Member Avatar for Slade

Hi all, I have run Adaware, Spybot and Spysweeper. All with updated spyware definitions, there is still some weird stuff going on with my pc, my notepad icon has gone, sometimes I can't open things in notepad, my browser keeps changing the home page... help? Here is my HJT log:

Logfile of HijackThis v1.97.7

Scan saved at 11:32:31 AM, on 28/05/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\atiptaxx.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\System32\rxecma.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*

R3 - Default URLSearchHook is missing

O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts

O1 - Hosts: lender-search.com

O1 - Hosts: hot-searches.com

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [fzvukzgv] C:\WINDOWS\System32\rxecma.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Messenger (HKLM)

O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Thanks in advance guys, your help is greatly appreciated.

Slade

  • 2 Contributors
  • 1 Reply
  • 127 Views
  • 13 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

The HJT output from points to hosts/proxy tampering, homepage redirection and a suspicious autorun executable living in a system folder. was right to advise terminating the running process and removing the file from startup while in Safe Mode — that is the immediate containment step.

Before deleting anything, capture a copy of the suspicious file for analysis, check its digital signature and submit it to an online multi-engine scanner. Use Sysinternals Process Explorer to inspect the running process (parent, full path, open handles) and Autoruns to find and disable any persistent Run keys, services or scheduled tasks. If the file cannot be removed while Windows is running, disable System Restore, reboot to Safe Mode and delete it there; then clear old restore points so the infection cannot be restored.

The missing Notepad icon and failure to open text files almost always means file-association damage. Restore the .txt association or reassign Notepad as the default handler (right‑click -> Open With -> Choose Program), or run these commands from an elevated command prompt:

assoc .txt=txtfile
ftype txtfile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"

After removal, repair system files and networking stacks as needed:

sfc /scannow
netsh winsock reset
netsh winhttp reset proxy

Rescan with a different, up-to-date anti‑malware engine (for example, a reputable on‑demand scanner) and re-run a clean HijackThis scan to confirm persistence is gone. If browser redirection or system instability continues after these steps, consider a repair/repair-install or a clean OS reinstall after backing up important data. Always back up the registry before edits and proceed cautiously when removing files from system folders.

Member Avatar for crunchie

Open Task Manager & end process on this file:
rxecma.exe

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked' :

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*

R3 - Default URLSearchHook is missing

O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: lender-search.com
O1 - Hosts: hot-searches.com

O4 - HKLM\..\Run: [fzvukzgv] C:\WINDOWS\System32\rxecma.exe

Reboot into safe mode following the instructions & navigate to & delete the following if found:

C:\WINDOWS\System32\rxecma.exe<<<<

Reboot normally.

commented: thanks crunch, you helped +26
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.