..

Logfile of HijackThis v1.97.7
Scan saved at 오전 5:43:25, on 2004-02-13
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ahnlab\Smart Update Utility\AhnSDsv.exe
C:\Program Files\Ahnlab\V3\MonSvcNT.EXE
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Samsung SCX-1020 Series\ssbbbmgr.exe
C:\Program Files\Ahnlab\Smart Update Utility\AhnSD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Ahnlab\V3\MonSysNT.exe
C:\Program Files\Samsung SCX-1020 Series\ssbbbmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\이성화\Local Settings\Temp\hijackthis[1].zip에 대한 임시 디렉터리 1\HijackThis.exe

O2 - BHO: V3 - {76EAE03C-F2B1-4397-97E8-390920B7C2DC} - C:\Program Files\Ahnlab\V3\V3Bar.dll
O3 - Toolbar: ?? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: V3 - {9E3849D6-41EF-4B2F-86B7-632EF90758E4} - C:\Program Files\Ahnlab\V3\V3Bar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [myLinker] C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\myLinker\MLCaller.dll,StartupMLCaller /B
O4 - HKLM\..\Run: [Samsung SCX-1020 Series] "C:\Program Files\Samsung SCX-1020 Series\ssbbbmgr.exe"
O4 - HKLM\..\Run: [Configuration Loading] svchos1.exe
O4 - HKLM\..\Run: [AHNSD] C:\Program Files\Ahnlab\Smart Update Utility\AhnSD.exe
O4 - HKLM\..\RunServices: [Configuration Loading] svchos1.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Fileguri] "C:\Program Files\Freechal\Fileguri\FcConnect.exe" PathFileguri /background
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} (CodeAx Class) - http://ezhub.hanyang.ac.kr:8080/EP/web/common/cabfiles/CM_CodeAx.cab
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://ezhub.hanyang.ac.kr:8080/EP/web/common/cabfiles/CM_ClientEXE.cab
O16 - DPF: {091CDD73-1401-4643-9B9C-65B091C88685} (MyLinker Control) - http://onlinetoeic.contents.mylinker.co.kr/module/MyLinker.cab
O16 - DPF: {2A9FBDB1-DDA7-47C1-B13D-61020DCF1799} (FcLinker Class) - http://messenger.freechal.com/install/freelinker.cab
O16 - DPF: {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} (V3ProX Control) - http://ahnlabdownload.nefficient.co.kr/plugin/myv3/myv3.cab
O16 - DPF: {66B30EA0-C033-4D4B-9F90-EA0AF07363AF} (BugsMediaPlayer Control) - http://so.bugs.co.kr/BugsOggPlay_9.CAB
O16 - DPF: {72ED8878-6E16-4EA1-BDD6-3B21EF676E45} (CVTrace Control) - http://www.seevideo.co.kr/pub/cvideox/trace/cvtrace.cab
O16 - DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} (XecureWeb 4.0 Client Control) - http://download.softforum.co.kr/XecureObject/XecureWeb/xw_install.cab
O16 - DPF: {97154128-DC4C-4D5B-AF7C-CA7356238EC9} (Hanmail FileUpload Control) - http://wwl421.daum.net/hanmail-ax/HM_fileupload.cab
O16 - DPF: {B2AEC562-9C98-459D-A596-6850EB2CE623} (comparison_4.comparison4) - http://www.omi.co.kr/search/chart_package/comparison4.CAB
O16 - DPF: {BF22698D-3BED-4CB0-BA3A-64534FBC32B1} (SVWebPlayer Control) - http://www.seevideo.co.kr/pub/seevideo2002/SVWebPlayer.cab
O16 - DPF: {CF362BDB-4EA2-11D5-AB47-000102913414} (SetGlb Control) - http://so.bugs.co.kr/SetGlb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{186C4F66-E576-4A00-AD77-357A239E57E2}: NameServer = 166.104.239.11
O17 - HKLM\System\CS1\Services\Tcpip\..\{186C4F66-E576-4A00-AD77-357A239E57E2}: NameServer = 166.104.239.11
O17 - HKLM\System\CS2\Services\Tcpip\..\{186C4F66-E576-4A00-AD77-357A239E57E2}: NameServer = 166.104.239.11

 

Hi Tae Hoon,

This is your worst problem:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.R&VSect=T

Before you start please unzip hijackthis.exe to a folder of it´s own. The program creates backups in the folder it is in. In a Temp folder they easily disappear.

Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

O4 - HKLM\..\Run: [Configuration Loading] svchos1.exe

O4 - HKLM\..\RunServices: [Configuration Loading] svchos1.exe

Then reboot and do an online virusscan, you will find several listed here: http://www.wilders.org/free_services_m.htm

Regards,

Pieter