..

Discussion in 'adware, spyware & hijack cleaning' started by Tae Hoon, Feb 12, 2004.

Thread Status:
Not open for further replies.
  1. Tae Hoon

    Tae Hoon Guest

    Logfile of HijackThis v1.97.7
    Scan saved at 오전 5:43:25, on 2004-02-13
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Ahnlab\Smart Update Utility\AhnSDsv.exe
    C:\Program Files\Ahnlab\V3\MonSvcNT.EXE
    C:\WINDOWS\system32\srvany.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\resetservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\Mixer.exe
    C:\Program Files\Samsung SCX-1020 Series\ssbbbmgr.exe
    C:\Program Files\Ahnlab\Smart Update Utility\AhnSD.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Ahnlab\V3\MonSysNT.exe
    C:\Program Files\Samsung SCX-1020 Series\ssbbbmon.exe
    C:\WINDOWS\System32\RUNDLL32.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Documents and Settings\이성화\Local Settings\Temp\hijackthis[1].zip에 대한 임시 디렉터리 1\HijackThis.exe

    O2 - BHO: V3 - {76EAE03C-F2B1-4397-97E8-390920B7C2DC} - C:\Program Files\Ahnlab\V3\V3Bar.dll
    O3 - Toolbar: o_O?? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: V3 - {9E3849D6-41EF-4B2F-86B7-632EF90758E4} - C:\Program Files\Ahnlab\V3\V3Bar.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [myLinker] C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\myLinker\MLCaller.dll,StartupMLCaller /B
    O4 - HKLM\..\Run: [Samsung SCX-1020 Series] "C:\Program Files\Samsung SCX-1020 Series\ssbbbmgr.exe"
    O4 - HKLM\..\Run: [Configuration Loading] svchos1.exe
    O4 - HKLM\..\Run: [AHNSD] C:\Program Files\Ahnlab\Smart Update Utility\AhnSD.exe
    O4 - HKLM\..\RunServices: [Configuration Loading] svchos1.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Fileguri] "C:\Program Files\Freechal\Fileguri\FcConnect.exe" PathFileguri /background
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} (CodeAx Class) - http://ezhub.hanyang.ac.kr:8080/EP/web/common/cabfiles/CM_CodeAx.cab
    O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) - http://ezhub.hanyang.ac.kr:8080/EP/web/common/cabfiles/CM_ClientEXE.cab
    O16 - DPF: {091CDD73-1401-4643-9B9C-65B091C88685} (MyLinker Control) - http://onlinetoeic.contents.mylinker.co.kr/module/MyLinker.cab
    O16 - DPF: {2A9FBDB1-DDA7-47C1-B13D-61020DCF1799} (FcLinker Class) - http://messenger.freechal.com/install/freelinker.cab
    O16 - DPF: {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} (V3ProX Control) - http://ahnlabdownload.nefficient.co.kr/plugin/myv3/myv3.cab
    O16 - DPF: {66B30EA0-C033-4D4B-9F90-EA0AF07363AF} (BugsMediaPlayer Control) - http://so.bugs.co.kr/BugsOggPlay_9.CAB
    O16 - DPF: {72ED8878-6E16-4EA1-BDD6-3B21EF676E45} (CVTrace Control) - http://www.seevideo.co.kr/pub/cvideox/trace/cvtrace.cab
    O16 - DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} (XecureWeb 4.0 Client Control) - http://download.softforum.co.kr/XecureObject/XecureWeb/xw_install.cab
    O16 - DPF: {97154128-DC4C-4D5B-AF7C-CA7356238EC9} (Hanmail FileUpload Control) - http://wwl421.daum.net/hanmail-ax/HM_fileupload.cab
    O16 - DPF: {B2AEC562-9C98-459D-A596-6850EB2CE623} (comparison_4.comparison4) - http://www.omi.co.kr/search/chart_package/comparison4.CAB
    O16 - DPF: {BF22698D-3BED-4CB0-BA3A-64534FBC32B1} (SVWebPlayer Control) - http://www.seevideo.co.kr/pub/seevideo2002/SVWebPlayer.cab
    O16 - DPF: {CF362BDB-4EA2-11D5-AB47-000102913414} (SetGlb Control) - http://so.bugs.co.kr/SetGlb.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{186C4F66-E576-4A00-AD77-357A239E57E2}: NameServer = 166.104.239.11
    O17 - HKLM\System\CS1\Services\Tcpip\..\{186C4F66-E576-4A00-AD77-357A239E57E2}: NameServer = 166.104.239.11
    O17 - HKLM\System\CS2\Services\Tcpip\..\{186C4F66-E576-4A00-AD77-357A239E57E2}: NameServer = 166.104.239.11
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Hi Tae Hoon,

    This is your worst problem:
    http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.R&VSect=T

    Before you start please unzip hijackthis.exe to a folder of it´s own. The program creates backups in the folder it is in. In a Temp folder they easily disappear.

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    O4 - HKLM\..\Run: [Configuration Loading] svchos1.exe

    O4 - HKLM\..\RunServices: [Configuration Loading] svchos1.exe

    Then reboot and do an online virusscan, you will find several listed here: http://www.wilders.org/free_services_m.htm

    Regards,

    Pieter
     
Thread Status:
Not open for further replies.