Member Avatar for jgc3912

I have got a system tray System Alert pop up. I have run all the
usual programs so far.

Logfile of HijackThis v1.97.7
Scan saved at 4:33:33 PM, on 10/28/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\drivers\CDAC11BA.EXE
D:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Agnitum\Outpost Firewall\outpost.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
D:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
D:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe
D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Program Files\AIM\aim.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
D:\WINNT\system32\ntvdm.exe
D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\VideoKeyCodec\isamonitor.exe
D:\Program Files\VideoKeyCodec\isamini.exe
D:\Program Files\VideoKeyCodec\pmsngr.exe
D:\Program Files\VideoKeyCodec\pmmon.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Joe Hill\Desktop\stng260.exe
D:\Program Files\Cleaners\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = -
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Quickenw\inet\common\blank.htm
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {09AA6C75-179E-42E0-82F7-302603339A82} - D:\Program Files\Blubster Toolbar\v\Blubster_Toolbar.dll
O2 - BHO: (no name) - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - D:\Program Files\Panicware\Pop-Up Stopper Pro\CCHelper.dll
O2 - BHO: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\YIESRVC.DLL
O2 - BHO: (no name) - {8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} - D:\Program Files\VideoKeyCodec\isaddon.dll
O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - D:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - D:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - D:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - D:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Toolbar\01.01.2607.0\en-us\msntb.dll
O3 - Toolbar: Blubster Toolbar - {7EFBC57C-CD57-481F-B794-648FCE9C9116} - D:\Program Files\Blubster Toolbar\v\Blubster_Toolbar.dll
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - D:\Program Files\FerretSoft\WebFerret\FerretBand.dll
O3 - Toolbar: Protection Bar - {1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} - D:\Program Files\VideoKeyCodec\iesplugin.dll
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] D:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB002" /M "Stylus CX4800"
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MMTray] "D:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Outpost Firewall] D:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] D:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\RunServices: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKCU\..\Run: [PPWebCap] D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = D:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://D:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Search -
O8 - Extra context menu item: &Viewpoint Search - res://D:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///D:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///D:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///D:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///D:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Outpost Firewall Pro Quick Tune (HKLM)
O9 - Extra button: Yahoo! Services (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{406A6D4A-CC11-4D5A-B580-8689C407EC02}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{406A6D4A-CC11-4D5A-B580-8689C407EC02}: NameServer =

  • 2 Contributors
  • 2 Replies
  • 120 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jgc3912

Dani AI

Generated

This thread describes a classic scareware/redirect incident: a persistent "System Alert" tray popup, a HijackThis log showing multiple browser helpers and autostart entries, and a successful cleanup after running a specialized remover and working in Safe Mode. pointed the OP toward a targeted removal approach, and confirmed that cleaning in Safe Mode removed the visible symptoms. For anyone arriving here later with the same problem, run through the following verification and follow‑up steps so the infection is really gone and does not return.

  • Re-scan the machine with an up‑to‑date full antivirus plus at least one on‑demand anti‑malware tool and a rootkit scanner. If possible, perform at least one scan from Safe Mode or from bootable rescue media.
  • Use an autorun inspection utility to enumerate every persistent start location (registry Run/RunServices/RunOnce, Scheduled Tasks, services and drivers, startup folders). Disable or note unknown entries before deleting files.
  • Inspect browser add‑ons, BHOs and toolbars; reset homepage/search provider and check proxy settings. Remove unfamiliar extensions and uninstall unwanted toolbars from Control Panel.
  • Verify the hosts file and DNS settings at the OS and at the router. If DNS or router settings were changed, reset the router to known good firmware/config and change the admin password.
  • Create a fresh diagnostic log (HijackThis or Autoruns) after cleanup and compare it with the original. If entries remain unclear, save the logs before making changes and seek advice from a trusted malware‑removal community.
  • After cleaning, change online passwords (start with email and banking), monitor accounts, and consider an image backup of the cleaned system.

A few cautions: keep the OS and browsers supported (legacy systems are high risk), run as a limited user for daily use, keep AV signatures current, and avoid installing unknown toolbars/codecs. Legitimate admin utilities can trigger antivirus "risk tool" detections—review context before deleting system files. When in doubt, make a full image backup before heavy registry or startup edits.

Recommended Answers

All 2 Replies

Member Avatar for Colin Mac

Download
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs as a 'RiskTool'; it is not a virus. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Member Avatar for jgc3912

Colin,
Thanks for the info. I went into safe mode and deleted the
nasties. All is well again.
good show.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.