rmhukcny.exe
O4 - HKLM\..\Run: [qlmtsp] C:\WINDOWS\qlmtsp.exe
O4 - HKLM\..\Run: [bXAvP.exe] c:\windows\system32\bXAvP.exe
O4 - HKLM\..\Run: [9n4s] C:\windows\system32\9n4s.exe
O4 - HKLM\..\Run: [3G@Y9J92A64YFM] C:\WINDOWS\system32\NuaK63G.exe
O4 - HKLM\..\Run: [cpdwqt] c:\windows\system32\nmbqlup.exe r
O4 - HKCU\..\Run: [Ospm] C:\WINDOWS\system32\?ti2evxx.exe
O4 - HKCU\..\Run: [Lwt9Rhj7O] catfmsp.exe
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O18 - Protocol hijack: mhtml -
O23 - Service: kgujtfyndq - Unknown owner - C:\WINDOWS\system32\tfyndq\kguj.exe
O23 - Service: ocwsjbbjrk - Unknown owner - C:\WINDOWS\system32\bbjrk\ocwsj.exe
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - c:\windows\SvcProc.exe

If you chose to uninstall My Web Search Bar, also check the following entry:
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk037

Close all browser and other windows except for HijackThis, and click "Fix Checked" to have HijackThis fix the entries you checked

Reconfigure Windows XP to show hidden files:
Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

Using Windows Explorer, locate the following files/folders, and delete them (if found: the ones in the Temp directory should be gone along with some others). Be careful to Not delete the Temp folder.

C:\Program Files\QuickSearch
C:\WINDOWS\FSCQHS.exe
C:\WINDOWS\wdskctl.exe
C:\documents and settings\owner\local settings\temp\9jc.exe
C:\WINDOWS\tzcvdxd.exe
C:\WINDOWS\ljnzrnpl.exe
C:\WINDOWS\llbzzqz.exe
C:\documents and settings\owner\local settings\temp\eH.exe
C:\documents and settings\owner\local settings\temp\rwnpn.exe
C:\documents and settings\owner\local settings\temp\E.exe
C:\documents and settings\owner\local settings\temp\RM.exe
C:\documents and settings\owner\local settings\temp\pjWKtCc.exe
C:\documents and settings\owner\local settings\temp\lMgd7En.exe
C:\documents and settings\owner\local settings\temp\iGS3cvz.exe
C:\documents and settings\owner\local settings\temp\81d1QQo.exe
C:\documents and settings\owner\local settings\temp\kEATQda6A.exe
C:\Program Files\VBouncer
C:\WINDOWS\system32\wkpx
C:\WINDOWS\system32\tfyndq
C:\WINDOWS\system32\pwbhwlo
C:\WINDOWS\system32\kmixlcod
C:\WINDOWS\system32\bbjrk
C:\documents and settings\Owner\local settings\Temp\rmhukcny.exe
C:\WINDOWS\qlmtsp.exe
c:\windows\system32\bXAvP.exe
C:\windows\system32\9n4s.exe
C:\WINDOWS\system32\NuaK63G.exe
c:\windows\system32\nmbqlup.exe
c:\windows\SvcProc.exe

Now use Windows Search (Start > Search > For Files or Folders), to search for and delete the following file:
catfmsp.exe

Now launch Notepad, and copy/paste the box below into a new text file. Save it as FindFile.bat and save it on your Desktop.

dir C:\WINDOWS\system32\?ti2evxx.exe /a h > files.txt
notepad files.txt

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan and the text from files.txt.

You appear to have installed a new peer-to-peer (P2P) file sharing program. Unfortunately, it's an infected one. Ares is known to have spyware or other unwanted parasites bundled into. I highly recommend uninstalling it and replacing it with a clean P2P program.  You can find a list of clean P2P programs at http://www.spywareinfo.com/articles/p2p/

To uninstall Ares, Go to Start -> Settings -> Control Panel -> Add or Remove Programs and uninstall:
Ares

Also at Start -> Settings -> Control Panel -> Add or Remove Programs and uninstall the following program if there:
Lycos Sidesearch

Now please try this again.
Now run HijackThis, click "Open the Misc Tools section", and then click "Delete an NT service".
In the "Delete a Windows NT Service" window that opens, type:
kgujtfyndq and hit OK.
Repeat the procedure and this time in the "Delete a Windows NT Service" window that opens, type:
ocwsjbbjrk and hit OK.
Close HijackThis.
Please let me know if you receive a file in use error again (or any other error).

Now you need to run HijackThis and click "Do a system scan only." Place a check next to the following entries (if they are still there):

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O4 - HKLM\..\Run: [bzitgy] c:\windows\system32\djjxni.exe r
O4 - HKCU\..\Run: [Ltho] C:\Documents and Settings\Owner\Application Data\ootr.exe
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

If you chose to uninstall Ares as recommended, also select:
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h

Close all browser and other windows except for HijackThis, and click "Fix Checked" to have HijackThis fix the entries you checked

Using Windows Explorer, locate the following files/folders, and delete them (if found):

C:\Program Files\SEP
c:\windows\system32\djjxni.exe
C:\Documents and Settings\Owner\Application Data\ootr.exe
C:\WINDOWS\system32\tfyndq
C:\WINDOWS\system32\bbjrk
C:\Program Files\Lycos\Sidesearch

If you chose to uninstall Ares as recommended, also delete the following folder:
C:\Program Files\Ares

Now using Windows Explorer, locate the following file and delete it. The first character may look like an "A", but it's a non-standard character which is why the file name shows with the question mark in it. Check the file size and date you posted (425,984 bytes, 04/06/2005) to be certain it's the correct file::
C:\WINDOWS\system32\?ti2evxx.exe

Restart your computer in normal mode and please post a new HijackThis log

Disable Microsoft AntiSpyware
Open Microsoft AntiSpyware.
Click on Tools, Settings.
In the left pane, click on Real-time Protection.
Under Startup Options uncheck> "Enable the Microsoft AntiSpyware Security Agents on startup (recommended".
Under Real-time spyware threat protection uncheck> "Enable real-time spyware threat protection (recommended)".
After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.
You can re-enable Microsoft AntiSpyware after your system has been cleaned.

Please download the Pocket Killbox by Option^Explicit from http://www.downloads.subratam.org/KillBox.zip and save it to your Desktop. You will need it later.

Run Ewido and from the main ewido screen, click on update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful")
Exit Ewido.  DO NOT scan yet.

Next, please reboot your computer in Safe Mode by doing the following:

1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site: http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.cmd.  Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Next, run CCleaner. 
Uncheck "Cookies" under "Internet Explorer".
If you are running Firefox:, then click on the "Applications" tab and uncheck "Cookies" under "Firefox".
Click on Run Cleaner in the lower right-hand corner.  This can take quite a while to run.

Now run Ewido again and run a full scan.  Save the logfile from the scan, you will need to post it later.

Now you need to run HijackThis and click "Do a system scan only." Place a check next to the following entries (if they are still there):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [euivebl] c:\windows\system32\cobigbq.exe r
O4 - HKCU\..\Run: [Ltho] C:\Documents and Settings\Owner\Application Data\ootr.exe
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Close all browser and other windows except for HijackThis, and click "Fix Checked" to have HijackThis fix the entries you checked

Now find Killbox on your Desktop and run it by double-clicking on it, and select the "Delete on Reboot" option. Manually select the first file in the list below in Killbox by clicking on the folder icon "Browse for file", locate it, select it, and then press the red X button, say Yes to the prompt and No to reboot now. Repeat the process for each file/folder in the list. Some of these files may not be there (Nail.exe and svcproc.exe should already be gone), if not, just proceed to the next file. When selecting the last file, say Yes to the first prompt, and Yes to Reboot Now.

C:\WINDOWS\Nail.exe
c:\windows\system32\cobigbq.exe
C:\Documents and Settings\Owner\Application Data\ootr.exe
C:\WINDOWS\svcproc.exe

If your computer does not restart automatically, please restart it manually. 

Please post a new HijackThis log and the log from Ewido.

Message Edited by TheJoker2 on 06-26-2005 12:51 PM

Ewido will clean tracking cookies. As long as you know the user ID and password for the system you aretrying to log on to, a deleted cookie should not be a problem. If you don't remember the user ID and password, most systems have a procedure to request that a new password e-mailed to you.

You are becoming infected just as fast as your system can be cleaned. I highly suggest you limit your internet activity until your system is clean and you can update your operating system (which you can't safely do until your system is clean). Also, you should avoid installing any new software until you are clean. Are you the only user on this system?