Member Avatar for dannyhuangster

Logfile of HijackThis v1.99.1
Scan saved at 7:19:01 PM, on 3/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\mptsnv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCMAIN.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccVScan.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\DOCUME~1\DANNYH~1\LOCALS~1\Temp\Rar$EX00.000\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Nvidia] d:\hack\ultra edition\update.scr\dll\nvidia.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Network Log Provider (MSPMT) - Unknown owner - C:\WINDOWS\mptsnv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

  • 3 Contributors
  • 6 Replies
  • 129 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Short, targeted next steps that build on what and already suggested, aimed at a persistent IM/autorun infection when standard scans and the vendor tool did not fully remove it.

Start with containment and evidence collection: isolate the machine from the network so it cannot re-spread or pull down components. Save the HijackThis log you already posted and capture two more artifacts before deleting anything: an Autoruns CSV and a process snapshot. Autoruns will show every startup/run/service entry and the exact image path so you can locate the binary or DLL to submit or inspect (Autoruns download). Do not "fix" items unless you know what they are; disabling (unchecking) first is safer than immediate delete.

If a process keeps recreating itself, inspect it live with a process tool to see loaded modules, open handles and the parent process. That helps identify a dropper or persistence mechanism (Process Explorer). If Autoruns points to a file but Explorer won’t show it, consider alternate data streams or system-hidden folders and run a deeper scanner from clean media. A reputable anti-malware scanner is useful as a second opinion; run it after taking the Autoruns/process snapshots so you keep a record of changes.

If you still cannot remove the entry or find the file, collect the Autoruns output and process snapshot and post them with the HijackThis log to a specialized malware removal forum for analysis (examples include community malware-removal sections). Final recourse for persistent, stealthy infections is a full wipe and reinstall after backing up data (only copy known-good personal files), then change all passwords from an uncompromised device.

Cautions: do not run suspicious binaries on other machines, avoid random "fix" tools unless recommended by a trusted analyst, and change credentials only after the system is clean.

Recommended Answers

All 6 Replies

Member Avatar for dannyhuangster

please help!!1 anyone??!??

Member Avatar for ShaneMcP

First you want to start your computer in safe mode (I say that a lot :D).

Repeatedly strike the f8 key while your computer is booting up and select "Safe mode with networking"

Once Safe mode loads, try opening up internet explorer. Head to http://housecall.trendmicro.com and run their spyware/virus utility. Keep running it until it displays no results.

Also try download spybot and adaware. Update those programs and run them both until they don't find anything.

Also head to http://www.trendmicro.com/spyware-scan/
and run that utility.

Another option is physically removing the hard drive, hooking up to another computer as a secondary drive and running a virus scan on it. That requires some expertise.

Member Avatar for dannyhuangster

okay, i have done many scans with trendmicro spyware/virus utlity and also scanned with ad-aware, also, ive use the AIMFIX and i somehow still have the virus. any suggestions?

Member Avatar for crunchie

Please go to Jotti's or to and have this file scanned. Post the results back here.

d:\hack\ultra edition\update.scr\dll\nvidia.exe

Member Avatar for dannyhuangster

for some reason i cannot find that file in my d drive? help please!!

Member Avatar for crunchie

Go in to your control panel and then double click on Folder Options. Go to the View Tab and hit the radio button for 'Show hidden files and folders.' See if you can find it now.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.