I THINK I'VE BEEN HIJACKED!! HijackThis Log included :)

Question

Silver_Dragon 0 Newbie Poster

20 Years Ago

Hi can someone help me clean my computer. I am being inundated by pop-ups that end in mainly .com/tau.html. I have downloaded HijackThis, and here is a copy of my log. Thanks in advance:!:

Logfile of HijackThis v1.99.1
Scan saved at 12:56:56 PM, on 6/8/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\SmFzb24\command.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Network Monitor\wnetmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Begone] "C:\Documents and Settings\Jason\My Documents\SpywareBeGone.exe" -FastScan
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\en2ul1f91.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SmFzb24\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

cybersecurity virus-malware

3 Contributors
6 Replies
592 Views
1 Day Discussion Span
Latest Post 20 Years Ago Latest Post by crunchie

Dani AI

Generated 10 Months Ago

Good progress so far — the pop‑ups stopping after the removal steps shows the active infection was addressed, and and correctly pointed you at the right places. A remaining low‑resolution/low‑color display after a Windows update is almost always a driver/restore‑point issue rather than a new infection. The following checklist fills the gaps in the thread and gives safe, practical next steps.

First, try the non‑destructive fixes: boot to “Last Known Good Configuration” (F8 at boot). If that does nothing, reinstall the video driver. In Device Manager uninstall the display adapter (or roll back the driver), reboot so Windows uses its basic VGA driver, then download and install the latest driver from the graphics card or laptop maker. If a normal uninstall fails, repeat the uninstall from Safe Mode and reboot. This usually restores full resolution and color.

Second, make sure the machine really is clean before rebuilding the system state: run up‑to‑date full scans with at least one mainstream anti‑malware tool plus a dedicated rootkit scanner, and use an autorun/startup viewer to confirm there are no hidden services or startup entries left. Clear System Restore (turn it off for all drives, reboot, then turn it back on) so you don’t accidentally reintroduce infected restore points; once everything is verified create a fresh restore point.

Finally, if the display still won’t return to normal or if you doubt the system’s integrity, either restore to a clean pre‑update point (if it’s known to be clean) or backup personal data and perform a clean OS reinstall. After that, follow ’s caution about applying major service packs only once the system is confirmed clean, and change any online passwords that were used while the machine was compromised.

All 6 Replies

crunchie 990 Most Valuable Poster

20 Years Ago

Please go here & install ALL critical updates required for your system, including service pack 1a for both XP and IE6.
Most malware is designed to attack unpatched XP systems - exploiting the available 'holes' - and can bypass third-party protection on an unpatched system. The most that can be done with an unpatched system is put a temporary bandage on it. Your system can potentially be reinfected within minutes of cleaning it.

==

Please download Look2Me-Destroyer.exe to your desktop.
Close all windows before continuing.
Double-click Look2Me-Destroyer.exe to run it.
Put a check next to Run this program as a task.
You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK.
When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
Once it's done scanning, click the Remove L2M button.
You will receive a Done Scanning[/color\ message, click OK.
When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
Your computer will then shutdown.
Turn your computer back on.
Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.

kylethedarkn 23 A.K.A. The Laughing Man

20 Years Ago

im 75% sure that these 2 are malware and key processes for the pop-ups

C:\WINDOWS\SmFzb24\command.exe
C:\Program Files\Network Monitor\netmon.exe

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Silver_Dragon 0 Newbie Poster · Answer 1 · 2006-06-08T20:07:10+00:00

Thanks for your help. Here are the 2 logs:

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 6/8/2006 2:57:11 PM

Infected! C:\WINDOWS\system32\mv0ml9d11.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007275.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007286.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007294.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007306.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007317.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007329.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007337.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007349.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007351.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007363.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007382.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007386.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP51\A0007397.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP52\A0007413.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP52\A0007425.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP55\A0007444.dll
Infected! C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP55\A0007448.dll
Infected! C:\WINDOWS\system32\mahtml.dll
Infected! C:\WINDOWS\system32\mv0ml9d11.dll
Infected! C:\WINDOWS\system32\n26q0cj5efo.dll
Infected! C:\WINDOWS\system32\nhwrsptb.dll
Infected! C:\WINDOWS\system32\pjustab.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\mv0ml9d11.dll
C:\WINDOWS\system32\mv0ml9d11.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007275.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007275.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007286.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007286.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007294.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007294.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007306.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP48\A0007306.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007317.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007317.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007329.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007329.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007337.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007337.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007349.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007349.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007351.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007351.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007363.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007363.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007382.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007382.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007386.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP50\A0007386.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP51\A0007397.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP51\A0007397.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP52\A0007413.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP52\A0007413.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP52\A0007425.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP52\A0007425.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP55\A0007444.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP55\A0007444.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP55\A0007448.dll
C:\System Volume Information\_restore{F63DFFF8-E9C0-4A71-9FA9-59E3439C82AE}\RP55\A0007448.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\mahtml.dll
C:\WINDOWS\system32\mahtml.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\mv0ml9d11.dll
C:\WINDOWS\system32\mv0ml9d11.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\n26q0cj5efo.dll
C:\WINDOWS\system32\n26q0cj5efo.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\nhwrsptb.dll
C:\WINDOWS\system32\nhwrsptb.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\pjustab.dll
C:\WINDOWS\system32\pjustab.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Extensions

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrators - Succeeded

Logfile of HijackThis v1.99.1
Scan saved at 3:05:31 PM, on 6/8/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\Jason\My Documents\SpywareBeGone.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\SmFzb24\command.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\NetMeeting\callcont.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Begone] "C:\Documents and Settings\Jason\My Documents\SpywareBeGone.exe" -FastScan
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SmFzb24\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2006-06-09T03:07:19+00:00

Please go here & install ALL critical updates required for your system, including service pack 1a for both XP and IE6.
Most malware is designed to attack unpatched XP systems - exploiting the available 'holes' - and can bypass third-party protection on an unpatched system. The most that can be done with an unpatched system is put a temporary bandage on it. Your system can potentially be reinfected within minutes of cleaning it.

Doesn't look like you have done this yet?

==

Can you please do the following.

===============

Open a command prompt by:

1. Clicking "Start", then "Run...".
2. Enter "cmd" (without the quotes).
3. Enter "services.msc" (without the quotes).

-

Now, locate and 'stop' the following services, if present:

Command Service (cmdService) owner ... (C:\WINDOWS\SmFzb24\command.exe)
Network Monitor owner ... (C:\Program Files\Network Monitor\netmon.exe)

Look carefully, since the name of the service (above) can be anywhere in the entry; also be careful not to 'stop' any required system services. Once stopped, set this service to disabled.

===============

Run HiJackThis then:

1. Click "Open the Misc Tools Section"
2. Click "Open Process manager"

-

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

C:\Program Files\winupdates\winupdates.exe
C:\WINDOWS\SmFzb24\command.exe
C:\Program Files\Network Monitor\netmon.exe

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.

===============

Scan with HiJackThis, then check(tick) the following, if present:

O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SmFzb24\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

folders...

C:\Program Files\winupdates
C:\WINDOWS\SmFzb24
C:\Program Files\Network Monitor

-

Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "".

-

Reboot.

===============

After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.

Silver_Dragon 0 Newbie Poster · Answer 3 · 2006-06-09T19:43:06+00:00

Thanks for your help. My pc started working fine yesterday after i completed the first steps. And today i realised i hadnt installed the service pack so i did that before i checked your next posts, and ive followed the rest of your instructions and its working great. One problem though, and it might be unrelated, but i installed a windows update this morning (before the service pack) and than it prompted me to reboot, and when my computer came back on, it was running with 6?bit colour (the lowest) and the lowest resolution. Ive tried to change this in the display properties but it wont allow it. So know i dont really know what to do. Id be really really grateful if you could help me with this problem as well. Thanks :)

Logfile of HijackThis v1.99.1
Scan saved at 2:38:54 PM, on 6/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SmFzb24\command.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\Program Files\outlook\outlook.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\Jason\My Documents\SpywareBeGone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Movie Maker\wmm2ae.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Begone] "C:\Documents and Settings\Jason\My Documents\SpywareBeGone.exe" -FastScan
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SmFzb24\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2006-06-10T03:03:06+00:00

First off I would suggest a system restore to before installing the windows update. I should have been more specific and told you not to install SP2 until your PC was clean, but to only install SP1, but all I wrote was to install SP1. SP2 is known to create issues on an infected PC.

I THINK I'VE BEEN HIJACKED!! HijackThis Log included :)

Dani AI

Recommended Answers Collapse Answers

All 6 Replies

Recommended Answers