Member Avatar for hbmarar

Hi to All,

When i start yahoo messenger, it throws a error CiceroUIWndFrame:YAHOOM~1.EXE -corrupt file. I dont know what causes it. Has it got any infection. I just made a full anit virus scan of my system yesterday night but the problem happens even now when istart yahoo messenger. Sometimes application crashes.

I am sure experts here would be able to give me some pointers and hoping so i paste below the hijackthis log. Please help me remove any malicious programs as i am not able to figure out a solution online googling.

Thanking you in advance, I remain

Hari

Logfile of HijackThis v1.99.1

Scan saved at 12:58:35, on 08/04/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\hkcmd.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\AVG\AVG8\avgscanx.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\AVG\AVG8\avgui.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Documents and Settings\Rekha\My Documents\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://in.yahoo.com/[/url]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [url]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R3 - URLSearchHook: (no name) -  - (no file)

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Rekha\LOCALS~1\Temp\system.exe

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\RunServices: [Microsoft Windows Update] C:\WINDOWS\system32\srshost.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart

O8 - Extra context menu item: &Search - [url]

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - [url]

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - [url]

O17 - HKLM\System\CCS\Services\Tcpip\..\{B3144229-7F33-4560-8116-9EABE997780A}: NameServer = 85.255.115.60,85.255.112.87

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.60 85.255.112.87

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.60 85.255.112.87

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.60 85.255.112.87

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Edited by mike_2000_17 because: Fixed formatting
  • 1 Contributor
  • 1 Reply
  • 276 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by hbmarar

Dani AI

Generated

— this looks like more than a single damaged Yahoo binary. The HijackThis output contains multiple persistence and network anomalies (altered startup entries, a suspicious service/startup item and nonstandard DNS settings). Those are classic signs of malware that can inject into other programs and cause UI/component errors such as the CiceroUIWndFrame dialog. Treat the machine as infected and clean it fully before trying to repair or reinstall Yahoo Messenger.

Immediate, safe workflow (do these in order)

  1. Disconnect the PC from the internet and back up personal files (documents, pictures) to an external drive — do not run any backed-up executables from that drive.
  2. Boot to Safe Mode (F8) and run a full scan with the installed antivirus. Then run a reliable on‑demand anti‑malware scanner (for example, Malwarebytes Anti‑Malware free) — if you cannot download on that PC, download on another machine and transfer the installer via USB.
  3. After removing detected items, repair Windows system files and disk errors and flush network stacks. The common commands to run from an Administrator command prompt are:
sfc /scannow
chkdsk C: /f
ipconfig /flushdns
netsh winsock reset

If a startup/Winlogon value was altered (common with these infections), restore the Winlogon Userinit value to just the Windows userinit executable. From an elevated command prompt this will set it back to the normal value:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe," /f

Do not run generic "registry cleaners" as a first step. They rarely remove root causes and can break the system; focus on removing the malware with targeted tools and restoring the few known Winlogon/startup values instead. If the infection is deep or system stability remains poor after cleanup, a clean OS reinstall (after securely backing up data) is the safest recovery path.

Member Avatar for hbmarar

Hi,

Doing a registry cleaning , would it help. Please do suggest me a free registry cleaner / optimiser if it would be of help in performance. Thanks.

Saff

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.