revop trojan-please review hijack log

Discussion in 'adware, spyware & hijack cleaning' started by baileygrrrl, Apr 28, 2004.

Thread Status:
Not open for further replies.
  1. baileygrrrl

    baileygrrrl Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    3
    I ran Spybot S&D and then HijackThis. Please see my log below. I am having trouble getting rid of the Revop-C Trojan and I suspect others. Any other recommendations welcome. Many thanks!

    Logfile of HijackThis v1.97.7
    Scan saved at 7:30:33 PM, on 4/28/2004
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\APCI8ME.EXE
    C:\UNZIPPED\HIJACKTHIS1977[1]\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    F1 - win.ini: run=hpfsched
    O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
    O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\CALSDR.DLL (file missing)
    O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\CLEARS~1\CSIE.DLL (file missing)
    O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [IGESTD] C:\WINDOWS\SYSTEM\IGESTD.exe
    O4 - HKLM\..\Run: [PCLTSCMR] C:\WINDOWS\SYSTEM\PCLTSCMR.exe
    O4 - HKLM\..\Run: [TIPRDEFA] C:\WINDOWS\SYSTEM\TIPRDEFA.exe
    O4 - HKLM\..\Run: [TMSVEXXA] C:\WINDOWS\SYSTEM\TMSVEXXA.exe
    O4 - HKLM\..\Run: [uickTimeVRQ] C:\WINDOWS\SYSTEM\uickTimeVRQ.exe
    O4 - HKLM\..\Run: [BMSVINND] C:\WINDOWS\SYSTEM\BMSVINND.exe
    O4 - HKLM\..\Run: [cienceS] C:\WINDOWS\SYSTEM\cienceS.exe
    O4 - HKLM\..\Run: [ftif62nL] C:\WINDOWS\SYSTEM\ftif62nL.exe
    O4 - HKLM\..\Run: [MDIALOGC] C:\WINDOWS\SYSTEM\MDIALOGC.exe
    O4 - HKLM\..\Run: [RVVFPD] C:\WINDOWS\SYSTEM\RVVFPD.exe
    O4 - HKLM\..\Run: [TWND11nL] C:\WINDOWS\SYSTEM\TWND11nL.exe
    O4 - HKLM\..\Run: [DBCCR32O] C:\WINDOWS\SYSTEM\DBCCR32O.exe
    O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
    O4 - HKLM\..\Run: [ENSS] C:\WINDOWS\SYSTEM\ENSS.exe
    O4 - HKLM\..\Run: [SIDLEM] C:\WINDOWS\SYSTEM\SIDLEM.exe
    O4 - HKLM\..\Run: [TI9DGAGA] C:\WINDOWS\SYSTEM\TI9DGAGA.exe
    O4 - HKLM\..\Run: [APCI8ME] C:\WINDOWS\SYSTEM\APCI8ME.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [Simple Star Media Manager] C:\PROGRAM FILES\SIMPLE STAR\PHOTOSHOW DELUXE\DATA\XTRAS\MSSYSMGR.EXE
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Yahoo! Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version6/DLHelper.cab
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37930.4090972222
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
    O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://www.pqpc.com/plugin/axversion/1410/printQuick1410.cab
    O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebuzz.com/common/programs/swicdad.cab
     
    baileygrrrl, Apr 28, 2004
    #1
  2. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hi baileygrrrl,

    Welcome to Wilders.

    Some of the items are from viruses. Please do an on-line Virus scan. Some good online scans can be found HERE.

    Before you start, please unzip or move HijackThis to a separate folder of its own. The program will make backups in the folder it's in. These easily get lost in a temporary folder or a folder with other programs.

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
    O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\CALSDR.DLL (file missing)
    O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\CLEARS~1\CSIE.DLL (file missing)
    O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL

    O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun

    Download CWShredder and run. Be sure ALL other windows are closed and use the Fix button and follow the instructions you will receive.

    There also may be hidden files. See HERE for how to show hidden files.

    Then reboot into safe mode and delete:

    C:\WINDOWS\TWAINTEC.DLL
    C:\PROGRA~1\CLEARS~1\ <-- entire folder
    C:\WINDOWS\BXXS5.DLL

    Reboot and then post a fresh HijackThis log.

    Regards,
    Kent
     
    puff-m-d, Apr 28, 2004
    #2
  3. baileygrrrl

    baileygrrrl Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    3
    Thanks...

    OK I followed your instructions to the letter. Please find the fresh Hijack log below. Two of the files that you asked me to delete: C:\PROGRA~1\CLEARS~1\ <-- entire folder and C:\WINDOWS\BXXS5.DLL I was unable to find. Thanks again for your help.


    Logfile of HijackThis v1.97.7
    Scan saved at 10:18:57 PM, on 4/28/2004
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\TMNORXXA.EXE
    C:\UNZIPPED\HIJACKTHIS1977[1]\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [IGESTD] C:\WINDOWS\SYSTEM\IGESTD.exe
    O4 - HKLM\..\Run: [PCLTSCMR] C:\WINDOWS\SYSTEM\PCLTSCMR.exe
    O4 - HKLM\..\Run: [TIPRDEFA] C:\WINDOWS\SYSTEM\TIPRDEFA.exe
    O4 - HKLM\..\Run: [TMSVEXXA] C:\WINDOWS\SYSTEM\TMSVEXXA.exe
    O4 - HKLM\..\Run: [uickTimeVRQ] C:\WINDOWS\SYSTEM\uickTimeVRQ.exe
    O4 - HKLM\..\Run: [BMSVINND] C:\WINDOWS\SYSTEM\BMSVINND.exe
    O4 - HKLM\..\Run: [cienceS] C:\WINDOWS\SYSTEM\cienceS.exe
    O4 - HKLM\..\Run: [ftif62nL] C:\WINDOWS\SYSTEM\ftif62nL.exe
    O4 - HKLM\..\Run: [MDIALOGC] C:\WINDOWS\SYSTEM\MDIALOGC.exe
    O4 - HKLM\..\Run: [RVVFPD] C:\WINDOWS\SYSTEM\RVVFPD.exe
    O4 - HKLM\..\Run: [TWND11nL] C:\WINDOWS\SYSTEM\TWND11nL.exe
    O4 - HKLM\..\Run: [DBCCR32O] C:\WINDOWS\SYSTEM\DBCCR32O.exe
    O4 - HKLM\..\Run: [ENSS] C:\WINDOWS\SYSTEM\ENSS.exe
    O4 - HKLM\..\Run: [SIDLEM] C:\WINDOWS\SYSTEM\SIDLEM.exe
    O4 - HKLM\..\Run: [TI9DGAGA] C:\WINDOWS\SYSTEM\TI9DGAGA.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [TMNORXXA] C:\WINDOWS\SYSTEM\TMNORXXA.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [Simple Star Media Manager] C:\PROGRAM FILES\SIMPLE STAR\PHOTOSHOW DELUXE\DATA\XTRAS\MSSYSMGR.EXE
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Yahoo! Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version6/DLHelper.cab
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37930.4090972222
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://www.pqpc.com/plugin/axversion/1410/printQuick1410.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
     
    baileygrrrl, Apr 28, 2004
    #3
  4. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    first please copy all these files, zip them if possible and send them to me submit@thespykiller.co.uk
    C:\WINDOWS\SYSTEM\IGESTD.exe
    C:\WINDOWS\SYSTEM\PCLTSCMR.exe
    C:\WINDOWS\SYSTEM\TIPRDEFA.exe
    C:\WINDOWS\SYSTEM\TMSVEXXA.exe
    C:\WINDOWS\SYSTEM\uickTimeVRQ.exe
    C:\WINDOWS\SYSTEM\BMSVINND.exe
    C:\WINDOWS\SYSTEM\cienceS.exe
    C:\WINDOWS\SYSTEM\ftif62nL.exe
    C:\WINDOWS\SYSTEM\MDIALOGC.exe
    C:\WINDOWS\SYSTEM\RVVFPD.exe
    C:\WINDOWS\SYSTEM\TWND11nL.exe
    C:\WINDOWS\SYSTEM\DBCCR32O.exe
    C:\WINDOWS\SYSTEM\ENSS.exe


    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked


    O4 - HKLM\..\Run: [IGESTD] C:\WINDOWS\SYSTEM\IGESTD.exe
    O4 - HKLM\..\Run: [PCLTSCMR] C:\WINDOWS\SYSTEM\PCLTSCMR.exe
    O4 - HKLM\..\Run: [TIPRDEFA] C:\WINDOWS\SYSTEM\TIPRDEFA.exe
    O4 - HKLM\..\Run: [TMSVEXXA] C:\WINDOWS\SYSTEM\TMSVEXXA.exe
    O4 - HKLM\..\Run: [uickTimeVRQ] C:\WINDOWS\SYSTEM\uickTimeVRQ.exe
    O4 - HKLM\..\Run: [BMSVINND] C:\WINDOWS\SYSTEM\BMSVINND.exe
    O4 - HKLM\..\Run: [cienceS] C:\WINDOWS\SYSTEM\cienceS.exe
    O4 - HKLM\..\Run: [ftif62nL] C:\WINDOWS\SYSTEM\ftif62nL.exe
    O4 - HKLM\..\Run: [MDIALOGC] C:\WINDOWS\SYSTEM\MDIALOGC.exe
    O4 - HKLM\..\Run: [RVVFPD] C:\WINDOWS\SYSTEM\RVVFPD.exe
    O4 - HKLM\..\Run: [TWND11nL] C:\WINDOWS\SYSTEM\TWND11nL.exe
    O4 - HKLM\..\Run: [DBCCR32O] C:\WINDOWS\SYSTEM\DBCCR32O.exe
    O4 - HKLM\..\Run: [ENSS] C:\WINDOWS\SYSTEM\ENSS.exe
    O4 - HKLM\..\Run: [SIDLEM] C:\WINDOWS\SYSTEM\SIDLEM.exe
    O4 - HKLM\..\Run: [TI9DGAGA] C:\WINDOWS\SYSTEM\TI9DGAGA.exe
    O4 - HKLM\..\Run: [TMNORXXA] C:\WINDOWS\SYSTEM\TMNORXXA.exe
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab


    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Delete these files

    C:\WINDOWS\SYSTEM\IGESTD.exe
    C:\WINDOWS\SYSTEM\PCLTSCMR.exe
    C:\WINDOWS\SYSTEM\TIPRDEFA.exe
    C:\WINDOWS\SYSTEM\TMSVEXXA.exe
    C:\WINDOWS\SYSTEM\uickTimeVRQ.exe
    C:\WINDOWS\SYSTEM\BMSVINND.exe
    C:\WINDOWS\SYSTEM\cienceS.exe
    C:\WINDOWS\SYSTEM\ftif62nL.exe
    C:\WINDOWS\SYSTEM\MDIALOGC.exe
    C:\WINDOWS\SYSTEM\RVVFPD.exe
    C:\WINDOWS\SYSTEM\TWND11nL.exe
    C:\WINDOWS\SYSTEM\DBCCR32O.exe
    C:\WINDOWS\SYSTEM\ENSS.exe
    O4 - HKLM\..\Run: [SIDLEM] C:\WINDOWS\SYSTEM\SIDLEM.exe
    O4 - HKLM\..\Run: [TI9DGAGA] C:\WINDOWS\SYSTEM\TI9DGAGA.exe
    O4 - HKLM\..\Run: [TMNORXXA] C:\WINDOWS\SYSTEM\TMNORXXA.exe

    and Delete these folders

    C:\PROGRAM FILES \CLEARSEARCH

    then
    Reboot normally &

    Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

    Spybot - Search & Destroy from http://security.kolla.de
    AdAware 6 from http://www.lavasoft.de/support/download

    Run Sybot S&D

    After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

    Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    then reboot &

    Run ADAWARE

    Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
    the current ref file should read at least 01R300 28.04.2004 or a higher number/later date

    Then ........

    Make sure the following settings are made and on -------"ON=GREEN"
    From main window :Click "Start" then " Activate in-depth scan"

    then......

    click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

    then.........

    go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and "Let windows remove files in use at next reboot"

    then...... click "proceed" to save your settings.

    Now to scan it´s just to click the "Scan" button.

    When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries.

    reboot again

    then post a new hijackthis log to check what is left
     
    dvk01, Apr 29, 2004
    #4
  5. baileygrrrl

    baileygrrrl Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    3
    Again, thanks for your help. I just know I'm well on the way to getting rid of this damn virus!

    Followed your instructions, and fresh Hijack log is below:

    Logfile of HijackThis v1.97.7
    Scan saved at 5:27:08 PM, on 4/29/2004
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\MRTRENDL.EXE
    C:\HIJACK\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [MRTRENDL] C:\WINDOWS\SYSTEM\MRTRENDL.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [Simple Star Media Manager] C:\PROGRAM FILES\SIMPLE STAR\PHOTOSHOW DELUXE\DATA\XTRAS\MSSYSMGR.EXE
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Yahoo! Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version6/DLHelper.cab
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37930.4090972222
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://www.pqpc.com/plugin/axversion/1410/printQuick1410.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
     
    baileygrrrl, Apr 29, 2004
    #5
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...