PLEASE HELP- I'M DESPERATE

Question

Please post response to board please ONLY because it is my sister's computer and I am trying to help her with a virus. ALSO, PLEASE POST TO BOARD AS I AM IN FRONT OF IT WATCHING - THANK YOU!The hijack log is as follows:Logfile of HijackThis v1.99.1Scan saved at 3:09:05 PM, on 10/18/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Common Files\Command Software\dvpapi.exeC:\WINDOWS\system32\drivers\KodakCCS.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\winservices.exeC:\WINDOWS\System32\hkcmd.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\Lexmark X74-X75\lxbbbmgr.exeC:\Program Files\Lexmark X74-X75\lxbbbmon.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\ABBYY FineReader 5.0 Sprint\CAgent.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Java\jre1.5.0_03\bin\jusched.exeC:\WINDOWS\System32\egq1buse.exeC:\WINDOWS\System32\kernels32.exeC:\WINDOWS\System32\efsdfgxg.exeC:\Program Files\ISTsvc\istsvc.exeC:\WINDOWS\etvhqhgp.exeC:\WINDOWS\System32\Icbukh.exeC:\WINDOWS\System32\vxgame2.exeC:\WINDOWS\System32\paytime.exeC:\WINDOWS	ool2.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\System32\vxh8jkdq2.exeC:\WINDOWS\System\svchost.exeC:\WINDOWS\System32\maxd1.exeC:\Program Files\Dell Support\DSAgnt.exeC:\winstall.exeC:\WINDOWS\System32\sysvcs.exeC:\WINDOWS\System32\vxh8jkdq2.exeC:\Program Filesdso\eetu.exeC:\WINDOWS\System32\m?hta.exeC:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exeC:\WINDOWS\System32\paytime.exeC:\WINDOWS	ool2.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exeC:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exeC:\Program Files\LimeWire\LimeWire.exeC:\WINDOWS\System32\kernels32.exeC:\WINDOWS\System32\vxh8jkdq2.exeC:\WINDOWS\System32\maxd1.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\System32\kernels32.exeC:\WINDOWS\System32\vxh8jkdq2.exeC:\WINDOWS\System32\vxh8jkdq6.exeC:\WINDOWS\System32\vxh8jkdq7.exeC:\WINDOWS\System32\vxgamet2.exeC:\WINDOWS\System32\maxd1.exeC:\WINDOWS\System32\split.exeC:\WINDOWS\System32\split.exeC:\WINDOWS\System32\split.exeC:\WINDOWS\System32\split.exeC:\WINDOWS\System32\mdms.exeC:\WINDOWS\system32\cidaemon.exeC:\Documents and Settings\Christina\Desktop\HijackThis-1.exeC:\PROGRA~1\MOZILL~1\FIREFOX.EXEC:\WINDOWS\System32\vxgame3.exeC:\WINDOWS\System32\vxgame3.exeC:\WINDOWS\System32\vxgame4.exeC:\WINDOWS\System32\vxgame4.exeC:\WINDOWS\System32\vxgame4.exeC:\WINDOWS\System32\vxgame6.exeC:\WINDOWS\System32\vxgame4.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jspR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mhtR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.comR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://media50.fastclick.net/w/safepop.cgi?mid=46873&sid=4507&id=103626&len=0&c=7&nfcp=1&fp=2R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exeO2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - (no file)O2 - BHO: C:\WINDOWS\adsldpbc.dll - {590C5120-43CE-4826-A636-0F1BE2E6871B} - C:\WINDOWS\adsldpbc.dllO2 - BHO: C:\WINDOWS\q342125.dll - {7A7E6D97-B492-4884-9ABB-C31281DCC4F2} - C:\WINDOWS\q342125.dllO2 - BHO: (no name) - {81B5BE0B-0EEE-2230-CB9E-2CB71F4F35E4} - C:\WINDOWS\System32\kgz.dllO2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\zolker011.dllO2 - BHO: ZToolbar Activator Class - {FFF5092F-7172-4018-827B-FA5868FB0478} - C:\WINDOWS\System32\ztoolb011.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: ZToolbar - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\ztoolb011.dllO3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [Lexmark X74-X75] 'C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe'O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [ABBYY Community Agent] C:\Program Files\ABBYY FineReader 5.0 Sprint\CAgent.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exeO4 - HKLM\..\Run: [egq1buse] C:\WINDOWS\System32\egq1buse.exeO4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exeO4 - HKLM\..\Run: [Explorer32] C:\WINDOWS\System32\efsdfgxg.exeO4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exeO4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exeO4 - HKLM\..\Run: [iMkQi0] C:\WINDOWS\etvhqhgp.exeO4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Whqbpl.exeO4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Icbukh.exeO4 - HKLM\..\Run: [Remote Login Services] winservices.exeO4 - HKLM\..\Run: [DME] C:\Program Files\Zero Knowledge\DM\DownloadManagerR.exeO4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /sO4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exeO4 - HKLM\..\RunServices: [Remote Login Services] winservices.exeO4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exeO4 - HKLM\..\RunServices: [Explorer64] C:\WINDOWS\System32\efsdfgxg.exeO4 - HKLM\..\RunOnce: [Remote Login Services] winservices.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startupO4 - HKCU\..\Run: [Windows installer] C:\winstall.exeO4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exeO4 - HKCU\..\Run: [SNInstall] C:\WINDOWS\System32\vxh8jkdq2.exeO4 - HKCU\..\Run: [Aida] 'C:\Program Filesdso\eetu.exe' -vt mtO4 - HKCU\..\Run: [Lqjw] C:\WINDOWS\System32\m?hta.exeO4 - HKCU\..\Run: [Shell] 'C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe'O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exeO4 - HKCU\..\Run: [Remote Login Services] winservices.exeO4 - HKCU\..\RunOnce: [Remote Login Services] winservices.exeO4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exeO4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exeO8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htmO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)O15 - Trusted Zone: *.asdbiz.bizO15 - Trusted Zone: *.blazefind.comO15 - Trusted Zone: *.clickspring.netO15 - Trusted Zone: *.coolwebsearch.comO15 - Trusted Zone: *.flingstone.comO15 - Trusted Zone: *.mt-download.comO15 - Trusted Zone: *.my-internet.infoO15 - Trusted Zone: *.searchbarcash.comO15 - Trusted Zone: *.searchmeup.comO15 - Trusted Zone: *.searchmiracle.comO15 - Trusted Zone: *.skoobidoo.comO15 - Trusted Zone: *.slotch.comO15 - Trusted Zone: *.slotchbar.comO15 - Trusted Zone: *.windupdates.comO15 - Trusted Zone: *.xxxtoolbar.comO15 - Trusted Zone: *.asdbiz.biz (HKLM)O15 - Trusted Zone: *.blazefind.com (HKLM)O15 - Trusted Zone: *.clickspring.net (HKLM)O15 - Trusted Zone: *.flingstone.com (HKLM)O15 - Trusted Zone: *.mt-download.com (HKLM)O15 - Trusted Zone: *.my-internet.info (HKLM)O15 - Trusted Zone: *.searchbarcash.com (HKLM)O15 - Trusted Zone: *.searchmiracle.com (HKLM)O15 - Trusted Zone: *.skoobidoo.com (HKLM)O15 - Trusted Zone: *.slotch.com (HKLM)O15 - Trusted Zone: *.slotchbar.com (HKLM)O15 - Trusted Zone: *.windupdates.com (HKLM)O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)O15 - Trusted IP range: 67.19.178.84O15 - Trusted IP range: 67.19.178.84 (HKLM)O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - http://supportsoft.adelphia.net/sdccommon/download/tgctlins.cabO16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=5059O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: style2 - C:\WINDOWS\q327265.dllO20 - Winlogon Notify: style32 - C:\WINDOWS\q342125.dllO20 - Winlogon Notify: tcpG4T - C:\WINDOWS\SYSTEM32	cpG4T.dllO21 - SSODL: SysTray.Excn - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - C:\WINDOWS\System32\inqkifmd.dllO21 - SSODL: SysTray.Exsh - {1768ECFC-4F5C-4f5b-B134-D67294FC78E9} - C:\WINDOWS\System32\moafnocm.dllO23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEPLEASE POST FOR ME AS  I AM HERE IN FRONT OF HER PC WAITING AND I DON'T KNOW WHAT TO REMOVE OR DO. SOMEONE ON ANOTHER PART OF THE BOARD TOLD ME TO TELL YOU IT LOOKS LIKE THE WHOLE THING HAS BEEN HIJACKED BECAUSE I'M GETTIG ALL PORN ADS AND DIRTY PICS AND THERE ARE KIDS HERE. PLEASE HURRY!THANK YOUJEANNEI DON'T KNOW WHAT THE STUFF BELOW IS - IT STOPPED AND THAT CAME ON THE SCREEN. An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=5059)Error #5 - Invalid procedure call or argumentPlease email me at merijn@spywareinfo.com, reporting the following:* What you were trying to fix when the error occurred, if applicable* How you can reproduce the error* A complete HijackThis scan log, if possibleWindows version: Windows NT 5.01.2600MSIE version: 6.0.2800.1106HijackThis version: 1.99.1This message has been copied to your clipboard.Click OK to continue the rest of the scan. Message Edited by JeanneGJ on 10-18-2005 04:46 PM Message Edited by JeanneGJ on 10-18-2005 04:48 PM Message Edited by JeanneGJ on 10-18-2005 09:25 PM

JeanneGJ · Answer

I am now back to my computer,  which is not infected - if anyone can help please tell me what to do.   I didn't realize that it wouldn't be wise to email to an infected pc but I am home now and I was wondering if I should just take everything off for her and start over. Thank you,  Jeanne Thank you

Virus & Spyware

Was this post helpful?