Member Avatar for algismorales

Logfile of HijackThis v1.98.2
Scan saved at 4:56:56 PM, on 4/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\LEXPPS.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\NavNT\vptray.exe
D:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
D:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
D:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Ydvq\Pyywyd.exe
D:\Program Files\QuickTime\qttask.exe
D:\windows\system32\ngrkep.exe
D:\WINDOWS\system32\exp.exe
D:\WINDOWS\system32\wintask.exe
D:\Program Files\Media Access\MediaAccK.exe
D:\windows\system32\saie.exe
D:\WINDOWS\IEXPLOR.EXE
D:\Program Files\Media Access\MediaAccess.exe
D:\WINDOWS\system32\chkisn.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
D:\WINDOWS\zrdpktfo.exe
D:\WINDOWS\WinTask.exe
D:\WINDOWS\system\qdxcuo.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\WINDOWS\system32\wshprbda.exe
D:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
D:\Program Files\NavNT\defwatch.exe
D:\windows\system32\packager.exe
D:\Program Files\NavNT\rtvscan.exe
D:\Program Files\UBizNames\MyKey\keyservice.exe
D:\Program Files\UBizNames\MyKey\keyalive.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\MsgSys.EXE
D:\WINDOWS\system32\rundll32.exe
D:\Documents and Settings\Algis\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", ""); (D:\Documents and Settings\Algis\Application Data\Mozilla\Profiles\default\3y2cvua3.slt\)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (D:\Documents and Settings\Algis\Application Data\Mozilla\Profiles\default\3y2cvua3.slt\)
O2 - BHO: (no name) - {C18517DA-CA70-46CE-86F4-882F6B62E975} - D:\PROGRA~1\UBIZNA~1\MyKey\bms.dll
O3 - Toolbar: ¸¶ÀÌÅ°¿öµå(&K) - {46D387E9-41FC-4F71-A7C3-B0BEB3568F00} - D:\PROGRA~1\UBIZNA~1\MyKey\keyband.dll
O4 - HKLM\..\Run: [vptray] D:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [PrinTray] D:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Mqjehc] C:\Program Files\Ydvq\Pyywyd.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Desktop Search] D:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] D:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [farmmext] D:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [ngrkep] d:\windows\system32\ngrkep.exe
O4 - HKLM\..\Run: [PaciSoft] D:\WINDOWS\system32\pacis.exe
O4 - HKLM\..\Run: [exp.exe] D:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] D:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [Media Access] D:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [saie] d:\windows\system32\saie.exe
O4 - HKLM\..\Run: [D:\WINDOWS\IEXPLOR.EXE] D:\WINDOWS\IEXPLOR.EXE
O4 - HKLM\..\Run: [AtxBrw] D:\WINDOWS\IEXPLOR.exe
O4 - HKLM\..\Run: [7FoX33l] chkisn.exe
O4 - HKLM\..\Run: [AutoLoaderEnvoloAutoUpdater] "D:\DOCUME~1\Algis\LOCALS~1\Temp\~compoundinst0\auto_update_loader.exe" /HideUninstall /HideDir /PC=CP.SAV /ShowLegalNote=nonbranded
O4 - HKLM\..\Run: [pze] D:\Program Files\prpo\ishxpb.exe
O4 - HKLM\..\Run: [winrest] D:\WINDOWS\system32\drivers\user\clsnum.exe
O4 - HKLM\..\Run: [KeyAgent] D:\Program Files\UBizNames\MyKey\keylaunch.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [hzmfzpwrxrtysdeutseva] D:\WINDOWS\zrdpktfo.exe
O4 - HKLM\..\Run: [D:\WINDOWS\WinTask.exe] D:\WINDOWS\WinTask.exe
O4 - HKLM\..\Run: [PopMark] D:\WINDOWS\WinTask.exe
O4 - HKLM\..\Run: [ctmpsd] D:\WINDOWS\ctmpsd.exe
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Mo77RTJ2S] wshprbda.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\aklsp.dll
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/a1bin02.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) -
O16 - DPF: {BF628973-1E86-4D0E-B42C-EDDECFFABDBC} (Bugs AoD Class) -
O16 - DPF: {C0B285F6-DB2B-4908-9C58-F6D95397D747} -
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab
O16 - DPF: {FFFFFFFF-3C18-4A7E-A29D-E24F84B79BF1} -
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - D:\WINDOWS\isrvs\mfiltis.dll

  • 3 Contributors
  • 5 Replies
  • 202 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Summary and context: ’s LSP advice was applied and the three HijackThis items were fixed; correctly pointed out that this looks like a multi-component infection that sometimes requires a targeted removal (Calamity Jane–style fixes have been used for similar families). The single biggest current obstacle is the Kaspersky service crashing in Safe Mode; that behavior often indicates either a rootkit component or a conflict between the AV service and other non‑Microsoft drivers present during the simplified Safe Mode environment.

Recommended remediation sequence (safe, ordered steps):

1) Reboot to Normal Windows and update the AV engine and signatures before scanning.
2) Run a full AV scan in Normal Mode (some AV services behave more stably there).
3) If problems persist, perform a clean boot:
   - Start -> Run -> msconfig
   - Services tab: check "Hide all Microsoft services", disable unknown/nonessential services
   - Startup tab: disable unknown startup items, Apply -> Reboot
   - Re-run full AV scan.
4) Inspect Event Viewer (Start -> Run -> eventvwr.msc) for Kaspersky/service error entries and note any faulting module names.

If the scanner still fails or hidden components are suspected: prefer an offline/bootable rescue scan (bootable ISO/USB rescue environment) to scan outside Windows; run dedicated rootkit detectors (GMER/TDSSKiller or equivalent) from a trusted environment; use Sysinternals Autoruns and Process Explorer to identify and remove persistent startup entries and drivers. Before removing drivers or registry keys, export affected registry keys and back up critical data. Temporarily disable System Restore prior to large removals to prevent reinfection from restore points.

Verification and caution: after remediation, produce a fresh HijackThis scan to confirm removal and compare against the original log. Avoid running unfamiliar self‑described “all-in-one” removal tools without clear, versioned instructions. When a security product crashes in Safe Mode, an offline rescue scan plus controlled clean-boot troubleshooting is the most reliable path to a full, stable cleanup.

Recommended Answers

All 5 Replies

Member Avatar for nanosani

Download LSPFix and remove aklsp.dll

Fix these entries in hijackthis :

O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA}
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab

O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - D:\WINDOWS\isrvs\mfiltis.dll

Member Avatar for algismorales

Hi Nanosani. Thank you for your reply.
Alright, I downloaded lspfix, removed aklsp.dlll, and went ahead and fixed the 3 items from hijackthis.
How do I proceed now?
Thank you!

Member Avatar for algismorales

Hi Crunchie,
I followed the procedure you sent me, but I get stuck in the part where I start the KAV full system scan on the computer in safe mode. The scanning process begins, but after 10 or 15 seconds, I get a window that says

Kaspersky Antivirus Service has encountered a problem and needs to close. We are sorry for the inconvenience.

As soon as I closed, I rebooted the computer into Safe Mode again following the instructions given, including stopping the explorer.exe process as indicated, and when I start the full scan again, I get yet again the same window as I mentioned above. Do you have any suggestions as to what may be the problem? What should I do next?
Thanks for your help. I know we'll get to the bottom of this!

Member Avatar for crunchie

Not sure what the problem may be. Maybe you can do the scan in normal mode and see how it goes. I do not have enough info on this infection to give any positive advice, only that AFAIK, Calamity Jane's fix is the only one that works.
Post back when you have gone through the instructions again (in normal mode). Perhaps you will be able to run the scan in safe mode once you have one it in normal mode.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.