Winfixer 2005 - HJT log file

Question

We keep getting the Winfixer popup.  Has been going on for weeks.   Hope you guys can help.       Logfile of HijackThis v1.99.1 Scan saved at 10:06:24 PM, on 11/13/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Real\RealPlayer\RealPlay.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\SYSTEM32\RAMASST.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\dlbxcoms.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\1-Lee\My Documents\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\system32\awtqo.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe' O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124410032\ee\AOLHostManager.exe O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1 O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\SYSTEM32\RAMASST.exe O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0esources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - Winlogon Notify: awtqo - C:\WINDOWS\system32\awtqo.dll O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll O20 - Winlogon Notify: awtsp - C:\WINDOWS\system32\awtsp.dll O20 - Winlogon Notify: awtsq - C:\WINDOWS\system32\awtsq.dll O20 - Winlogon Notify: awvvs - C:\WINDOWS\system32\awvvs.dll O20 - Winlogon Notify: awvvu - C:\WINDOWS\system32\awvvu.dll O20 - Winlogon Notify: awvvv - C:\WINDOWS\system32\awvvv.dll O20 - Winlogon Notify: ddaby - C:\WINDOWS\system32\ddaby.dll O20 - Winlogon Notify: ddayv - C:\WINDOWS\system32\ddayv.dll O20 - Winlogon Notify: ddayx - C:\WINDOWS\system32\ddayx.dll O20 - Winlogon Notify: ddccb - C:\WINDOWS\system32\ddccb.dll O20 - Winlogon Notify: ddccy - C:\WINDOWS\system32\ddccy.dll O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll O20 - Winlogon Notify: ddcyv - C:\WINDOWS\system32\ddcyv.dll O20 - Winlogon Notify: ddcyw - C:\WINDOWS\system32\ddcyw.dll O20 - Winlogon Notify: gebcb - C:\WINDOWS\system32\gebcb.dll O20 - Winlogon Notify: gebcc - C:\WINDOWS\system32\gebcc.dll O20 - Winlogon Notify: gebya - C:\WINDOWS\system32\gebya.dll O20 - Winlogon Notify: gebyv - C:\WINDOWS\system32\gebyv.dll O20 - Winlogon Notify: gebyw - C:\WINDOWS\system32\gebyw.dll O20 - Winlogon Notify: gebyx - C:\WINDOWS\system32\gebyx.dll O20 - Winlogon Notify: geeba - C:\WINDOWS\system32\geeba.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: jkhfc - C:\WINDOWS\system32\jkhfc.dll O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll O20 - Winlogon Notify: jkhff - C:\WINDOWS\system32\jkhff.dll O20 - Winlogon Notify: jkhhe - C:\WINDOWS\system32\jkhhe.dll O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll O20 - Winlogon Notify: jkhhg - C:\WINDOWS\system32\jkhhg.dll O20 - Winlogon Notify: jkhhi - C:\WINDOWS\system32\jkhhi.dll O20 - Winlogon Notify: jkkjh - C:\WINDOWS\system32\jkkjh.dll O20 - Winlogon Notify: jkkjk - C:\WINDOWS\system32\jkkjk.dll O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll O20 - Winlogon Notify: mljgd - C:\WINDOWS\system32\mljgd.dll O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll O20 - Winlogon Notify: mljjh - C:\WINDOWS\system32\mljjh.dll O20 - Winlogon Notify: mlljg - C:\WINDOWS\system32\mlljg.dll O20 - Winlogon Notify: mlljk - C:\WINDOWS\system32\mlljk.dll O20 - Winlogon Notify: mllmn - C:\WINDOWS\system32\mllmn.dll O20 - Winlogon Notify: pmkhg - C:\WINDOWS\system32\pmkhg.dll O20 - Winlogon Notify: pmkjh - C:\WINDOWS\system32\pmkjh.dll O20 - Winlogon Notify: pmkjj - C:\WINDOWS\system32\pmkjj.dll O20 - Winlogon Notify: pmnli - C:\WINDOWS\system32\pmnli.dll O20 - Winlogon Notify: pmnll - C:\WINDOWS\system32\pmnll.dll O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll O20 - Winlogon Notify: pmnnl - C:\WINDOWS\system32\pmnnl.dll O20 - Winlogon Notify: ssqpm - C:\WINDOWS\system32\ssqpm.dll O20 - Winlogon Notify: sstqn - C:\WINDOWS\system32\sstqn.dll O20 - Winlogon Notify: sstqo - C:\WINDOWS\system32\sstqo.dll O20 - Winlogon Notify: sstqq - C:\WINDOWS\system32\sstqq.dll O20 - Winlogon Notify: ssttq - C:\WINDOWS\system32\ssttq.dll O20 - Winlogon Notify: sstts - C:\WINDOWS\system32\sstts.dll O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll O20 - Winlogon Notify: vtsqn - C:\WINDOWS\system32\vtsqn.dll O20 - Winlogon Notify: vtsqp - C:\WINDOWS\system32\vtsqp.dll O20 - Winlogon Notify: vtsqr - C:\WINDOWS\system32\vtsqr.dll O20 - Winlogon Notify: vtstq - C:\WINDOWS\system32\vtstq.dll O20 - Winlogon Notify: vtstu - C:\WINDOWS\system32\vtstu.dll O20 - Winlogon Notify: vturo - C:\WINDOWS\system32\vturo.dll O20 - Winlogon Notify: vtutq - C:\WINDOWS\system32\vtutq.dll O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll O20 - Winlogon Notify: vtutu - C:\WINDOWS\system32\vtutu.dll O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

ky331 · Answer

i think you've set the record... i see over 60 distinct Winfixer-related vundo/virtumundo trojans :-(

let's try the following first, just to see what (if anything) it will remove...

[be advised it may not change anything, but let's give it a shot]

http://forums.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=17240

if you've already downloaded the tool there on a prior occasion, please download it again, just to be sure you have the latest version.

when you're done, please REPLY and post your latest/updated HJT log.

Virus & Spyware

Winfixer 2005 - HJT log file

Was this post helpful?